Forward session keys to ExtraHop-managed sensors

Session key forwarding can be enabled when you deploy ExtraHop-managed sensors from Reveal(x) 360. You must enable session key forwarding for each sensor.

1. Log in to the Reveal(x) 360 Console.
2. Click System Settings and then click All Administration.
3. Click Deploy Sensors. Select the Enable session key forwarding on this sensor checkbox as you complete the deployment process.
4. From the Sensors page, wait for the Status column to display Enabled and the Key Forwarding Endpoint column to display the endpoint string.
5. Copy the endpoint string. The string is required when you create an endpoint in your VPC.

Security groups determine which servers can forward session keys to the VPC endpoint as well as which session keys are accepted by the VPC endpoint. The following steps describe how to create the security group that permits inbound traffic to your VPC endpoint.

1. Log in to the AWS Management Console.
2. In the All services section, under Compute, click EC2.
3. In the left pane under Network & Security, click Security Groups.
4. Click Create Security Group.
5. Type a name for the security group.
6. Type a description about the security group.
7. From the drop-down list, select the VPC that you want to forward traffic from. You must create a security group for each VPC that you need an endpoint for.
8. In the Inbound rule section, click Add rule, and complete the following fields:

   Type: Custom TCP

   Protocol: TCP

   Port range: 4873

   Source: Select Custom from the drop-down list and in the next field select one or more options, such as the CIDR block for the VPC, a CIDR block for the range of IP addresses that includes all of the servers that you want to forward secrets from, or an existing security group that is associated with both the instances and the endpoint—the security group must allow outbound traffic to TCP:4873.

9. Click Create security group.

Create an endpoint for each VPC that can accept forwarded session keys from your servers and send them to the VPC Endpoint Service in the Reveal(x) 360 system.

1. Return to the AWS Management Console.
2. In the All services section, under Network & Content Delivery, click VPC.
3. In the left pane, under Virtual Private Cloud, click Endpoints. (Do not click Endpoint Services.)
4. Click Create Endpoint.
5. For the Service category, select Find service by name.
6. Paste the endpoint string you copied from Reveal(x) 360 into the Service Name field.
7. Click Verify.
8. From the VPC drop-down list, select the VPC that has the ENIs that are mirroring traffic to the sensor.
9. Make sure that the Enable DNS name checkbox is selected.

   Important:

   You must select Enable DNS hostnames and Enable DNS Support in the VPC settings.

10. Select the security group you configured in the previous procedure.
11. Click Create endpoint.
12. Repeat these steps to create an endpoint for each target ENI that is a different VPC.

The following steps describe how to install and configure the ExtraHop session key forwarder software on supported Windows and Linux servers.

To validate that the ExtraHop system is able to receive forwarded keys, create a dashboard that identifies messages successfully received.

1. Create a new dashboard.
2. Click the chart widget to add the metric source.
3. Click Add Source.
4. In the Sources field, type Discover in the search field and then select Discover Appliance.
5. In the Metrics field, type received messages in the search field and then select Key Receiver System Health - Received Messages Containing Keys.
6. Click Save.