Admin UI Guide

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select the LDAP option and click Continue.

   Note:

   Clicking the back button in your browser during this procedure could result in lost changes.

3. On the LDAP Settings page, complete the following server information fields:
   1. Type the hostname or IP address of the LDAP server in the Hostname field. Make sure that the DNS entry of the ExtraHop appliance is properly configured if you type a hostname.
   2. Type the port number on which the LDAP server is listening in the Port field. Port 389 is the standard cleartext LDAP server port. Port 636 is the standard port for secure LDAP (ldaps/tls ldap).
   3. Select the type of LDPA server from the Server Type drop-down list. Select Posix or Active Direcrory.
   4. Type the bind DN in the Bind DN field. The bind DN is the user credentials that allow you to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers.

      Note:

      The standard login attribute for POSIX systems is uid. The standard login attribute for Active Directory systems is sAMAccountName.

   5. Type the bind password in the Bind Password field. The bind password is the password required when authenticating with the LDAP server as the bind DN specified above. If you are configuring an anonymous bind, leave this setting blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.
   6. Select on of the following encryption options from the Encryption drop-down list.
      • None. This options specifies the use of cleartext TCP sockets, typically port 389.

        Warning:

        All passwords are sent across the network in cleartext in this mode.

      • LDAPS. This option specifies LDAP wrapped inside SSL, typically on port 636.
      • StartTLS. This option specifies the use of TLS LDAP, typically on port 389. (SSL is negotiated before any passwords are sent.)
   7. Select Validate SSL Certificates to enable certificate validation. If you select this option, the certificate on the remote endpoint is validated against the root certificate chains specified by the trusted certificates manager. In addition, the host name specified in the certificate presented by the LDAP server must match the host name specified in your LDAP configuration or validation will fail. You must configure which certificates you want to trust on the Trusted Certificates page. For more information, see Add a trusted certificate to your ExtraHop appliance.
   8. Type a time value in the Refresh Interval field or leave the default setting of 1 hour. The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop appliance.
4. Configure the following user settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user accounts.
   3. Select one of the following options from the Search Scope drop-down list. Search scope specifies the scope of the directory search when looking for user entities.
      • Whole subtree. This option looks recursively under the base DN for matching users. For example, with a Base DN value of dc=example,dc=com, the search would find the user uid=jdoe,dc=example,dc=com and uid=jsmith,ou=seattle,dc=example,dc=com.
      • Single level. This option looks for users that exist in the base DN; not any subtrees. For example, with a Base DN value of dc=example,dc=com, the search would find a user uid=jdoe,dc=example,dc=com, but would not find uid=jsmith,ou=seattle,dc=example,dc=com.
5. To configure user group settings, select the Import user groups from LDAP server checkbox and configure the following settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for user groups. The base DN must contain all user groups that will have access to the ExtraHop appliance. The user groups can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user groups.
   3. Select one of the following options from the Search Scope drop-down list. Search scope specifies the scope of the directory search when looking for user group entities.
      • Whole subtree. This option looks recursively under the base DN for matching user groups.
      • Single level. This option looks for user groups that exist in the base DN; not any subtrees.
6. Click Test Settings. If the test succeeds, a status message appears near the bottom of the page. If the test fails, click Show details to see a list of errors. You must resolve any errors before you continue.
7. Click Save and Continue.

Determine whether you want to allow local or remote authentication.

1. Choose one of the following options from the Permission assignment options drop-down list:
   • Obtain permissions level from remote server

     If you want to obtain a permissions level from a remote server, select the Obtain permissions level from remote server option and complete at least one of the following fields to specify the remote permissions:

     • Full access DN
     • Read-write DN
     • Limited DN
     • Personal DN
     • Node connection privileges DN

       Note:

       This field is visible only on the Command appliance.

     • Read-only DN
     • Read-limited DN
     • Packet access full DN

     These fields must be groups (not organizational units) that are pre-specified on the LDAP Server. A user account with access must be a direct member of a specified group. User accounts that are a member of a group that is a member of a group specified above will not have access. If the groups are not present, they will not be authenticated on the ExtraHop appliance.

     The ExtraHop appliance supports the following types of group membership:

     • Active Directory: memberOf
     • Posix: posixGroups, groupofNames, and groupofuniqueNames
   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI. To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.

   • Remote users have read-only access
     This option allows remote users to have read-only privileges to the ExtraHop Web UI. To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

2. Click Save and Finish.
3. Click Done.

1. In the Access Settings section, click Remote Authentication.
2. Select RADIUS from the Remote authentication method drop-down, then click Continue.
3. On the Add RADIUS Server page, type the following information:

   Host

   The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you specify a hostname.

   Secret

   The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout

   The amount of time the ExtraHop appliance waits for a response from the RADIUS server before attempting the connection again.

4. Click Add Server.
5. (Optional): Add additional servers as needed.
6. Click Continue.
7. By default, remote users have full write access. If you wish to grant all remote users read-only privileges by default, select Remote users have Read Only access.
8. (Optional): To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.
9. Click Save and Finish.
10. Click Done.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select TACACS+ from the Remote authentication method drop-down, then click Continue.
3. On the Add TACACS+ Server page, type the following information:

   Host: The hostname or IP address of the TACACS+ server. Make sure that the DNS of the ExtraHop appliance is properly configured if you are entering a hostname.

   Secret: The shared secret between the ExtraHop appliance and the TACACS+ server. Contact your TACACS+ administrator to obtain the shared secret.

   Timeout: The amount of time the ExtraHop appliance waits for a response from the TACACS+ server before attempting to connect again.

4. Click Add Server.
5. (Optional): Add additional servers as needed.
6. Click Save and Finish.
7. Choose one of the following options from the Permission assignment options drop-down list:
   • Obtain permissions level from remote server

     This option allows remote users to obtain permission levels from the remote server.

     Note that you must also configure the TACACS+ server. Set up the ExtraHop service by adding the attribute service = extrahop and setting one of the following permission levels:

     • setup = 1, which allows the user to create and modify all objects and settings on the ExtraHop Web UI and Admin UI
     • readwrite = 1, which allows the user to create and modify all objects and settings on the ExtraHop Web UI
     • limited = 1, which allows the user to create, modify, and share dashboards
     • readonly = 1, which allows the user to view objects in the ExtraHop Web UI
     • personal = 1, which allows the user to create dashboards for themselves and modify any dashboards that have been shared with them
     • limited_metrics = 1, which allows the user to view shared dashboards
     • packetsfull = 1, which allows the user to view and download packets for any of the above user permission levels

     For example:

     user = dave {
       ...    
       service = extrahop {    
       readonly = 1    
       } 
     }

   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI.

   • Remote users have read-only access

     This option allows remote users to have read-only permissions to the ExtraHop Web UI.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

8. (Optional): To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.
9. Click Save and Finish.
10. Click Done.

You can configure one or more allowed origins or you can allow access to the ExtraHop REST API from any origin.

1. In the Access Settings section, click API Access.
2. In the CORS Settings section, specify one of the following access configurations.
   • To add a specific URL, type an origin URL in the text box, and then click the plus (+) icon or press ENTER.

     The URL must include a scheme, such as HTTP or HTTPS, and the exact domain name. You cannot append a path; however, you can provide a port number.

   • To allow access from any URL, select the Allow API requests from any Origin checkbox.

     Note:

     Allowing REST API access from any origin is less secure than providing a list of explicit origins.

3. Click Save Settings and then click Done.

You can delete a URL from the list of allowed origins or disable access from all origins.

1. In the Access Settings section, click API Access.
2. In the CORS Settings section, modify one of the following access configurations.
   • To delete a specific URL, click the delete (X) icon next to the origin you want to delete.
   • To disable access from any URL, clear the Allow API requests from any Origin checkbox.
3. Click Save Settings.

To exclude a protocol module from the network capture:

1. Click System Configuration > Capture.
2. Click Excluded Protocol Modules.
3. Add Module to Exclude.
4. On the Select Protocol Module to Exclude page, from the Module Name dropdown, select the module that you want to exclude from the capture.
5. Click Add.
6. On the Excluded Protocol Modules page, click Restart Capture.
7. After the capture restarts, click OK.

To re-include a previously excluded protocol module:

1. Click System Configuration > Capture.
2. Click Excluded Protocol Modules.
3. On the Excluded Protocol Modules page, click Delete next to the module name for each module you want to re-include.
4. Click Restart Capture.
5. After the capture restarts, click OK.

1. In the System Configuration section, click Capture.
2. Click MAC Address Filters.
3. Click Add Filter.
4. In the MAC Address field, type the MAC address to exclude.
5. In the Mask field, type the mask to indicate how many bits, from left to right, the filter checks against the MAC address.
6. Click Add.
   In the following example, the full MAC address is excluded from the capture:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:FF:FF:FF

   In this example, only the first 24 bits are evaluated for exclusion:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:00:00:00

1. Click System Configuration > Capture.
2. Click MAC Address Filters.
3. On the MAC Address Filters page, click Delete next to the MAC address filter for each address you want to re-include.
4. Click OK.

1. Click System Configuration > Capture.
2. Click IP Address Filters.
3. Click Add Filter.
4. On the IP Address Filters page, enter either a single IP address you want to exclude, or an IP address mask in CIDR format for a range of IP addresses you want to exclude.
5. Click Add.

1. Click System Configuration > Capture.
2. Click IP Address Filters.
3. On the IP Address Filters page, click Delete next to the IP address filter for each address you want to re-include.
4. Click OK.

1. Go to the Configuration section and click Capture.
2. On the Capture Configuration page, click Port Filters.
3. Click Add Filter.
4. On the Port Address Filters page, enter the port you want to include.
   • To specify a source port you want to exclude, enter the port in the Source Port field.
   • To specify a destination port you want to exclude, enter the port in the Destination Port field.
5. From the IP Protcol drop-down list, select the protocol you want to exclude on the indicated port.
6. Click Add.

1. Click System Configuration > Capture.
2. Click Port Filters.
3. On the Port Address Filters page, click Delete next to the port you want to re-include.
4. Click OK.

1. Click System Configuration > Capture.
2. Click Psuedo Devices.
3. Click Add Device.
4. On the Add Pseudo Devices page, enter the following information:

   IP Address

   The IP address range for the device in CIDR notation.

   IP Address/subnet prefix length

   For example, 10.10.0.0/16 for IPv4 networks or 2001:db8::/32 for IPv6 networks.

   MAC

   A dummy MAC address for the device.

1. Click System Configuration > Capture.
2. Click Psuedo Devices.
3. On the Pseudo Devices page, click Delete next to the pseudo device you want to remove from the list.
4. Click OK.

The following procedure describes how to add custom protocol classification labels using the TDS (MS SQL Server) protocol as an example. By default, the ExtraHop appliance looks for TDS traffic on TCP port 1533.

1. In the System Configuration section, click Capture.
2. Click Protocol Classification.
3. Click Add Protocol.
4. On the Protocol Classification page, enter the following information:

   Name

   From the drop-down, select Add custom label....

   Name

   Enter TDS for the custom protocol name.

   Protocol

   From the drop-down, select an L4 protocol to associate with the custom protocol (TCP in this example).

   Source

   The source port for the custom protocol. (The default value of 0 specifies any source port.)

   Destination

   The destination port for the custom protocol. To specify a range of ports, put a hyphen between the first and last port in the range. For example, 3400-4400.

   Loose Initiation

   Select this checkbox if you want the classifier to attempt to categorize the connection without seeing the connection open. ExtraHop recommends selecting loose initiation for long-lived flows.

   By default, the ExtraHop appliance uses loosely-initiated protocol classification, so it attempts to classify flows even after the connection was initiated. You can turn off loose initiation for ports that do not always carry the protocol traffic (for example, the wildcard port 0).

5. Click Add.
6. Confirm the setting change, and then click Restart Capture for the change to take effect. This will briefly interrupt the collection of data.
7. After the capture restarts, a confirmation message appears. Click Done.
8. This change has been applied to the running config. When you save the change to the running config, it will be reapplied when the ExtraHop appliance restarts. Click View and Save Changes at the top of the screen.
9. Click Save to write the change to the default configuration.
10. After the configuration is saved, a confirmation message appears. Click Done.

1. Click System Configuration > Capture.
2. Click Protocol Classification.
3. On the Protocol Classification page, click Delete next to the protocol that you want to remove from the list.
4. Click OK.
5. This change has been applied to the running config. When you save the change to the running config, it will be reapplied when the ExtraHop system restarts. Click View and Save Changes at the top of the screen.
6. Click Save to write the change to the default configuration.
7. After the configuration is saved, a confirmation message appears. Click Done.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the SSL Decryption Keys section, click Add Keys.
4. In the Add PEM Certificate and RSA Private Key section, enter the following information:

   Name

   A friendly name for the added key.

   Enabled

   Deselect this checkbox if you do not want to enable this SSL certificate.

   Certificate

   The public key certificate information.

   Private Key

   The RSA private key information.

5. Click Add.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the SSL Decryption Keys section, click Add Keys.
4. In the Add PKCS#12/PFX File With Password section, enter the following information:

   Description

   A friendly name for the added key.

   Enabled

   Deselect this checkbox if you don't want to enable this SSL certificate.

   PKCS#12/PFX

   Click Choose File and browse to the file, select it, and click Open.

   Password

   The password for the PKCS#12/PFX file.

5. Click Add.
6. Click OK.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the Encrypted Protocols section, click Add Protocol.
4. On the Add Encrypted Protocol page, enter the following information:

   Protocol

   From the drop-down list, select the protocol you want to add.

   Key

   From the drop-down, select a previously set key.

   Port

   The source port for the protocol. By default this is set to 443, which specifies HTTP traffic.

5. Click Add.

1. Click System Configuration > Capture.
2. Click Open Data Context API.
3. On the Open Data Context API page, enter the following information:

   Enable Open Data Context API

   Check this checkbox to enable the Open Data Context API.

   TCP Port Enabled

   Check this checkbox to enable the TCP port for Open Data Context.

   TCP Port

   The port number of the enabled TCP port. By default, this is set to 11211.

   UDP Port Enabled

   Check this checkbox to enable the UDP port for Open Data Context.

   UDP Port

   The port number of the enabled UDP port. By default, this is set to 11211.

4. Click Save and Restart Capture.
5. Click OK.

The default session table size is 32768 entries. You can modify the running config to change the session table size, but increasing the session table size might impact memory consumption on the system and cause other issues. You must restart the capture to see these changes.

"jssession_table_size": 32768

1. Click System Configuration > Capture.
2. Click Network Overlay Decapsulation.
3. In the Settings section, select the Enabled checkbox next to NVGRE.
4. Click Save.

VXLAN is a UDP tunneling protocol is configured for specific destination ports. Decapsulation is not attempted unless the destination port in a packet matches the UDP destination port or ports listed in the VXLAN decapsulation settings.

1. Click System Configuration > Capture.
2. Click Network Overlay Decapsulation.
3. In the Settings section, select the Enabled checkbox next to VXLAN.
4. In the VXLAN UDP Destination Port text box, type a port number and click the green plus (+) .
   By default, port 4789 is added to the UDP Destination Port list. You can add up to eight destination ports.
5. Click Save.

1. Click Diagnostics > Offline Capture File.
2. Click the Offline - Upload Capture File radio button to turn on the setting to set the capture mode to offline.
   The capture process is stopped, the capture state is set to offline, and the datastore is cleared of all data.
3. Click Save to activate the new setting.
   When the system has set the capture to offline mode, the Upload a Capture File page is displayed.
4. To upload a capture file:
   1. Click Choose File, browse to the capture file that you want to upload, select the file and click Open.
   2. On the Offline Capture page, click Upload.
      The Discover appliance displays the Offline Capture Results page when the capture file uploads successfully.

The Capture mode settings in the Admin UI are also used to return the Discover appliance to online capture mode. When you choose to restart the ExtraHop online capture, the data loaded into the datastore from the offline capture file is deleted as soon as you save the online capture setting.

1. Click Diagnostics > Offline Capture File.
2. Click the Online - Live Traffic radio button.
3. Click Save.
4. At the prompt to restart the excap, click OK.

1. Under System Configuration, click Datastore and Customizations.
2. Click Reset Datastore.
3. (Optional): On the Reset Datastore page, specify whether to save customizations before you reset the datastore.
   • To retain the current customizations after the datastore is reset, select the Save Customizations checkbox.
   • To discard the current customizations after the datastore is reset, clear the Save Customizations checkbox and then type YES in the confirmation text box.
4. Click Reset Datastore.
5. Wait approximately one minute.
   When the datastore reset is complete, the browser will prompt you to restore customizations.
6. If you chose to restore customizations, the browser redirects to a detailed list of imported customizations.
7. Click OK.
8. Go to the Web UI to view the devices that were discovered after the datastore reset. Wait approximately one minute for the system to discover and display new devices.

1. Access the ExtraHop CLI using one of the following three methods:
   • From a USB keyboard and SVGA monitor directly connected to the ExtraHop appliance.
   • Using an RS-232 serial cable and a terminal-emulator program. The terminal emulator must be set to 115200 bps with 8 data bits, no parity, and 1 stop bit (8N1). Hardware flow control must be disabled.
   • Secure shell (SSH).
2. Connect to the ExtraHop appliance.
   The login is shell and the password is the service tag number on the pullout tab on the front panel of the ExtraHop appliance.
3. Enable the administration controls.
   The password is the service tag number on the rightfront bracket of the ExtraHop appliance.

   extrahop>enable

4. Reset the datastore.

   extrahop#reset datastore

5. Go to the Web UI to view the devices that were discovered after the datastore reset. Wait approximately one minute for the system to discover and display new devices.

If you configure an extended datastore for an ExtraHop appliance, the device hosting the datastore must be able to support the processing requirements of the appliance. If the device is too slow to write all data sent from the appliance, system performance might be degraded.

1. On an ExtraHop Discover or Command appliance, click the Settings icon.
2. Click System Health.
3. Scroll down to the Datastore section.
4. In the Disk Write Throughput chart, zoom in on a peak of blue and green.
   To zoom in on a time window, click and drag over the chart area.
5. Record the highest point of blue and green along with the amount of time it takes for activity to return to the baseline value.
   For example, in the following chart, the blue and green area peaks at 1.72 MB/sec and has returned to normal after 30 seconds:
   
   
6. The datastore must be able to write data at the highest rate for the amount of time it took for activity to return to normal.
   For example, in the previous example, the datastore would need to be able to write 1.7 MB/sec for 30 seconds.

Before you store metric data in an external datastore, you must make sure that the datastore has enough space to contain the amount of data generated by the appliance. The following procedure explains how you can calculate approximately how much free space you need for the datastore.

1. On an ExtraHop Discover or Command appliance, click the Settings icon.
2. Click System Health.
3. Scroll down to the Datastore section.
4. From the Store Lookback chart, record the Rate and Estimated Lookback for each cycle (or time period) that you want to store on the external datastore.
5. Calculate the amount of required space by applying the following formula:

   <rate> x <lookback_time>

   For example, consider the following chart:

   
   
   

   The following sequence shows how you can calculate the amount of space needed from the information in the chart:

   87.25KB/sec * 1.9days
   87.25KB/sec * 60sec * 60min * 24hr * 1.9days
   14322960 KB
   14 GB

   To store all of the 5 minute metrics from this appliance, you need 14 GB of free space.

You can create an active extended datastore for a Discover appliance to store metrics on.

1. Under System Configuration, click Datastore and Customizations.
2. Under Extended Datastore Settings, click Configure Extended Datastore.
3. On the Configure Extended Datastore page, click the name of the mount you want to create the extended datastore on.
4. In the Datastore Directory field, type a name for the datastore directory.
   The directory will be automatically created by the Discover appliance.
5. In the Datastore Size field, specify the maximum amount of data that can be stored on the datastore.
6. (Optional): To store 5-minute and 1-hour metrics on the extended datastore as well, select the Include 5-minute and 1-hour metrics checkbox.
   24-hour metrics are stored on the extended datastore regardless of whether you select this option.
7. (Optional): Specify whether to migrate existing metrics to the extended datastore.
   If you selected to store 5-minute and 1-hour metrics on the extended datastore, selecting this option will cause the appliance to migrate any 5-metrics and 1-hour metrics that the appliance had already collected from the local Discover appliance datastore to the extended datastore. Migrating 5-minute and 1-hour metrics to an extended datastore will leave more room to store 30-second metrics on the local datastore, which will increase the amount of high-resolution lookback available.

   Warning:

   While data is being migrated, the Discover appliance will not collect data and system performance will be degraded. The migration process will take more time under the following circumstances: If there is a large amount of data to migrate If the network connection to the NAS device hosting the datastore is slow If the write performance of the NAS device hosting the datastore is slow

   • To migrate existing metrics, click Move existing metrics to the extended datastore.
   • To retain existing metrics on the local datastore, click Keep existing metrics on the ExtraHop.
8. Select the Move existing radio button.
9. Select whether to overwrite older data when the datastore becomes full.
   • To overwrite older data when the datastore becomes full, click Overwrite.
   • To stop storing new metrics on the extended datastore when the datastore becomes full, click Stop writing.
10. Click Configure.
    After the storage is added, the Status reads Nominal.

You can change an active datastore into an archive datastore by disconnecting an active datastore from a Discover appliance. Once you have disconnected an active datastore, the datastore becomes read-only, and you can connect any number of Discover appliances to the datastore. Disconnecting from an active datastore does not delete any of the data stored on the datastore.

1. Click System Configuration > Datastore and Customizations.
2. Click Extended Datastore Settings > Configure Extended Datastore.
3. On the Configure Extended Datastore page, click the name of the mount that contains the datastore you want to disconnect from.
4. In the row of the datastore you want to disconnect from, click Disconnect Extended Datastare.
5. Type YES to confirm and then click OK.

After you disconnect from an active extended datastore, you can connect to that datastore as an archive datastore. Archive datastores are read-only and can be accessed by multiple Discover appliances simultaneously.

1. Under System Configuration, click Datastore and Customizations.
2. Under Extended Datastore Settings, click Configure Extended Datastore.
3. On the Configure Extended Datastore page, click the name of the mount that contains the archive datastore.
4. In the Datastore Directory field, type the path of the archive datastore directory.
5. Click Archive (Read Only).
6. Click Configure.

After you mount an NFS or CIFS share, you can update your ExtraHop appliance and import your existing metrics to that new ExtraHop appliance. To upgrade to a new ExtraHop appliance:

1. On the old ExtraHop appliance (ExtraHop A), write the metrics to an external store using the previous procedure, Add Storage Space.
2. On ExtraHop A:
   1. Click System Configuration > Datastores and Customizations.
   2. Click Extended Datastore Settings > Configure Extended Datastore.
   3. Click Disconnect Extended Datastore.
   4. Type YES in the confirmation text box and click OK.
3. On the new ExtraHop appliance (ExtraHop B):
   1. Click Configuration > Datastore and Customizations.
   2. Click Extended Datastore Settings > Import Metrics from External Datastore.
   3. Click the name of the datastore directory that you configured for ExtraHop A, then click Import Metrics.
   4. Type YES in the confirmation text box and click OK.

1. In the System Configuration section, click Datastore and Customizations.
2. In the Customizations section, click Manage Customizations.
3. In the Saved Customizations and Automatically Saved Customizations tables, view customizations.

You can download the current datastore configuration settings into a .json archive file that can be stored on your workstation. This archive file can be used to restore the datastore settings on the originating ExtraHop appliance, if problems occur. In addition, these settings can be uploaded to specify the datastore configuration settings in a new ExtraHop appliance.

1. In the System Configuration section, click Datastore and Customizations.
2. In the Customizations section, click Manage Customizations.
3. Click on the name of the saved customization that you want to download.
   The file is download to your browser's default download location.

Datastore configuration settings can be saved and, if necessary, saved settings can be used to restore the datastore to the last saved state.

1. In the System Configuration section, click Datastore and Customizations.
2. In the Customizations section, click Manage Customizations.
3. In either the Saved Customizations or the Automatically Saved Customizations table, click Restore next to the customization you want to restore.
4. Click OK to restore the datastore.
5. Click OK again.

The ExtraHop appliance lets you save the current datastore configuration settings and store them in memory. These saved configuration settings can be used at a later date to restore the datastore to the saved state.e

1. In the System Configuration section, click Datastore and Customizations.
2. In the Customizations section, click Save Customizations.
3. Click OK.

ExtraHop appliance datastore configuration can be exported and saved as a .json archive file. The datastore customization file can be uploaded to the ExtraHop appliance to restore customization settings on the original system or install datastore customization settings on a new ExtraHop appliance.

1. Click System Configuration > Datastore and Customizations.
2. Click Customizations > Upload and Restore Customizations.
3. On the Upload and Restore Customizations page, click Choose File, navigate to the datastore customization file that you want to upload and click Open.
4. Click Restore.
5. When the file is finished uploading, click OK.

1. Click System Configuration > Geomap Data Source.
2. Click GeoIP Database.
3. In the Change Source section, select the Upload New Database radio button, then click Choose File to upload a database in .dat or .mmdb format from your workstation.
4. Navigate to the file you want to upload and click Open.
5. Click Save.

1. Under System Configuration, click Geomap Data Source.
2. Click IP Location Override.
3. In the text box, type or paste a tab or comma-delimited list of overrides in the following format:

   IP address, latitude, longitude, city, state or region, country name, ISO
   alpha-2 country code

   For example:

   10.10.113.0/24, 38.907231, -77.036464, Washington, DC, United States, US
   10.10.225.25, 47.6204, -122.3491, Seattle, WA, United States, US

4. Click Save.

To save any modified system configuration settings:

1. Click Running Config.
2. Click Save config.
3. Review the comparison between the old running config and the current (new) running config.
4. If the changes are correct, click Save.
5. Click Done.

To revert your changes without saving them to disk:

1. Click Running Config.
2. Click Revert config.
3. Click Revert.
4. Click OK.
5. Click Done.

The default time server setting is pool.ntp.org. If you want to maintain the default setting, skip this procedure and go to the next section.

1. In the Appliance Settings section, click System Time.
2. Click Configure Time.
3. Click the Time Zone drop-down list and select a time zone.
4. Click Save and Continue.
5. On the Time Setup page, select one of the following options:
   • Set time manually

     Note:

     You cannot manually set the time if the Discover appliance is managed by a Command appliance.

   • Set time with NTP server
6. Select the Set time with NTP server radio button, then click Select.
   The pool.ntp.org public time server appears in the Time Server #1 field by default.
7. Type the IP address or fully qualified domain name (FQDN) for the time servers in the Time Server fields. You can add a maximum of nine time servers.

   Tip:	After adding the fifth time server, click Add Server to display up to four additional time server fields.

8. Click Save, and then click Done.

1. Click Appliance Settings > Shutdown or Restart.
2. Select whether to restart or shut down the system.
   • Click Shutdown, and then at the prompt, click Shut down.
   • Click Restart, and then at the prompt, click Restart.

1. Click Appliance Settings > Shutdown or Restart.
2. On the Shutdown or Restart page, under Bridge Status, click Restart.
3. At the prompt, click OK.
4. Click Done.

1. Click Appliance Settings > Shutdown or Restart.
2. On the Shutdown or Restart page, under Capture Status, click Restart.
3. At the prompt, click OK.
4. Click Done.

1. In the Appliance Settings section, click Shutdown or Restart.
2. In the Actions column for Portal Status, click Restart.
3. Click OK to confirm.

To view the licensing system information and the status of licensed modules on the ExtraHop appliance:

1. In the Appliance Settings section, click License.
2. On the License Administration page, under Modules, check the status column to verify that the add-in modules are enabled.

1. In the Appliance Settings, click License.
2. Click Manage license.
3. (Optional): Click Test Connectivity to ensure that the ExtraHop appliance can communicate with the licensing server.

   The ExtraHop license server determines whether a connection is possible through DNS records.

   If the test does not pass, open DNS server port 53 to make a connection or contact your network administrator.

4. Click Register and wait for the licensing server to finish processing.

   Note:

   Register is unavailable on Discover appliances that are managed by a Command appliance.

5. Click Done.

1. In the Appliance Settings section, click License.
2. Click Manage License.
3. Click Update.
4. In the Enter License text box, enter the licensing information for the module.

   License information must include the dossier and service tag number for the ExtraHop appliance as well as key-value pairs to enable the module licenses and other ExtraHop appliance features. In the license information, a key-value pair with a value of 1 enables the feature or module; a key-value pair with a value of 0 disables the feature or module. For example:

   -----BEGIN EXTRAHOP LICENSE-----
   serial=ABC123D;
   dossier=1234567890abcdef1234567890abcdef;
   mod_cifs=1;
   mod_nfs=1;
   mod_amf=0;
   live_capture=1;
   capture_upload=1;
   10G=1;
   triggers=0;
   poc=0;
   early_access_3.1=0;
   activity_map=1;
   ssl_acceleration=0;
   ssl_decryption=0;
   +++;
   ABCabcDE/FGHIjklm12nopqrstuvwXYZAB12345678abcde901abCD;
   12ABCDEFG1HIJklmnOP+1aA=;
   =abcd;
   -----END EXTRAHOP LICENSE-----

5. Click Update.

1. In the system health email notification, note which machine has the problematic disk.
2. In the ExtraHop Web UI for the identified machine, click the Settings button in the navigation bar, and go to the Disk page by doing either of the following:
   • Click Administration. Then, under Appliance Settings, click Disks.
   • Click the Disk Error link at the top of the page.
3. Under the section for the disk type (for example, Datastore), find the problematic disk and note the Slot number.

   Click RAID Disk Details to display more details.

4. Insert an identical disk into an available slot.
   The system detects the new disk and adds a new row (Disk Error Action) with a link to replace the bad disk.
5. Verify the new disk information:
   • Under Unused Disks on the Disk Details page, verify that the new disk is the same size, speed, and type as the disk being replaced.

   • Mouse over the old and new disks in the Drive Map. The new disk displays the message "Unconfigured(good), Spun Up."

     
6. Under the section for the disk type, click Replace with Disk in slot #n in the Disk Error Action row.

   The data begins copying over. The Copy Status row displays the progress. Mousing over the disk in the Drive Map shows the status.

   
7. After copying is complete, make sure that the copy process was successful:
   • Settings button and Settings page no longer display error messages.
   • Disk page shows the old disk under the Unused Disk section
8. Remove the old disk.

   The Drive Map now shows the new disk in green.

   

1. Ensure that your ExtraHop license has packet capture enabled.
   For more information, refer to Packet Captures.
2. In the Appliance Settings section, click Disks.

   If the Drive Map shows the last slot (Disk #5 on the EDA 2000, Disk #7 on the EDA 5000) in red, you must replace the SSD drive.

   
3. Insert the SSD drive into the last slot and wait for the LED on the drive to turn green.
4. In the Admin UI, refresh the browser.

   The Drive Map shows the last slot in yellow because the drive is not configured.

   
5. Next to SSD Assisted Packet Capture, click Enable.
6. Wait about 1 minute for the drive to be configured and brought online.
7. The browser automatically refreshes.

   The Drive Map shows the SSD drive as green and the Status changes to Online.