Deploy Reveal(x) Ultra in AWS

1. Log in to your AWS Management Console.
2. In Marketplace, search for ExtraHop Ultra sensors.
   
3. Click one of the following sensor names:
   • Reveal(x) Ultra Cloud Sensor 1 Gbps (BYOL)
   • Reveal(x) Ultra Cloud Sensor 10 Gbps (BYOL)
4. Click Continue to Subscribe.
5. Read the ExtraHop Terms and Conditions, and then click Accept Terms.
6. After the subscription process completes, click Continue to Configuration.
7. Select CloudFormation Template from the Fulfillment option drop-down list.
   
8. Select one of the following CloudFormation templates from the drop-down list:
   • Single sensor with ENI as traffic mirror target
   • Single sensor with NLB as traffic mirror target. This option is recommended when you have more than ten traffic sources.
   
9. Select a firmware version from the Software Version drop-down list.
10. Select your AWS region from the Region drop-down list.
    
11. Click Continue to Launch.
12. On the Launch this software page, under Choose Action, select Launch CloudFormation.
    
13. Click Launch.
14. On the Create stack page, leave the default settings unchanged and click Next.
15. On the Specify stack details page, type a name in the Stack name field to identify your instance in AWS.
16. In the Network configuration section, configure the following fields:

    VPCID: Select the VPC where the sensor will be deployed

    MgmtSubnetID: Select the subnet where the management ENI will be deployed

    CaptureSubnetID: Select the subnet where the data capture ENI will be deployed

    RemoteAccessCIDR: Type a CIDR IP range to restrict user access to the instance. We recommend that you configure a trusted IP address range.

17. In the ExtraHop configuration section, select one of the following options for the PublicIP field:
    • Select false if you do not want a public-facing IP address.
    • Select true if you want the sensor available to users through the public internet. The MgmtSubnetID specified in the previous step must be a public subnet.
18. (Optional): In the Other parameters section, type an AMI ID for the source instance.
19. Click Next.
20. Add one or more tags in the Tags section and then click Next.
21. Review your configuration settings and then click Create stack.
22. Wait for the creation to complete. The CREATE_COMPLETE status appears on the Stack info page when the stack creation is successful.
    
23. Click the Outputs tab.
    
24. Copy the SocSensorPublicCredentials value. This is the setup user password required to log in to the ExtraHop system.
25. Click the EDAPublicAccess value URL to go to the sensor Administration settings page.

Complete these steps for each ENI you created.

1. Return to the AWS Management Console.
2. From the top menu, click Services.
3. In the Networking & Content Delivery section, click VPC.
4. In the left pane, under Traffic Mirroring, click Mirror Targets.
5. Click Create traffic mirror target and complete the following fields:

   Option	Description
   Name tag	(Optional) Type a descriptive name for the target.
   Description	(Optional) Type a description for the target.
   Target type	Select Network Interface.
   Target	Select the ENI you previously created.

6. Click Create.

You must create a filter to allow or restrict traffic from your ENI traffic mirror sources to your ExtraHop system. We recommend the following filtering rules to help avoid mirroring duplicate frames from peer EC2 instances that are in a single VPC to the sensor.

1. In the AWS Management Console, in the left pane under Traffic Mirroring, click Mirror Filters.
2. Click Create traffic mirror filter and complete the following fields:

   Option	Description
   Name tag	Type a name for the filter.
   Description	Type a description for the filter.
   Network services	Select the amazon-dns checkbox.

3. In the Inbound rules section, click Add rule and then complete the following fields:

   Option	Description
   Number	Type a number for the rule, such as 100.
   Rule action	Select reject from the drop-down list.
   Protocol	Select All protocols from the drop-down list.
   Source CIDR block	Type the CIDR block for the subnet.
   Destination CIDR block	Type the CIDR block for the subnet.
   Description	(Optional) Type a description for the rule.

4. In the Inbound rules section, click Add rule again and then complete the following fields:

   Option	Description
   Number	Type a number for the rule, such as 200.
   Rule action	Select accept from the drop-down list.
   Protocol	Select All protocols from the drop-down list.
   Source CIDR block	Type 0.0.0.0/0.
   Destination CIDR block	Type 0.0.0.0/0.
   Description	(Optional) Type a description for the rule.

5. In the Outbound rules section, click Add rule and then complete the following fields:

   Option	Description
   Number	Type a number for the rule, such as 100.
   Rule action	Select accept from the drop-down list.
   Protocol	Select All protocols from the drop-down list.
   Source CIDR block:	Type 0.0.0.0/0.
   Destination CIDR block:	Type 0.0.0.0/0.
   Description	(Optional) Type a description for the rule.

6. Click Create.

You must create a session for each AWS resource that you want to monitor. You can create a maximum of 500 traffic mirror sessions per sensor.

1. In the AWS Management Console, in the left pane, under Traffic Mirroring, click Mirror Session.
2. Click Create traffic mirror session and complete the following fields:

   Option	Description
   Name tag	(Optional) Type a descriptive name for the session.
   Description	(Optional) Type a description for the session
   Mirror source	Select the source ENI. The source ENI is typically attached to the EC2 instance that you want to monitor.
   Mirror target	Select the traffic mirror target ID generated for the target ENI.
   Session number	Type 1.
   VNI	Leave this field empty.
   Packet length	Leave this field empty.
   Filter	From the drop-down menu, select the ID for the traffic mirror filter you created.

3. Click Create.