Start Demo

Deploy the ExtraHop Explore 5200 Appliance

This guide explains how to install the rack-mounted EXA 5200 ExtraHop Explore appliance.

Installation prerequisites

To install the Explore appliance, your environment must meet the following requirements:
Appliance
2U of rack space and 2x750W of power
Management
One 10/100/1000 BASE-T network port or one 10G BASE-SR port for appliance management.
Network Access
TCP port 443 must be open between the Explore appliance and any connected Discover or Command appliances as well as any system that connects to the appliance for administration.
TCP port 9443 must be open to enable Explore nodes to communicate with other Explore nodes in the same cluster.

For more information about the interfaces on the ExtraHop appliance, see the Appliance Hardware FAQ.

Rear panel ports

EXA 5200

  • One iDRAC port
  • One RS-232 serial port to connect a console device
  • One VGA port to connect an external display
  • Two USB 3.0 ports to connect input devices such as a keyboard and mouse
  • Two 10 GbE ports. Ports 1 and 2 can be configured as a management port.
  • Two 10/100/1000 BASE-T network ports. Port 3 is the primary management port.
  • Two power ports to connect the appliance to an AC power source

Set up the appliance

  1. Rack mount the Explore appliance.
    Install the Explore appliance in your data center with the included rack-mounting kit. The mounting kit supports most four-post racks with either round or square holes.

    Orient the hardware to ensure proper airflow. The cold air intake is through the front of the appliance.

  2. Connect port 3 to your management network.
    The EXA 5200 appliance has two 10/100/1000 BASE-T network ports. With a network patch cable, connect the management port on the EXA 5200 to your management network. Port 3 is the default management port on the EXA 5200.
  3. (Optional): Connect the iDRAC port.
    To enable remote management of the Explore appliance, connect your management network to the iDRAC port with a network patch cable.
  4. (Optional): Connect a 10 GbE port.
    Connect one of the 10 GbE ports on the appliance with a 10 GbE cable to your network to manage the EXA 5200.
  5. Install the front bezel.
    You must install the front bezel if you want to configure the appliance through the LCD display.

    Insert the USB connector on the right side of the bezel into the USB port on the front of the appliance. Press and hold the release button on the left end of the bezel and push the bezel flush with the appliance until it snaps into place.

  6. Connect the power cords.
    Connect the two supplied power cords to the power supplies on the back of the appliance, and then plug the cords into a power outlet. If the appliance does not power on automatically, press the power button on the front-right of the appliance.

Configure the management IP address

DHCP is enabled by default on the ExtraHop system. When you power on the system, interface 3 attempts to acquire an IP address through DHCP. If successful, the IP address appears on the home screen of the LCD.

If your network does not support DHCP, you can configure a static IP address through the LCD menu on the front panel or through the command-line interface (CLI).

Important:For deployments that include a Discover appliance that is connected to a Command appliance, we strongly recommend configuring a unique hostname. If the IP address on the sensor is changed, the Command appliance can re-establish connection easily to the sensor by hostname.

Configure a static IP address through the LCD

Complete the following steps to manually configure an IP address through the front panel LCD controls.
  1. Make sure that the default management interface is connected to the network and the link status is active.
  2. Press the select button (✓) to begin.
  3. Press the down arrow button to select Network, and then press the select button.
  4. Press the down arrow to DHCP and then press the select button.
  5. Press the down arrow to select No, and then press the select button to disable DHCP.
  6. Press the down arrow to select Set static IP, and then press the select button.
  7. Press the left or right arrows to select the first digit to change, and then press the up or down arrows to change the digit to the desired number. Repeat this step for each digit you need to change. After you configure the desired IP address, press the select button.
  8. On the Network mask screen, press the left or right arrows to select the first digit to change, and then press the up or down arrows to change the digit to the desired number. Repeat this step for each digit you need to change. After you configure the desired network mask, press the select button.
  9. On the Default gateway screen, press the left or right arrows to select the first digit to change, and then press the up or down arrows to change the digit to the desired number. Repeat this step for each digit you need to change. After you configure the desired default gateway, press the select button.
  10. Confirm your modified network settings on the Settings saved screen, and then press any button to return to the Network Menu.
    Note:Each address is preceded by a letter that identifies whether it is the system IP address (I), the gateway address (G), or the netmask (N).
  11. Press the down arrow and scroll to Set DNS servers, and then press the select button.
  12. Press the left or right arrows on the DNS1 screen to select the first digit to change, and then press the up or down arrows to change the digit to the desired number. Repeat this step for each digit you need to change, and then press the select button to continue to the DNS2 screen.
  13. Configure a second DNS server.
  14. Confirm the DNS settings on the Settings saved screen, and then press any button to return to the Network Menu.
  15. Press the down arrow twice until ← Back appears, and then press the select button.
  16. Press the down arrow twice to select iDRAC. Configure the iDRAC DHCP, IP, mask, gateway, and DNS in the same manner as the IP address.
  17. Press the X button to return to the main menu.

Configure an IP address through the CLI

You can access the CLI by connecting a USB keyboard and SVGA monitor to the system or through an RS-232 serial cable and a terminal-emulator program. The terminal emulator must be set to 115200 bps with 8 data bits, no parity, 1 stop bit (8N1), and hardware flow control should be disabled.

  1. Establish a connection to the ExtraHop system.
  2. At the login prompt, type shell and then press ENTER.
  3. At the password prompt, type the system serial number and then press ENTER. The serial number is printed on a label on the back of the appliance. The serial number can also be found on the LCD display on the front of the appliance in the Info section.
  4. Enable privileged commands: 
    enable
  5. At the password prompt, type the serial number, and then press ENTER.
  6. Enter configuration mode: 
    configure
  7. Enter the interface configuration mode: 
    interface
  8. Run the ip command and specify the IP address and DNS settings in the following format: ip ipaddr <ip_address> <netmask> <gateway> <dns_server>
    For example:
    ip ipaddr 10.10.2.14 255.255.0.0 10.10.1.253 10.10.1.254
  9. Leave the interface configuration section: 
    exit
  10. Save the running config file: 
    running_config save
  11. Type y and then press ENTER.

(Optional) Configure the 10 GbE management interface

You can configure a 10 GbE port (port 1 or port 2) to manage the system. The commands below move the settings from port 3 to port 1 and then disables port 3. Alternatively, you can configure the 10 GbE management interface in the Administration settings.

  1. Make sure that the port 1 is connected to the 10 GbE network.
  2. Establish an SSH connection to the ExtraHop system.
  3. At the login prompt, type shell and then press ENTER.
  4. At the password prompt, type the system serial number and then press ENTER. The serial number is printed on a label on the back of the appliance. The serial number can also be found on the LCD display on the front of the appliance in the Info section.
  5. Enable privileged commands: 
    enable
  6. At the password prompt, type the serial number, and then press ENTER.
  7. Enter configuration mode: 
    configure
  8. Enter the interface configuration mode: 
    interface 1
  9. Move the interface settings:
    Warning:This command overwrites the settings for Interface 1 with the settings from Interface 3. The current settings for Interface 1 will be lost and Interface 3 will be disabled.
    take_settings 3
  10. Type Y to proceed and then press ENTER.

Create an Explore cluster

For the best performance, data redundancy, and stability, you must configure at least three Explore appliances in an Explore cluster.

Important:If you are creating an Explore cluster with six or more nodes, you must configure the cluster with manager nodes. For manager node instructions, see Deploying manager nodes.

In the following example, the Explore appliances have the following IP addresses:

  • Node 1: 10.20.227.177
  • Node 2: 10.20.227.178
  • Node 3: 10.20.227.179

You will join nodes 2 and 3 to node 1 to create the Explore cluster. All three nodes are data nodes. You cannot join a data node to a manager node or join a manager node to a data node to create a cluster.

Important:Each node that you join must have the same configuration (physical or virtual) and the same ExtraHop firmware version. EXA 5100 and EXA 5200 physical appliances can be in the same cluster.

Before you begin

You must have already installed or provisioned the Explore appliances in your environment before proceeding.
  1. Log in to the Administration settings on all three Explore appliances with the setup user account in three separate browser windows or tabs.
  2. Select the browser window of node 1.
  3. In the Status and Diagnostics section, click Fingerprint and note the fingerprint value. You will later confirm that the fingerprint for node 1 matches when you join the remaining two nodes.
  4. Select the browser window of node 2.
  5. In the Explore Cluster Settings section, click Join Cluster.
  6. In the Host field, type the hostname or IP address of data node 1 and then click Continue.
    Note:For cloud-based deployments, be sure to type the IP address listed in the Interfaces table on the Connectivity page.
  7. Confirm that the fingerprint on this page matches the fingerprint you noted in step 3.
  8. In the Setup Password field, type the password for the node 1 setup user account and then click Join.
    When the join is complete, the Explore Cluster Settings section has two new entries: Cluster Members and Cluster Data Management.
  9. Click Cluster Members. You should see node 1 and node 2 in the list.
  10. In the Status and Diagnostics section, click Explore Cluster Status. Wait for the Status field to change to Green before adding the next node.
  11. Repeat steps 5 - 10 to join each additional node to the new cluster.
    Note:To avoid creating multiple clusters, always join a new node to an existing cluster and not to another single appliance.
  12. When you have added all of your Explore appliances to the cluster, click Cluster Members in the Explore Cluster Settings section. You should see all of the joined nodes in the list, similar to the following figure.
  13. In the Explore Cluster Settings section, click Cluster Data Management and make sure that Replication Level is set to 1 and Shard Reallocation is ON.

Next steps

Connect the Discover and Command appliances to Explore appliances

Configure the Explore appliance

After you configure an IP address for the Explore appliance, log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin, and complete the following recommended procedures.

Note:The default login username is setup and the password is the system serial number, which can be found on a sticker on the rear of the chassis. Alternatively, the serial number appears in the Info section of the LCD display.
Last modified 2023-11-07