ExtraHop Trace Admin UI Guide

To add a new disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. In the Email address text box, type the recipient email address.
4. Click Save.

To delete a disk notification email address:

1. In the Network Settings section, click Notifications.
2. Under Notifications, click Email Addresses.
3. Click the red delete icon (X) to the right of the email address.
4. On the Delete page, click OK.

Simple Network Management Protocol (SNMP) is a standard way of monitoring hardware and software on a network. SNMP collects information both by polling devices on the network and when SNMP-enabled devices send alerts to SNMP management stations. SNMP communities specify the group that devices and management stations running SNMP belong to, which specifies where information is sent. The community name identifies the group.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Network Settings section, click Notifications.
3. Click SNMP.
4. In the SNMP Monitor field, type the hostname for the SNMP trap receiver. Multiple names can be entered, separated by commas.
5. In the SNMP Community field, enter the SNMP community name. SNMP community names are case-sensitive.
6. In the SNMP Port field, type the SNMP port number for your network that the SNMP agent responds back to the source port on the SNMP manager. By default, this value is set to 162.
7. Click Test Settings to verify that your SNMP settings are correct. If the settings are correct, you should see an entry in the SNMP log file on the SNMP server similar to the following:

   Connection from UDP: [192.0.2.0]:42164->[ 192.0.2.255]:162

   Where 192.0.2.0 is the IP address of your ExtraHop appliance and 192.0.2.255 is the IP address of the SNMP server.

8. Click Save.

SNMP does not provide a database of information that an SNMP monitored network reports. SNMP uses information defined by third-party management information bases (MIBs) that describe the structure of the collected data.

1. Go to the Network Settings section and click Notifications.
2. Under Notifications, click SNMP.
3. Under SNMP MIB, click the Download ExtraHop SNMP MIB.
   The file is typically saved to the default download location for your browser.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select the LDAP option and click Continue.

   Note:

   Clicking the back button in your browser during this procedure could result in lost changes.

3. On the LDAP Settings page, type the following information:

   Hostname

   Specifies the hostname or IP address of the LDAP server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Port

   Specifies the port on which the LDAP server is listening. Port 389 is the standard cleartext LDAP server port. Port 636 is the standard port for secure LDAP (ldaps/tls ldap).

   Base DN

   Specifies the base of the LDAP search used to find users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below. Consult your LDAP administrator to learn what your organization selects.

   • Active directory canonical name: example.com/people
   • LDAP base DN: ou=people,dc=example,dc=com

   Server Type

   Specifies the type of LDAP server. Select Posix or Active Direcrory.

   Search Filter

   Specifies the criteria used when searching the LDAP directory for user accounts. Examples include:

   objectclass=person
   objectclass=*
   &(objectclass=person)(ou=webadmins)

   A search filter of objectclass=* matches all entities and is the default wildcard.

   Search Scope

   Specifies the scope of the directory search when looking for user entities. Select one of the following options:

   • Single level: This option looks for users that exist in the base DN; not any subtrees. For example, with a Base DN value of dc=example,dc=com, the search would find a user uid=jdoe,dc=example,dc=com, but would not find uid=jsmith,ou=seattle,dc=example,dc=com.
   • Whole subtree: This option looks recursively under the base DN for matching users. For example, with a Base DN value of dc=example,dc=com, the search would find the user uid=jdoe,dc=example,dc=com and uid=jsmith,ou=seattle,dc=example,dc=com.

   Bind DN

   Specifies the Distinguished Name (DN) used by the ExtraHop appliance to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers. To verify whether anonymous binds are enabled, contact your LDAP administrator. Using the active directory canonical name example.com/people, Bind DN examples include: cn=admin, ou=users, dc=example,dc=com uid=nobody,ou=people,dc=example,dc=com

   Note:

   The standard login attribute for POSIX systems is uid. The standard login attribute for Active Directory systems is sAMAccountName.

   Bind Password

   Specifies the password used when authenticating with the LDAP server as the bind DN specified above. If you are using an anonymous bind, leave this setting blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.

   Encryption

   Specifies if encryption should be used when making LDAP requests. Options include:

   • None: This options specifies the use of cleartext TCP sockets, typically port 389.

     Warning:

     All passwords are sent across the network in cleartext in this mode.

   • LDAPS: This option specifies LDAP wrapped inside SSL, typically on port 636.
   • StartTLS: This option specifies the use of TLS LDAP, typically on port 389. (SSL is negotiated before any passwords are sent.)

   Full Access DN

   Specifies which users can access the Explore appliance admin UI. If a DN is specified, only users in the specified DN will be able to log in. If the field is left blank, all users in the base DN will be able to log in.

   Refresh Interval

   Specifies when LDAP user information is refreshed. Type a time value in the Refresh Interval field or leave the default setting of 1 hour. The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop appliance.

4. Click Test Settings.
   If the test succeeds, the message LDAP settings test succeeded appears. If the test fails, the message LDAP settings test failed appears. Resolve any errors before continuing.
5. Click Save & Continue.
6. Click Done.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select RADIUS from the Remote authentication method drop-down, then click Continue.
3. On the Add RADIUS Server page, type the following information:

   Host: The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you use a hostname.

   Secret: The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout: The amount of time the ExtraHop appliance will wait for a response from the RADIUS server before it attempts to connect again.

4. Click Add Server.
5. Click Save and Finish.
6. Click Done.

   Note:

   Remote users have full write access permissions to the Admin UI.

1. Go to the Access Settings section and click Remote Authentication.
2. In the Methods section, select TACACS+ and click Continue.
3. On the Add TACACS+ Server page, enter the host, secret, and timeout information and click Add Server.
4. Add multiple servers as needed.
5. Click Continue.
6. Click Save & Finish.
7. Click Done.

   Note:

   By default, remote users have full write access.

You can manage which users are able to generate API keys on the ExtraHop appliance.

1. In the Access Settings section, click API Access.
2. In the Manage Access section, select one of the following options:
   • Allow all users to generate an API key

     Local and remote users can generate API keys.

   • Only local users can generate an API key

     Only users created on the appliance can generate API keys.

   • No users can generate an API key

     API keys cannot be generated. Selecting this option will delete any

3. Click Save Settings, then click OK, and then click Done.

After you log into the ExtraHop appliance, if API key generation is enabled, you can generate an API key.

1. In the Access Settings section, click API Access.
2. In the API Keys section, enter a description for the key, and then click Generate.

1. In the Access Settings section, click API Access.
2. In the Keys section, click the X next to the API key you want to delete.
3. Click OK.

To save any modified system configuration settings:

1. Click Running Config.
2. Click Save config.
3. Review the comparison between the old running config and the current (new) running config.
4. If the changes are correct, click Save.
5. Click Done.

To revert your changes without saving them to disk:

1. Click Running Config.
2. Click Revert config.
3. Click Revert.
4. Click OK.
5. Click Done.

You can remove one or more packet queries to clear query memory and disk cache.

1. In the Trace Cluster Settings section, click Packet Query Status.
2. Do one of the following:
   • To remove a single query, click Remove in the Actions column of the query you want to remove.
   • To remove all listed queries, click Remove All.

Connect the Trace appliance to a Command appliance to remotely run support scripts and upgrade firmware on the Trace appliance.

1. In the Trace Cluster Settings section, click Connect to a Command Appliance.
2. Configure the following settings:

   Command appliance hostname: Type the hostname or IP address of the Command appliance.

   Command appliance setup password: Type the setup user password for the Command appliance.

   Trace node nickname (Optional): Type a friendly name for the Trace appliance. If no nickname is entered, the node is identified by the hostname.

3. Select the Manage with Command appliance checkbox and then click Connect.