Connect to ExtraHop Cloud Services

ExtraHop Cloud Services provides access to ExtraHop cloud-based services through an encrypted connection. The services you are connected to are determined by your system license.

After the connection is established, information about the available services appear on the Administration page.
  • ExtraHop Machine Learning Service enables detections for your ExtraHop system. In Reveal(x) systems, you can enable security-only or security and performance detections.
  • ExtraHop Update Service enables automatic updates of resources to the ExtraHop system, such as ransomware packages.
  • ExtraHop Remote Access enables you to allow ExtraHop account team members, ExtraHop Atlas analysts, and ExtraHop Support to connect to your ExtraHop system for configuration help. If you have signed up for the Atlas Remote Analysis service, ExtraHop analysts can perform an unbiased analysis of your network data and report on areas in your IT infrastructure where improvements can be made. See the Remote Access FAQ for more information about remote access users.

Before you begin

  • Reveal(x) 360 systems are automatically connected to ExtraHop Cloud Services, however, you might need to allow access through network firewalls.
  • You must apply the relevant license on the ExtraHop system before you can connect to ExtraHop Cloud Services. See the License FAQ for more information.
  • You must have unlimited privileges to access ExtraHop Administration and to connect to ExtraHop Cloud Services.
  1. Log in to the Administration page on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Network Settings section, click ExtraHop Cloud Services.
  3. Click Terms and Conditions to read the content.
  4. Read the terms and conditions, and then select the checkbox.
  5. Click Connect to ExtraHop Cloud Services.
    After you are connected, the page updates to show status and connection information for each service.
If the connection fails, there might be an issue with your firewall rules.

Configure your firewall rules

You must allow access through any firewalls on your network to connect to ExtraHop Cloud Services.

Connection to ExtraHop Cloud Services requires that your environment is able to meet the following conditions:

  • The ability to perform a DNS lookup of *.extrahop.com
  • The ability to connect to ExtraHop Cloud Services through HTTPS (port 443). The server IP addresses for ExtraHop Cloud Services are listed below.

Portland, U.S.A.:

35.161.154.247

Sydney, Australia:

54.66.242.25

Frankfurt, Germany:

52.59.110.168

Connect to ExtraHop Cloud Services through a proxy

If you do not have a direct internet connection, you can try connecting to ExtraHop Cloud Services through an explicit proxy.

Note:If you want to connect to ExtraHop Cloud Services through an explicit proxy, ensure that the proxy allows CONNECT requests over port 22.
  1. Log in to the Administration page on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Network Settings section, click Connectivity.
  3. Click Enable ExtraHop Cloud Proxy.
  4. Type the hostname for your proxy server, such as proxyhost.
  5. Type the port for your proxy server, such as 8080.
  6. (Optional): If required, type a user name and password for your proxy server.
  7. Click Save.

Bypass certificate validation

Some environments are configured so that encrypted traffic cannot leave the network without inspection by a third-party device. This device can act as an SSL/TLS endpoint that decrypts and re-encrypts the traffic before sending the packets to ExtraHop Cloud Services.

If the ExtraHop system cannot connect to the proxy server because the certificate validation has failed, you can bypass certificate validation and then connect to ExtraHop Cloud Services.
Note:The following procedure requires familiarity with modifying the ExtraHop Running Configuration file.
  1. Log in to the Administration page on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Appliance Settings section, click Running Config.
  3. Click Edit config.
  4. Add the following line to the end of the Running Config file:
    "hopcloud": { "verify_outer_tunnel_cert": false }
  5. Click Update.
  6. Click View and Save Changes.
  7. Review the changes and click Save.
  8. Click Done.
Published 2020-09-15 19:57