By adding a CIDR block to the Network Localities page, you can classify traffic from these IP addresses as internal or external to your network.
Here are some important considerations:
- You must have full-write privileges to change the locality of IP addresses.
- You must enter a unique range of IP addresses.
- If you have an ExtraHop Command appliance, you must configure these settings in the Command appliance and in all connected Discover appliances.
- Log into the Web UI on the Discover or Command appliance.
- Click the System Settings icon in the upper right corner of the page and click Network Localities.
- Click Add a CIDR Block.
- In the CIDR BLOCK field, type a single IP address or CIDR block.
- Select Internal or External, based on which classification you want to apply to the CIDR block.
- (Optional): In the DESCRIPTION field, type information about why you are configuring the locality of this CIDR block.
- At the top of the page, click Save.
- To add more entries, click Add CIDR, select the locality, and then click Save.
Next stepsTo verify that the ExtraHop system no longer classifies an IP address as an external or internal, look at external metrics by completing the following steps:
- Click Assets at the top of the page and then click Protocols from the left pane.
- Scroll down the page and click the TCP Devices group. A protocol page appears that displays metrics for every device on your network with TCP activity.
- In the TCP Connections section near the top of page, look for changes in the External Accepted and External Connected metrics. For example, if you classified a large CIDR block for a remote office as Internal, then the number of external connections should be lower.
You can choose whether to view only internal or external IP addresses in detail metric data.
- Log into a Discover or Command appliance.
Drill down on a metric from a dashboard or
protocol page by client, server, or IP address.
A detail metric page appears that displays metric data listed by IP address.
Click Any Field and then click Network
Locality, as shown in the following figure.
- Click All Locations and then click Internal or External.
- Click Add Filter.