Deploy ERSPAN with an ExtraHop sensor and Brocade 5600 vRouter in AWS

In this section you will configure a new Brocade 5600v router within the public subnet created previously, and assign an Elastic IP to configure and test the setup through SSH.

1. Click the Console Home icon in the upper left corner to return to the AWS Management Console page.
2. In the Compute section, click EC2.
3. In the navigation pane, click Instances.
4. Click Launch Instance to start the Amazon Machine Image (AMI) wizard.
5. Click AWS Marketplace and type 5600 or Brocade vRouter in the Search AWS Marketplace Products field and then press ENTER.
6. Click the Select button next to Brocade 5600 Virtual Router/Firewall/VPN.
7. For this example, select the m4.large instance type and then click Next: Configure Instance Details.
8. On the Configure Instance Details page, complete the following steps:
   1. Type 1 in the Number of instances field.
   2. From the Network dropdown list, select the VPC you created in the first section of this guide.
   3. From the Subnet dropdown list, select the public subnet, 10.4.0.0/24.
   4. In the Network interfaces section at the bottom of the page, type 10.4.0.187 in the Primary IP field.
9. Click Next: Add Storage. Keep the default storage settings and then click Next: Tag Instance.
10. Type any name in the Value field for the Name key to identify the instance. Add any additional tags to identify this instance in the environment and then click Next: Configure Security Group.
11. Choose Select an existing security group and the select the default Security Group ID for your VPC.
    Ensure the rules created earlier have been applied. For example, SSH and ICMP are still listed and their source addresses are 0.0.0.0/0. Optionally, a new security group could be created specifically for this instance.
12. Click Review and Launch to launch and install the Brocade vRouter.
13. Review the selections and entries, especially the subnet and IP addresses. If costs are a concern, ensure the instance has stayed within the confines of the free trial. Click Launch to launch the instance and register the Brocade vRouter.
14. In the key pair dialog box, select Create a new key pair from the dropdown menu, type a friendly name and click the Download Key Pair button to download the key pair. Ensure you make note of the download location.
15. Click Launch Instances to finish the install process.
16. Click View Instances at the bottom of the Launch Status screen or select Instances from navigation pane. The instance, depending on the selections, might take a several minutes to be fully online.
17. After the instance has fully launched and the Status Checks are complete, click the Description tab at the bottom of the page. In the Network interfaces section, click eth0. Verify that the IP address is 10.4.0.187 (or the IP address configured earlier).
18. Click the link associated with the Interface ID. In this example, the ID is eni-f554a48d.
    
19. With the private interface of the Brocade vRouter selected, click on the Actions dropdown menu and select Change Source/Dest. Check.
20. Select the Disabled radio button and then click Save.
21. Create the private subnet interface for the Brocade vRouter by clicking Create Network Interface.
22. In the Create Network Interface dialog box, complete the following fields:

    Description

    Type a name to identify the private interface.

    Subnet

    From the dropdown list, select the subnet for 10.4.1.0/24.

    Private IP

    Type 10.4.1.10.

    Security groups

    Select the default VPS security group.

23. Click Yes, Create to create the new interface.
24. Select the private interface and then click on the Actions dropdown menu and select Change Source/Dest. Check.
25. Select the Disabled radio button and then click Save.
    Record or make note of the 10.4.1.10 network interface ID.
26. With the private interface still selected, click Attach.
27. Select your instance from the Instance ID dropdown list and then click Attach.
28. Return to the VPC Dashboard.
29. In the navigation pane, select Route Tables.
30. Select the route table associated with the private subnet 10.4.1.0/24.
31. Click the Routes tab and then click Edit.
32. Click Add another route. In the Destination field, type 0.0.0.0/0 and in the target field, type the interface ID noted in step 23 and then click Save. This route table should be associated with the private Interface ID of the Brocade vRouter and associated with the private subnet 10.4.1.0/24.
33. Allocate an Amazon Elastic IP, a dynamically allocated publicly routed IP, by selecting Elastic IPs from the navigation pane. Click Allocate New Address, and then click Yes, Allocate.
34. From the Actions drop-down menu, select Associate Address and set the following fields:

    Associate with

    Network Interface

    Network Interface

    Select the public interface ID of the Brocade vRouter. In this example, the ID is eni-f554a48d.

    Private IP address

    Select the public subnet assigned IP address. In this example, it is 10.4.0.187.

35. Click Yes, Associate.

In this section and the next, you will configure a new Linux AMI in order to verify the Brocade vRouter and ExtraHop Discover configuration. If other sources of traffic are available, then these sections can be skipped.

1. Click the Console Home icon in the upper left corner to return to the AWS Management Console page.
2. In the Compute section, click EC2.
3. In the navigation pane, click Instances.
4. Click Launch Instance to start the Amazon Machine Image (AMI) wizard.
5. Locate an Ubuntu Server image in the list and then click Select.
6. Select the t2.micro instance type and then click Next: Configure Instance Details.
7. On the Configure Instance Details page, complete the following steps:
   1. Type 1 in the Number of instances field.
   2. From the Network dropdown list, select the VPC you created in the first section of this guide.
   3. From the Subnet dropdown list, select the 10.4.1.0/24 subnet.
      A static IP is not necessary for this step, but make note of the IP address assigned to the instance. In this example, the IP is 10.4.1.50.
   4. The remaining settings can be left at their default values.
8. Click Next: Add Storage. No changes are necessary.
9. Click Next: Tag Instance. No changes are necessary.
10. Click Next: Configure Security Group.
11. On the Configure Security Group page, complete the following steps:
    1. Select Create a new security group.
    2. In the Security group name field, type a descriptive name. For example, Ubuntu Linux.
    3. In the Description field, type a description for this security group.
    4. Click Add Rule.
    5. Select All ICMP from the dropdown list.
    6. In the Source column, select Anywhere from the dropdown list and type 0.0.0.0/0 in the field.
    7. If SSH is not listed, click Add Rule.
    8. In the Source column, select Anywhere from the dropdown list and type 0.0.0.0/0 in the field.
    9. Click Review and Launch.
    10. Acknowledge that your security group is open to the world, and then click Launch.

        Note:

        This is a non-production configuration. Typically, traffic should not be configured open to the world.

    11. In the key pair dialog box, select Create a new key pair from the dropdown list. Type a name in the Key pair name field and click Download Key Pair. Make note of the download location and then click Launch Instances to finish the install process.

In this section, you will configure a new ExtraHop EDA 1000v sensor.

1. Click the Console Home icon in the upper left corner to return to the AWS Management Console page.
2. In the Compute section, click EC2.
3. In the navigation pane, click Instances.
4. Click Launch Instance to start the Amazon Machine Image (AMI) wizard.
5. Click Community AMIs.
6. Type ExtraHop in the Search community AMIs field and locate the ExtraHop Discover appliance 1000v 5.x.x.x AMI and click Select.
7. Select the t2.medium instance type and then click Next: Configure Instance Details.
8. In the Configure Instance Details page, complete the following steps:
   1. Type 1 in the Number of instances field.
   2. In the Network drop-down list, select the VPC created in the first portion of this guide.
   3. In the Subnet drop-down list, select the private subnet 10.4.1.0/24.
   4. In the Network interfaces section type 10.4.1.15 in the Primary IP field and then click Next: Add Storage.
9. Leave the default storage size at the default setting. Click Next: Tag Instance.
10. Tag the instance with a name to identify the instance. Add any additional tags for identifying this instance in the environment and then click Next: Configure Security Group.
11. On the Configure Security Group page, complete the following steps:
    1. Select Create a new security group.
    2. In the Security group name field, type a descriptive name. For example, EDA 1000v.
    3. In the Description field, type a description for this security group.
    4. Click Add Rule 6 times and configure each protocol type as follows:

    Type	Protocol	Port Range	Source
    SSH	TCP	22	Anywhere 0.0.0.0/0
    HTTP	TCP	80	Anywhere 0.0.0.0/0
    HTTPS	TCP	443	Anywhere 0.0.0.0/0
    Custom TCP Rule	TCP	2003	Anywhere 0.0.0.0/0
    Custom UDP Rule	UDP	2003	Anywhere 0.0.0.0/0
    All Traffic	ALL	0-65535	Custom IP 10.4.0.0/16
    All ICMP	ICMP	0-65535	Anywhere 0.0.0.0/0

12. Click Review and Launch.

    Note:

    If a Boot from General Purpose (SSD) dialog appears, select the first option and then click Next.

13. Review the instance selection and then click Launch.
14. In the Select an existing key pair page dialog box, select Proceed without a key pair from the drop-down list. Most of the configuration is completed through the Administration settings on the sensor, so a key pair is not necessary. Select the I acknowledge checkbox and then click Launch Instances.
15. Go to your Instances list in AWS. Confirm that the status checks have passed and note the instance IP.

In this section you will configure the ERSPAN and portmonitoring features on the Brocade vRouter to send ERSPAN traffic to the ExtraHop sensor.

1. From a remote machine, SSH to the vRouter.

   ssh -i <vrouter_private_key.pm> vyatta@<elastic_IP>

   Copy
2. Configure the ERSPAN interface by running the following commands:
   1. Enter configuration mode:

      configure

      Copy
   2. Set the local IP address for the ERSPAN interface:

      set interfaces erspan erspan1 local-ip 10.4.1.10

      Copy
   3. Set the remote IP address for the ERSPAN interface:

      set interfaces erspan erspan1 remote-ip 10.4.1.15

      Copy
   4. Set the following additional configuration:

      set interfaces erspan erspan1 ip tos inherit
      
      set interfaces erspan erspan1 ip ttl 255
      
      set interfaces erspan erspan1 mtu 1500

      Copy
   5. Display the configuration changes:

      show interfaces

      Copy
   6. Type commit and then press ENTER.
   7. Type save and then press ENTER to save the changes.
3. Configure the Port Monitor and ERSPAN source by running the following commands:

   Note:

   In this example, the source of the monitor is the internal interface of the Brocade vRouter. Additionally, the session and identifier numbers are arbitrary, but should not overlap other session IDs.

   1. Set the portmonitor session type:

      set service portmonitor session 25 type erspan-source

      Copy
   2. Set the source interface for portmonitoring:

      set service portmonitor session 25 source dp0s1

      Copy
   3. Set the destination interface for portmonitoring:

      set service portmonitor session 25 destination erspan1

      Copy
   4. Set the session identifier:

      set service portmonitor session 25 erspan identifier 200

      Copy
   5. Set the ERSPAN header type:

      set service portmonitor session 25 erspan header type-II

      Copy
   6. Set the ERSPAN direction:

      set service portmonitor session 25 source dp0s1 direction both

      Copy
   7. Type commit and then press ENTER.
   8. Type save and then press ENTER to save the changes.
      Port monitoring for the session is immediately enabled if the type, source, destination, ERSPAN identifier, and ERSPAN header type parameters are configured correctly.
   9. Type exit to leave configuration mode.
   10. Type show configuration to display the new configuration.
       Output similar to the following appears (truncated for clarity):

       erspan erspan1 {
                       ip {
                               tos inherit
                               ttl 255
                       }
                       local-ip 10.4.1.10
                       mtu 1500
                       remote-ip 10.4.1.15
               }
       .
       .
       portmonitor {
                       session 25 {
                               destination erspan1
                               erspan {
                                       header type-II
                                       identifier 200
                               }
                               source dp0s1 {
                                       direction both
                               }
                               type erspan-source
                       }
               }

       Copy
4. Log in to the ExtraHop system through https://<elastic_public_ip:8443>/extrahop and verify that the ExtraHop is receiving ERSPAN traffic from the vRouter from the Dashboards interface.