ExtraHop Trace Admin UI Guide

To add a new disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. In the Email address text box, type the recipient email address.
4. Click Save.

To delete a disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. Click the red delete icon (X) to the right of the email address.
4. On the Delete page, click OK.

To configure the SNMP settings:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click SNMP.
3. On the SNMP Settings page, in the SMTP Monitor field, type the hostname for the SNMP trap receiver. Multiple names can be entered, separated by commas.
4. In the SNMP Community field, enter the SNMP community name.
5. In the SNMP Port field, type the SNMP port number for your network that is used by the SNMP agent to respond back to the source port on the SNMP manager.
   The default response port is 162.
6. Click Test Settings. You cannot continue until the test is successful.
7. Click Save.

SNMP does not provide a database of information that an SNMP monitored network reports. SNMP uses information defined by third-party management information bases (MIBs) that describe the structure of the collected data.

1. Go to the Network Settings section and click Notifications.
2. Under Notifications, click SNMP.
3. Under SNMP MIB, click the Download ExtraHop SNMP MIB.
   The file is typically saved to the default download location for your browser.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select the LDAP option and click Continue.

   Note:

   Clicking the back button in your browser during this procedure could result in lost changes.

3. On the LDAP Settings page, type the following information:

   Hostname

   Specifies the hostname or IP address of the LDAP server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Port

   Specifies the port on which the LDAP server is listening. Port 389 is the standard cleartext LDAP server port. Port 636 is the standard port for secure LDAP (ldaps/tls ldap).

   Base DN

   Specifies the base of the LDAP search used to find users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below. Consult your LDAP administrator to learn what your organization selects.

   • Active directory canonical name: example.com/people
   • LDAP base DN: ou=people,dc=example,dc=com

   Server Type

   Specifies the type of LDAP server. Select Posix or Active Direcrory.

   Search Filter

   Specifies the criteria used when searching the LDAP directory for user accounts. Examples include:

   objectclass=person
   objectclass=*
   &(objectclass=person)(ou=webadmins)

   A search filter of objectclass=* matches all entities and is the default wildcard.

   Search Scope

   Specifies the scope of the directory search when looking for user entities. Select one of the following options:

   • Single level: This option looks for users that exist in the base DN; not any subtrees. For example, with a Base DN value of dc=example,dc=com, the search would find a user uid=jdoe,dc=example,dc=com, but would not find uid=jsmith,ou=seattle,dc=example,dc=com.
   • Whole subtree: This option looks recursively under the base DN for matching users. For example, with a Base DN value of dc=example,dc=com, the search would find the user uid=jdoe,dc=example,dc=com and uid=jsmith,ou=seattle,dc=example,dc=com.

   Bind DN

   Specifies the Distinguished Name (DN) used by the ExtraHop appliance to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers. To verify whether anonymous binds are enabled, contact your LDAP administrator. Using the active directory canonical name example.com/people, Bind DN examples include: cn=admin, ou=users, dc=example,dc=com uid=nobody,ou=people,dc=example,dc=com

   Note:

   The standard login attribute for POSIX systems is uid. The standard login attribute for Active Directory systems is sAMAccountName.

   Bind Password

   Specifies the password used when authenticating with the LDAP server as the bind DN specified above. If you are using an anonymous bind, leave this setting blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.

   Encryption

   Specifies if encryption should be used when making LDAP requests. Options include:

   • None: This options specifies the use of cleartext TCP sockets, typically port 389. Warning: All passwords are sent across the network in cleartext in this mode.
   • LDAPS: This option specifies LDAP wrapped inside SSL, typically on port 636.
   • StartTLS: This option specifies the use of TLS LDAP, typically on port 389. (SSL is negotiated before any passwords are sent.)

   Full Access DN

   Specifies which users can access the Admin UI on the ExtraHop appliance. If a DN is specified, only users in the specified DN will be able to log in with full write privileges. If the field is left blank, all users in the base DN will be able to log in with full write privileges.

4. Click Test Settings.
   If the test succeeds, the message LDAP settings test succeeded appears. If the test fails, the message LDAP settings test failed appears. Resolve any errors before continuing.
5. Click Save & Continue.
6. Click Done.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select RADIUS from the Remote authentication method drop-down, then click Continue.
3. On the Add RADIUS Server page, type the following information:

   Host: The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Secret: The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout: The amount of time the ExtraHop appliance will wait for a response from the RADIUS server before it attempts to connect again.

4. Click Add Server.
5. Click Save and Finish.
6. Click Done.

   Note:

   Remote users have full write access permissions to the Admin UI.

1. Go to the Access Settings section and click Remote Authentication.
2. In the Methods section, select TACACS+ and click Continue.
3. On the Add TACACS+ Server page, enter the host, secret, and timeout information and click Add Server.
4. Add multiple servers as needed.
5. Click Continue.
6. Click Save & Finish.
7. Click Done.

   Note:

   By default, remote users have full write access.

To save any modified system configuration settings:

1. Click Running Config.
2. Click Save config.
3. Review the comparison between the old running config and the current (new) running config.
4. If the changes are correct, click Save.
5. Click Done.

To revert your changes without saving them to disk:

1. Click Running Config.
2. Click Revert config.
3. Click Revert.
4. Click OK.
5. Click Done.

1. In the Appliance Settings section, click System Time.
2. Click Configure Time.
3. Click to select from the Select time zone drop-down list.
4. Click Save and Continue.
5. Select the Use NTP server to set time radio button, then click Select.
   The pool.ntp.org public time server is entered by default.
6. Change the default server address or add a second server address in the two available time server fields, and then click Save.
7. Click Done.

1. In the Appliance Settings section, click License.
2. On the License Administration page, under System Information, view the Extra Hop appliance information.

1. In the Appliance Settings, click License.
2. Click Manage license.
3. Optional: Click Test Connectivity to ensure that the ExtraHop appliance can communicate with the licensing server.

   The ExtraHop license server determines whether a connection is possible through DNS records.

   If the test does not pass, open DNS server port 53 to make a connection or contact your network administrator.

4. Click Register and wait for the licensing server to finish processing.

   Note:

   Register is unavailable on Discover appliances that are managed by a Command appliance.

5. Click Done.

1. In the Appliance Settings section, click License.
2. Click Manage License.
3. Click Update.
4. In the Enter License text box, enter the licensing information for the module.

   License information must include the dossier and service tag number for the ExtraHop appliance as well as key-value pairs to enable the module licenses and other ExtraHop appliance features. In the license information, a key-value pair with a value of 1 enables the feature or module; a key-value pair with a value of 0 disables the feature or module. For example:

   -----BEGIN EXTRAHOP LICENSE-----
   serial=ABC123D;
   dossier=1234567890abcdef1234567890abcdef;
   mod_cifs=1;
   mod_nfs=1;
   mod_amf=0;
   live_capture=1;
   capture_upload=1;
   10G=1;
   triggers=0;
   poc=0;
   early_access_3.1=0;
   activity_map=1;
   ssl_acceleration=0;
   ssl_decryption=0;
   +++;
   ABCabcDE/FGHIjklm12nopqrstuvwXYZAB12345678abcde901abCD;
   12ABCDEFG1HIJklmnOP+1aA=;
   =abcd;
   -----END EXTRAHOP LICENSE-----

5. Click Update.