ExtraHop Explore Admin UI Guide

To add a new disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. In the Email address text box, type the recipient email address.
4. Click Save.

To delete a disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. Click the red delete icon (X) to the right of the email address.
4. On the Delete page, click OK.

To configure the SNMP settings:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click SNMP.
3. On the SNMP Settings page, in the SNMP Monitor field, type the hostname for the SNMP trap receiver. Multiple names can be entered, separated by commas.
4. In the SNMP Community field, enter the SNMP community name.
5. In the SNMP Port field, type the SNMP port number for your network that is used by the SNMP agent to respond back to the source port on the SNMP manager.
   The default response port is 162.
6. Click Test Settings to verify that your SNMP settings are correct. If the settings are correct, you should see an entry in the SNMP log file on the SNMP server similar to the following:

   Connection from UDP: [192.0.2.0]:42164->[ 192.0.2.255]:162

   Where 192.0.2.0 is the IP address of your ExtraHop appliance and 192.0.2.255 is the IP address of the SNMP server.

7. Click Save.

SNMP does not provide a database of information that an SNMP monitored network reports. SNMP uses information defined by third-party management information bases (MIBs) that describe the structure of the collected data.

1. Go to the Network Settings section and click Notifications.
2. Under Notifications, click SNMP.
3. Under SNMP MIB, click the Download ExtraHop SNMP MIB.
   The file is typically saved to the default download location for your browser.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select the LDAP option and click Continue.

   Note:

   Clicking the back button in your browser during this procedure could result in lost changes.

3. On the LDAP Settings page, type the following information:

   Hostname

   Specifies the hostname or IP address of the LDAP server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Port

   Specifies the port on which the LDAP server is listening. Port 389 is the standard cleartext LDAP server port. Port 636 is the standard port for secure LDAP (ldaps/tls ldap).

   Base DN

   Specifies the base of the LDAP search used to find users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below. Consult your LDAP administrator to learn what your organization selects.

   • Active directory canonical name: example.com/people
   • LDAP base DN: ou=people,dc=example,dc=com

   Server Type

   Specifies the type of LDAP server. Select Posix or Active Direcrory.

   Search Filter

   Specifies the criteria used when searching the LDAP directory for user accounts. Examples include:

   objectclass=person
   objectclass=*
   &(objectclass=person)(ou=webadmins)

   A search filter of objectclass=* matches all entities and is the default wildcard.

   Search Scope

   Specifies the scope of the directory search when looking for user entities. Select one of the following options:

   • Single level: This option looks for users that exist in the base DN; not any subtrees. For example, with a Base DN value of dc=example,dc=com, the search would find a user uid=jdoe,dc=example,dc=com, but would not find uid=jsmith,ou=seattle,dc=example,dc=com.
   • Whole subtree: This option looks recursively under the base DN for matching users. For example, with a Base DN value of dc=example,dc=com, the search would find the user uid=jdoe,dc=example,dc=com and uid=jsmith,ou=seattle,dc=example,dc=com.

   Bind DN

   Specifies the Distinguished Name (DN) used by the ExtraHop appliance to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers. To verify whether anonymous binds are enabled, contact your LDAP administrator. Using the active directory canonical name example.com/people, Bind DN examples include: cn=admin, ou=users, dc=example,dc=com uid=nobody,ou=people,dc=example,dc=com

   Note:

   The standard login attribute for POSIX systems is uid. The standard login attribute for Active Directory systems is sAMAccountName.

   Bind Password

   Specifies the password used when authenticating with the LDAP server as the bind DN specified above. If you are using an anonymous bind, leave this setting blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.

   Encryption

   Specifies if encryption should be used when making LDAP requests. Options include:

   • None: This options specifies the use of cleartext TCP sockets, typically port 389.

     Warning:

     All passwords are sent across the network in cleartext in this mode.

   • LDAPS: This option specifies LDAP wrapped inside SSL, typically on port 636.
   • StartTLS: This option specifies the use of TLS LDAP, typically on port 389. (SSL is negotiated before any passwords are sent.)

   Full Access DN

   Specifies which users can access the Explore appliance admin UI. If a DN is specified, only users in the specified DN will be able to log in. If the field is left blank, all users in the base DN will be able to log in.

   Refresh Interval

   Specifies when LDAP user information is refreshed. Type a time value in the Refresh Interval field or leave the default setting of 1 hour. The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop appliance.

4. Click Test Settings.
   If the test succeeds, the message LDAP settings test succeeded appears. If the test fails, the message LDAP settings test failed appears. Resolve any errors before continuing.
5. Click Save & Continue.
6. Click Done.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select RADIUS from the Remote authentication method drop-down, then click Continue.
3. On the Add RADIUS Server page, type the following information:

   Host: The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Secret: The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout: The amount of time the ExtraHop appliance will wait for a response from the RADIUS server before it attempts to connect again.

4. Click Add Server.
5. Click Save and Finish.
6. Click Done.

   Note:

   Remote users have full write access permissions to the Admin UI.

1. Go to the Access Settings section and click Remote Authentication.
2. In the Methods section, select TACACS+ and click Continue.
3. On the Add TACACS+ Server page, enter the host, secret, and timeout information and click Add Server.
4. Add multiple servers as needed.
5. Click Continue.
6. Click Save & Finish.
7. Click Done.

   Note:

   By default, remote users have full write access.

You can manage which users are able to generate API keys on the ExtraHop appliance.

1. In the Access Settings section, click API Access.
2. In the Manage Access section, select one of the following options:
   • Allow all users to generate an API key

     Local and remote users can generate API keys.

   • Only local users can generate an API key

     Only users created on the appliance can generate API keys.

   • No users can generate an API key

     API keys cannot be generated. Selecting this option will delete any

3. Click Save Settings, then click OK, and then click Done.

After you log into the ExtraHop appliance, if API key generation is enabled, you can generate an API key.

1. In the Access Settings section, click API Access.
2. In the API Keys section, enter a description for the key, and then click Generate.

1. In the Access Settings section, click API Access.
2. In the Keys section, click the X next to the API key you want to delete.
3. Click OK.

1. In the Appliance Settings section, click System Time.
2. Click Configure Time.
3. Select your time zone from the drop-down list then click Save and Continue.
4. On the Time Setup page, select one of the following options:
   • Set time manually
   • Set time with NTP server
5. Select the Set time with NTP server radio button, then click Select.
   The pool.ntp.org public time server appears in the Time Server #1 field by default.
6. Type the IP address or fully qualified domain name (FQDN) for the time servers in the Time Server fields. You can have up to nine time servers.

   Tip:	After adding the fifth time server, click Add Server to display up to four additional timer server fields.

7. Click Done.

1. On the Admin page in the Appliance Settings section, click Shutdown or Restart.
2. Select Restart for the component you want to restart:
   • System (can also be shutdown completely)
   • Admin
   • Receiver
   • Search

1. In the Appliance Settings section, click License.
2. On the License Administration page, under System Information, view the Extra Hop appliance information.

1. In the Appliance Settings, click License.
2. Click Manage license.
3. (Optional): Click Test Connectivity to ensure that the ExtraHop appliance can communicate with the licensing server.

   The ExtraHop license server determines whether a connection is possible through DNS records.

   If the test does not pass, open DNS server port 53 to make a connection or contact your network administrator.

4. Click Register and wait for the licensing server to finish processing.

   Note:

   Register is unavailable on Discover appliances that are managed by a Command appliance.

5. Click Done.

1. In the Appliance Settings section, click License.
2. Click Manage License.
3. Click Update.
4. In the Enter License text box, enter the licensing information for the module.

   License information must include the dossier and service tag number for the ExtraHop appliance as well as key-value pairs to enable the module licenses and other ExtraHop appliance features. In the license information, a key-value pair with a value of 1 enables the feature or module; a key-value pair with a value of 0 disables the feature or module. For example:

   -----BEGIN EXTRAHOP LICENSE-----
   serial=ABC123D;
   dossier=1234567890abcdef1234567890abcdef;
   mod_cifs=1;
   mod_nfs=1;
   mod_amf=0;
   live_capture=1;
   capture_upload=1;
   10G=1;
   triggers=0;
   poc=0;
   early_access_3.1=0;
   activity_map=1;
   ssl_acceleration=0;
   ssl_decryption=0;
   +++;
   ABCabcDE/FGHIjklm12nopqrstuvwXYZAB12345678abcde901abCD;
   12ABCDEFG1HIJklmnOP+1aA=;
   =abcd;
   -----END EXTRAHOP LICENSE-----

5. Click Update.

You can download the Running Config settings to your workstation in text file format. You can open this text file and make changes to it locally, before copying those changes into the Running Config window.

1. Click Running Config.
2. Click Download config as a File.