In this guide, you will learn how to launch the ExtraHop Explore appliance AMI in your Amazon Web Services (AWS) environment, and join multiple Explore appliances to create an Explore cluster.
Your environment must meet the following requirements to deploy a virtual Explore appliance in AWS:
- An AWS account
- Access to the Amazon Machine Image of the ExtraHop Explore appliance
- An Explore appliance product key
- A m4.2xlarge instance type in AWS
- A datastore size between 186 GiB (200 GB) and 2328 GiB (2.5 TB)
|Important:||If you want to deploy more than one ExtraHop virtual appliance, create the new instance with the original deployment package or clone an existing instance that has never been started.|
Before you beginThe Amazon Machine Images (AMIs) of ExtraHop appliances are not publicly shared. Before you can start the deployment procedure, you must send your AWS account ID to email@example.com. Your account ID will be linked to the ExtraHop AMIs.
- Sign in to AWS with your user name and password.
- Click EC2.
- In the left navigation panel, under Images, click AMIs.
- Above the table of AMIs, change the Filter from Owned by Me to Private Images.
- In the filter box, type ExtraHop and then press ENTER.
- Select the checkbox next to the ExtraHop Explore appliance AMI and click Launch.
- On the Choose an Instance Type page, select m4.2xlarge, and then click Next: Configure Instance Details.
- In the Number of instances text box, type the number nodes in your Explore cluster.
- Click the Network drop-down list and select the default setting or one of your organization’s VPCs.
- From the Shutdown behavior drop-down list, select Stop.
- Click the Protect against accidental termination checkbox.
- Optional: Click the IAM role drop-down list and select an IAM role.
If you launched into a VPC and want to add more than one interface, scroll down
to the Network Interfaces section and click Add
Device to add additional interfaces to the instance.
Note: If you add more than one interface, make sure that each interface is on a different subnet.
- Click Next: Add Storage.
In the Size (GiB) field for the root
volume, type the size of the storage volume. The minimum datastore
size is 186 GiB (200 GB) and the maximum datastore size is 2328 GiB (2.5 TB). If
you specify a storage volume greater than 2047 GiB, you can safely ignore any
warning messages stating that root volumes of this size might result in the
instance not booting successfully.
Note: Consult with your ExtraHop sales representative or Technical Support to determine the datastore disk size that is best for your needs.
- Click Next: Tag Instance.
- In the Value field, type a name for the instance.
- Click Next: Configure Security Group.
On the Configure Security Group page, create a new
security group or add ports to an existing group.
If you already have a security group with the required ports for ExtraHop, you can skip this step.
- Select either Create a new security group or Select an existing security group. If you choose to edit an existing group, select the group you want to edit. If you choose to create a new group, type a name for the Security group and type a Description.
- Click the Type drop-down list, and select a protocol. Type the port number in the Port Range field.
For each additional port needed, click the Add
Rule button. Then click the Type
drop-down list, select a protocol, and type the port number in the
Port Range field.
The following ports must be open for the Explore appliance AWS instance:
- TCP ports 80 and 443: Enables you to administer the Explore appliance through the Web UI. Requests sent to port 80 are automatically redirected to HTTPS port 443.
- TCP port 9443: Enables Explore nodes to communicate with other Explore nodes in the same cluster.
- Click Review and Launch.
Select Make General Purpose (SSD)...(recommended) and
Note: If you select Make General Purpose (SSD)...(recommended), you will not see this step on subsequent instance launches.
- Scroll down to review the AMI details, instance type, and security group information, and then click Launch.
- In the pop-up window, click the first drop-down list and select Proceed without a key pair.
- Click the I acknowledge… checkbox and then click Launch Instance.
Click View Instances to return to the AWS Management
From the AWS Management Console, you can view your instance on the Initializing screen.
Under the table, on the Description tab, you can find an IP or hostname for the Explore appliance that is accessible from your environment.
After you obtain the IP address for the Explore appliance, log into the Explore Admin UI through the following URL: https://<explore_ip_address>/admin and complete the following recommended procedures.
Complete the following steps to apply a product key supplied by ExtraHop Support in an AWS environment.
|Tip:||To verify that your environment can
resolve DNS entries for the ExtraHop licensing server, open a terminal application
on your Windows, Linux, or Mac OS client and run the following
nslookup -type=NS d.extrahop.com
If the name resolution is successful, output similar to the following appears:
Non-authoritative answer: d.extrahop.com nameserver = ns0.use.d.extrahop.com. d.extrahop.com nameserver = ns0.usw.d.extrahop.com.
- In your browser, type the IP address of the ExtraHop appliance (https://<extrahop_management_ip>/admin).
- Review the license agreement, select I Agree, and click Submit.
On the log in screen, type setup for the user name and
the instance ID for the password.
You can find the Instance ID on the Description tab of an instance selected on the Initializing screen. Type the string of characters that follow i- (but not i- itself), and then click Log In.
- Click Please apply license in Admin UI.
- Click Register.
- Enter the product key, and then click Register.
- Click Done.
Before you beginLog into the Admin UI of each Explore node, click Fingerprint in the Status section, and note the value listed in the Fingerprint field. The fingerprint of each node should be verified during the join process.
If you are deploying three or more Explore nodes, join the nodes to create a cluster.
|Important:||Each node that you join must have the same configuration (physical or virtual) and ExtraHop firmware version.|
- Log into the Admin UI of any new Explore node.
- In the Cluster Settings section, click Join Cluster.
- In the Host text box, type the hostname or IP address of any of the other new nodes and then click Continue.
- Verify that the fingerprint displayed on the page matches the fingerprint of the Explore node that you are joining. If these fingerprints do not match, communication between the nodes might have been intercepted and altered.
- In the Setup Password field, type the password for the setup user.
- Click Join.
- In the Status section, click Cluster Status.
- Wait for the Status field to change to green.
Repeat steps 1 - 8 to join each additional node to the new cluster.
Note: Always join a new node to the existing cluster and not another unjoined node, or you will create multiple clusters.
- Click Cluster Members in the Cluster Settings section to confirm that all of the nodes are listed on the page.
The default time server setting is pool.ntp.org. If you want to maintain the default setting, skip this procedure and go to the next section.
- In the System Settings section, click System Time.
- Click Configure Time.
- Click the Time Zone drop-down list and select a time zone.
- Click Save and Continue.
- Select Use NTP server to set time and then click Select.
- Type the IP address or fully qualified domain name (FQDN) for the time servers in the Time Server fields.
- Click Save, and then click Done.
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
- In the Network Settings section, click Notifications.
- Click Email Server and Sender.
On the Email Settings page, type the following
- SMTP Server
- The IP address for the outgoing SMTP mail server.
Note: The SMTP server should be the FQDN or IP address of an outgoing mail server that is accessible from the management network. If the DNS server is set, then the SMTP server can be a FQDN, otherwise it needs to be an IP address
- Sender Address
- The email address for the notification sender.
- Click Save.
After you deploy the Explore cluster, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore cluster before you can query records. If you manage all of your Discover appliances from a Command appliance, you only need to perform this procedure from the Command appliance.
|Important:||If you have an Explore cluster, pair the Discover appliance to each Explore node so that the Discover appliance can distribute the workload across the entire Explore cluster.|
- Log into the Discover or Command appliance Admin UI.
- In the ExtraHop Explore Settings section, click Configure Explore Cluster.
- Click Add New.
- In the Host #1 Host field, type the hostname or IP address of any Explore appliance in the Explore cluster.
- For each additional Explore appliance in the cluster, click Add New and enter the individual hostname or IP address in the corresponding Host field.
- Click Save.
- Note the information listed for Fingerprint. Verify that the fingerprint listed on this page matches the fingerprint of the Explore appliance (Host #1) listed on the Fingerprint page in the Explore Admin UI.
- In the Explore Setup Password field, type the password of the Explore appliance.
- Click Join, and then click Done.
After your Explore appliance is paired with all of your Discover and Command appliances, you must configure the type of records you want to store. See the following documentation for more information about Explore configuration settings, how to generate and store records, and how to create record queries.