Deploy the ExtraHop Explore Appliance with VMware
The following procedure guides you through the deployment process of the ExtraHop Explore virtual appliance with the vSphere client running on a Windows machine. You should be familiar with administrating VMware ESX and ESXi environments before proceeding.
The Explore virtual appliance is distributed as an OVA package that includes a preconfigured virtual machine (VM) with a 64-bit, Linux-based OS that is optimized to work with VMware ESX and ESXi version 5.5 and later.
Important: | If you want to deploy more than one ExtraHop virtual appliance, do not clone an existing instance. Always start with the original deployment package when deploying additional instances. |
System requirements
Your environment must meet the following requirements to deploy a virtual Explore appliance:
- An existing installation of VMware ESX or ESXi server version 5.5 and later capable of
hosting the Explore virtual appliance. The Explore virtual appliance is available in the
following configurations:
EXA-XS EXA-S EXA-M EXA-L 4 CPUs 8 CPUs 16 CPUs 32 CPUs 8GB RAM 16 GB RAM 32 GB RAM 64 GB RAM 4 GB boot disk 4 GB boot disk 4 GB boot disk 4 GB boot disk 500 GB or smaller datastore disk 1.2 TB or smaller datastore disk 2.5 TB or smaller datastore disk 4.1 TB or smaller datastore disk Note: When you deploy an Explore appliance, a second virtual disk is required to store record data. The EXA-XS is preconfigured with a 500 GB datastore disk; however, you must manually add a second virtual disk to the other available EXA configurations. The minimum datastore disk size for all configurations is 150 GB. Consult with your ExtraHop sales representative or Technical Support to determine the datastore disk size that is best for your needs.
- A vSphere client
- An Explore virtual appliance license key.
- The following TCP ports must be open:
- TCP ports 80 and 443: Enables you to administer the Explore appliance through the Web UI. Requests sent to port 80 are automatically redirected to HTTPS port 443.
- TCP port 9443: Enables Explore nodes to communicate with other Explore nodes in the same cluster.
Deploy the Explore virtual appliance
To deploy the Explore virtual appliance, complete the following steps:
(Optional) Configure a static IP address through the CLI
The ExtraHop appliance is delivered with DHCP enabled. If your network does not support DHCP, no IP address is acquired, and you must configure a static address manually. To configure a static IP address, complete the following steps.
- Establish a console connection to the ExtraHop appliance.
- At the login prompt, type shell and then press ENTER.
- At the password prompt, type default, and then press ENTER.
-
To configure the static IP address, run the following commands:
Configure the Explore appliance
After you obtain the IP address for the Explore appliance, log into the Explore Admin UI through the following URL: https://<explore_ip_address>/admin and complete the following recommended procedures.
Note: | The default log in name is setup and the password is default. |
Register the ExtraHop appliance
Complete the following steps to apply a product key supplied by ExtraHop Support.
Tip: | To verify that your environment can
resolve DNS entries for the ExtraHop licensing server, open a terminal application
on your Windows, Linux, or Mac OS client and run the following
command:nslookup -type=NS d.extrahop.com If the name
resolution is successful, output similar to the following
appears:
Non-authoritative answer: d.extrahop.com nameserver = ns0.use.d.extrahop.com. d.extrahop.com nameserver = ns0.usw.d.extrahop.com. |
- In your browser, type the URL of the ExtraHop Admin UI, https://<extrahop_ip_address>/admin.
- Review the license agreement, select I Agree, and then click Submit.
- On the login screen, type setup for the username.
-
For the password, select from the following options:
- For 1U and 2U appliances, type the service tag number found on the pullout tab on the front of the appliance.
- For the EDA 1100, type the serial number displayed in the Appliance info section of the LCD menu. The serial number is also printed on the bottom of the appliance.
- For a virtual appliance, type default.
- Click Log In.
- In the System Settings section, click License.
- Click Manage License.
- Click Register.
- Enter the product key and then click Register.
- Click Done.
Create an Explore cluster
Before you begin
Log into the Admin UI of each Explore node, click Fingerprint in the Status section, and note the value listed in the Fingerprint field. The fingerprint of each node should be verified during the join process.If you are deploying three or more Explore nodes, join the nodes to create a cluster.
Important: | Each node that you join must have the same configuration (physical or virtual) and ExtraHop firmware version. |
Configure the system time
By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.
Note: | Time synchronization is critical to ensuring proper cluster operations and maintaining consistent views of data across both Discover and Explore appliances. We strongly recommend that you either keep the default system time setting or configure settings for a different NTP server. |
- In the System Settings section, click System Time.
- Click Configure Time.
- Click the Time Zone drop-down list and select a time zone. Click Save and Continue.
- Select the Use NTP server to set time radio button and then click Select.
- Type the IP addresses for the time server, and then click Save.
- Click Done.
- Click Sync Now to sync system time on the Explore appliance with the remote time server.
Configure email notifications
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
Pair the Explore appliance to Discover and Command appliances
After you deploy the Explore cluster, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore cluster before you can query records. If you manage all of your Discover appliances from a Command appliance, you only need to perform this procedure from the Command appliance.
Important: | If you have an Explore cluster, pair the Discover appliance to each Explore node so that the Discover appliance can distribute the workload across the entire Explore cluster. |
- Log into the Discover or Command appliance Admin UI.
- In the ExtraHop Explore Settings section, click Configure Explore Cluster.
- Click Add New.
- In the Host #1 Host field, type the hostname or IP address of any Explore appliance in the Explore cluster.
- For each additional Explore appliance in the cluster, click Add New and enter the individual hostname or IP address in the corresponding Host field.
- Click Save.
- Note the information listed for Fingerprint. Verify that the fingerprint listed on this page matches the fingerprint of the Explore appliance (Host #1) listed on the Fingerprint page in the Explore Admin UI.
- In the Explore Setup Password field, type the password of the Explore appliance.
- Click Join, and then click Done.
Send record data to the Explore appliance
After your Explore appliance is paired with all of your Discover and Command appliances, you must configure the type of records you want to store. See the following documentation for more information about Explore configuration settings, how to generate and store records, and how to create record queries.
- ExtraHop Explore Admin UI Guide
- ExtraHop Explore Settings section in the ExtraHop Admin UI Guide.
- Records section in the ExtraHop Web UI Guide.
- ExtraHop Trigger API Reference
Thank you for your feedback. Can we contact you to ask follow up questions?