Start Demo

Deploy the ExtraHop EFC 1292v NetFlow Sensor

This guide explains how to deploy the EFC 1292v NetFlow virtual sensor.

The EFC 1292v is designed to connect to RevealX 360 and RevealX Enterprise and collect NetFlow records from your network. Packet analysis is not available.

System requirements

Your environment must meet the following requirements to deploy an EFC 1292v virtual sensor on Linux KVM or VMware vSphere:

  • You must have familiarity with administering Linux KVM or VMware VMware.
  • You must have the ExtraHop deployment file, which is available on the ExtraHop Customer Portal.
  • You must have an ExtraHop EFC 1292v sensor product key.
  • You should upgrade to the latest patch for the Linux KVM or vSphere environment to avoid any known issues.

Virtual machine requirements

You must provision a hypervisor that most closely matches the following specifications for the virtual sensor.

Sensor vCPUs RAM Disk
1100v 4 8 GB 46 GB

Deployment overview

Collecting NetFlow records requires the following configuration setup.

Configure interfaces

  1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Network Settings section, click Connectivity.
  3. In the Interfaces section, click the name of the interface you want to configure.
  4. On the Network Settings for Interface <interface number> page, from the Interface Mode drop-down, select Management + Flow Target.
  5. Disable all remaining interfaces, since the sensor cannot process NetFlow and wire data simultaneously:
    1. In the Interfaces section, click the name of the interface you want to configure.
    2. From the Interface Mode drop-down, select Disabled.
    3. Repeat until all additional interfaces are disabled.
  6. Click Save.
Last modified 2024-07-29