Deploy the ExtraHop Explore Appliance
In this guide, you will learn how to configure the rack-mounted ExtraHop Explore appliance and to join multiple Explore appliances to create an Explore cluster.
For the best performance, data redundancy, and stability, you must configure at least three Explore appliances in an Explore cluster.
System requirements
Your environment must meet the following requirements to deploy an Explore appliance:
- Appliance
- 2U of rack space and 2x750W of power
- Network Access
-
- The following TCP ports must be open:
- TCP ports 80 and 443
- Enables you to administer the Explore appliance through the Web UI. Requests sent to port 80 are automatically redirected to HTTPS port 443.
- TCP port 9443
- Enables Explore nodes to communicate with other Explore nodes in the same cluster.
- The following TCP ports must be open:
Install the Explore appliance
To install the Explore appliance, complete the following steps.
Before you begin
All Explore nodes in an Explore cluster must be physically located in the same datacenter. This configuration helps reduce any network latency that might affect the collection of records.Configure an IP address
DHCP is enabled by default on the ExtraHop appliance. When you power on the appliance, interface 1 attempts to acquire an IP address through DHCP. If successful, the IP address appears on the home screen of the LCD. If an IP address has not been configured, the LCD displays No IP.
If your network does not support DHCP, you can configure a static IP address through the LCD menu on the front panel or through the command-line interface (CLI).
Configure a static IP address through the CLI
You can access the CLI by connecting a USB keyboard and SVGA monitor to the appliance or through an RS-232 serial cable and a terminal-emulator program. The terminal emulator must be set to 115200 bps with 8 data bits, no parity, 1 stop bit (8N1), and hardware flow control should be disabled.
Configure a static IP address through the front panel
Complete the following steps to configure the IP address from the front panel. If an IP address has not been configured, the front panel displays No IP. If the system is plugged in and powered off, the LCD screen displays ExtraHop.
- Make sure that the default management interface is connected to the network and the link status is active.
- Press the select button (✓) to begin.
- Press the right arrow (>) button to select Net and then press the select button.
- Press the right arrow button twice to highlight DHCP and then press the select button.
- Press the right arrow button to select Static and then press the select button.
- Press the right arrow button to select IP and then press the select button. The currently configured IP address appears.
- Press the right arrow button until the first digit you want to change is highlighted.
- Press the select button. The digit blinks when selected. While the digit is blinking, press the left arrow (<) or right arrow (>) button to change the digit value.
- After you have chosen the correct digit, press the select button.
- Repeat steps 7-9 for each remaining digit you want to change.
-
Press the left arrow button to navigate to the up arrow
on the display and press the select button.
- On the Save screen, select Yes and then press the select button.
- Wait a moment to be redirected to the Net screen. Repeat the actions above to set the mask, gateway, and up to two DNS servers.
- Configure the iDRAC DHCP, IP, mask, gateway, and DNS in the same manner as the IP address.
Configure the Explore appliance
After you configure an IP address for the Explore appliance, log into the Explore Admin UI, https://<explore_ip_address>, and complete the following recommended procedures.
Note: | The default login username is setup and the password is the service tag number on the pullout tab on the front of the appliance. You can modify user names and passwords in the Explore Admin UI. |
Register the ExtraHop appliance
Complete the following steps to apply a product key.
If you do not have a product key, contact your ExtraHop account team.
Tip: | To verify that your environment can resolve DNS entries for the
ExtraHop licensing server, open a terminal application on your Windows, Linux, or
Mac OS client and run the following
command:nslookup -type=NS d.extrahop.com If the name
resolution is successful, output similar to the following
appears:
Non-authoritative answer: d.extrahop.com nameserver = ns0.use.d.extrahop.com. d.extrahop.com nameserver = ns0.usw.d.extrahop.com. |
- In your browser, type the URL of the ExtraHop Admin UI, https://<extrahop_ip_address>/admin.
- Review the license agreement, select I Agree, and then click Submit.
- On the login screen, type setup for the username.
-
For the password, select from the following options:
- For 1U and 2U appliances, type the service tag number found on the pullout tab on the front of the appliance.
- For the EDA 1100, type the serial number displayed in the Appliance info section of the LCD menu. The serial number is also printed on the bottom of the appliance.
- For a virtual appliance, type default.
- Click Log In.
- In the Appliance Settings section, click License.
- Click Manage License.
- Click Register.
- Enter the product key and then click Register.
- Click Done.
(Optional) Configure the 10GbE management port
- In the Network Settings section, click Connectivity.
- In the Interfaces section, click Interface 5 or Interface 6. Make sure you select the same interface as the physical port you connected the 10GbE cable to. Interface 5 is the 10GbE port to the left on the rear of the appliance.
- From the Interface Mode drop-down list, select Management Port.
- Configure the rest of the network settings.
- Click Save.
- In the Interfaces section, click Interface 1.
- From the Interface Mode drop-down list, select Disabled.
- Click Save.
- Click the View and Save Changes button at the top of the page to save the running config file.
- Click Save. Your connection to the Web UI through interface 1 is terminated.
- Log in to the Web UI again to connect through the newly configured 10GbE interface.
Configure the system time
By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.
Note: | Time synchronization is critical to ensuring proper cluster operations and maintaining consistent views of data across both Discover and Explore appliances. We strongly recommend that you either keep the default system time setting or configure settings for a different NTP server. |
Configure email notifications
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
You can receive the following alerts from the system:
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
Create an Explore cluster
If you are deploying more than one Explore appliance, join the appliances together to create a cluster. For optimal performance, we recommend that you set up three or more Explore appliances in a cluster to take advantage of data redundancy.
In the following example, the Explore appliances have the following IP addresses:
- Node 1: 10.20.227.177
- Node 2: 10.20.227.178
- Node 3: 10.20.227.179
You will join nodes 2 and 3 to node 1 to create the Explore cluster.
Important: | Each node that you join must have the same configuration (physical or virtual) and ExtraHop firmware version. |
Connect the Explore appliance to Discover and Command appliances
After you deploy the Explore appliance, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore appliance before you can query records.
Important: | If you have an Explore cluster of three or more Explore nodes, connect the Discover appliance to each Explore node so that the Discover appliance can distribute the workload across the entire Explore cluster. |
Note: | If you manage all of your Discover appliances from a Command appliance, you only need to perform this procedure from the Command appliance. |
Next steps
Important: | If you only deployed a single Explore appliance, after you connect to your Discover or Command appliance, you must log into the Admin UI on the Explore appliance and set the 0. | to
Send record data to the Explore appliance
After your Explore appliance is connected to all of your Discover and Command appliances, you must configure the type of records you want to store. See the following documentation for more information about Explore configuration settings, how to generate and store records, and how to create record queries.
- ExtraHop Explore Admin UI Guide
- ExtraHop Explore Settings section in the ExtraHop Admin UI Guide.
- Records section in the ExtraHop Web UI Guide.
- ExtraHop Trigger API Reference
Thank you for your feedback. Can we contact you to ask follow up questions?