Secure event connector installation

Log in to Security Cloud Control. From the Security Cloud Control Home page, click Firewall.

In the left pane, click Administration > Secure Connectors.

Click the icon and then click Secure Event Connector.

Skip Step 1 of the wizard and go to Step 2. In step 2 of the wizard, click the link to Copy SEC Bootstrap Data.

Open a terminal window and log into the SDC as the "cdo" user.

Once logged in, switch to the "SDC" user. When prompted for a password, enter the password for the "cdo" user.

[cdo@sdc-vm ~]$ sudo su sdc
[sudo] password for cdo: <type password for cdo user>
[sdc@sdc-vm ~]$

At the prompt, run the SEC.sh setup script:

[sdc@sdc-vm ~]$ /usr/local/cdo/toolkit/sec.sh setup

At the end of the prompt, paste the bootstrap data you copied in step 4 and press Enter.

Please copy the bootstrap data from Setup Secure Event Connector page of Security Cloud Control: KJHYFuYTFuIGhiJKlKnJHvHfgxTewrtwE
RtyFUiyIOHKNkJbKhvhgyRStwterTyufGUihoJpojP9UOoiUY8VHHGFXREWRtygfhVjhkOuihIuyftyXtfcghvjbkhB=

After the SEC is onboarded, the SEC.sh runs a script to check on the health of the SEC. If all the health checks are "green," the health check sends a sample event to the Event Log. The sample event shows up in the Event Log as a policy named "SEC-health-check."

Determine if the VM on which the SDC and SEC are running needs additional configuration:

Log on to the Security Cloud Control tenant you are creating the Security Cloud Control Connector for.

From the Security Cloud Control Home page, click Firewall.

In the left pane, click Administration > Secure Connectors.

Click the icon and then click Secure Event Connector.

In Step 1, click Download the Security Cloud Control Connector VM image. This is a special image that you install the SEC on. Always download the Security Cloud Control Connector VM to ensure that you are using the latest image.

Extract all the files from the .zip file. They will look similar to these:

Log on to your VMware server as an administrator using the vSphere Web Client.

Deploy the on-premises Security Cloud Control Connector virtual machine from the OVF template by following the prompts. (You will need the .OVF, .mf, and .vdk files to deploy the template.)

When the setup is complete, power on the VM.

Open the console for your new Security Cloud Control Connector VM.

Login as the Security Cloud Control user. The default password is adm123 .

At the prompt type sudo SDC-onboard setup

[cdo@localhost ~]$ sudo sdc-onboard setup

When prompted, enter the default password for the Security Cloud Control user: adm123 .

Follow the prompts to create a new password for the root user.

Follow the prompts to create a new password for the Security Cloud Control user.

Follow the prompts to enter your Security Cloud Control domain information.

Enter the static IP address you want to use for the Security Cloud Control Connector VM.

Enter the gateway IP address for the network on which the Security Cloud Control Connector VM is installed.

Enter the NTP server address or FQDN for the Security Cloud Control Connector.

When prompted, enter the information for the Docker bridge or leave it blank if it is not applicable and press <Enter>.

Confirm your entries.

When prompted "Would you like to setup the SDC now?" enter n.

Create an SSH connection to the Security Cloud Control Connector by logging in as the Security Cloud Control user.

At the prompt type sudo SDC-onboard bootstrap

[cdo@localhost ~]$ sudo sdc-onboard bootstrap

When prompted, enter the Security Cloud Control user's password.

When prompted, return to Security Cloud Control and copy the Security Cloud Control bootstrap data, then paste it into your SSH session. To copy the Security Cloud Control bootstrap data:

When prompted, Would you like to update these settings? enter n.

Return to the Deploy an On-Premises Secure Event Connector dialog in Security Cloud Control and click OK. In the Secure Connectors page, you will see your Secure Event Connector is in the yellow Onboarding state.

Log in to Security Cloud Control. From the Security Cloud Control Home page, click Firewall.

In the left pane, choose Administration > Secure Connectors.

Select the Security Cloud Control Connector that you onboarded above. In the Secure Connectors table, it will be called a Secure Event Connector and it should still be in the "Onboading" status.

Click Deploy an On-Premises Secure Event Connector in the Actions pane on the right.

In step 2 of the wizard, click the link to Copy SEC bootstrap data.

Create an SSH connection to the Security Cloud Control Connector and log in as the CDO user.

Once logged in, switch to the sdc user. When prompted for a password, enter the password for the "Security Cloud Control" user. Here is an example of those commands:

[cdo@sdc-vm ~]$ sudo su sdc
 [sudo] password for cdo: <type password for cdo user> 
[sdc@sdc-vm ~]$

At the prompt, run the SEC.sh setup script:

[sdc@sdc-vm ~]$ /usr/local/cdo/toolkit/sec.sh setup

At the end of the prompt, paste the bootstrap data you copied in step 4 and press Enter.

Please copy the bootstrap data from Setup Secure Event Connector page of CDO: KJHYFuYTFuIGhiJKlKnJHvHfgxTewrtwE
 RtyFUiyIOHKNkJbKhvhgyRStwterTyufGUihoJpojP9UOoiUY8VHHGFXREWRtygfhVjhkOuihIuyftyXtfcghvjbkhB= 

Log on to Security Cloud Control.

From the Security Cloud Control Home page, click Firewall.

From the left pane, Administration > Secure Connectors.

Click the icon and then click Secure Event Connector.

Copy the SEC bootstrap data in step 2 on the window to a notepad.

Execute the following commands:

[sdc@vm]:~$sudo su sdc 

sdc@vm:/home/user$ cd /usr/local/cdo/toolkit 

sdc@vm:~/toolkit$ ./sec.sh setup 
Please input the bootstrap data from Setup Secure Event Connector page of CDO: 
Successfully on-boarded SEC

Log on to Security Cloud Control .

From the Security Cloud Control Home page, click Firewall.

From the left pane, Administration > Secure Connectors .

Click the icon and then click Secure Event Connector .

Using the link provided, copy the SEC Bootstrap Data in step 2 of the "Deploy an On-Premises Secure Event Connector" window.

Once installed, configure basic networking such as specifying the IP address for the Security Cloud Control Connector, the subnet mask, and gateway.

Configure a DNS (Domain Name Server) server.

Configure a NTP (Network Time Protocol) server.

Install an SSH server for easy interaction with Security Cloud Control Connector's CLI.

Install the AWS CLI package ( https://docs.aws.amazon.com/cli/latest/userguide/awscli-install-linux.html )

Install the Docker CE packages ( https://docs.docker.com/install/linux/docker-ce/centos/#install-docker-ce )

Start the Docker service and enable it to start on boot:

                        [root@sdc-vm ~]# 
                        systemctl start docker
 [root@sdc-vm ~]# 
                        systemctl enable docker
Created symlink from /etc/systemd/system/multiuser.target.wants/docker.service to /usr/lib/systemd/system/docker.service. 
                    

Create two users: Security Cloud Control and sdc. The Security Cloud Control user will be the one you log-into to run administrative functions (so you don't need to use the root user directly), and the sdc user will be the user to run the Security Cloud Control Connector docker container.

                        [root@sdc-vm ~]# 
                        useradd
                        Security Cloud Control
 [root@sdc-vm ~]# 
                        useradd sdc –d /usr/local/
                        Security Cloud Control
                    

Configure the sdc user to use crontab:

                        [root@sdc-vm ~]# 
                        touch /etc/cron.allow
[root@sdc-vm ~]# 
                        echo "sdc" >> /etc/cron.allow
                    

Set a password for the Security Cloud Control user.

                        [root@sdc-vm ~]# 
                        passwd
                        Security Cloud Control
Changing password for user 
                        Security Cloud Control
                        . 
New password: 
                        <type password> 
Retype new password: 
                        <type password> 
passwd: all authentication tokens updated successfully. 
                    

Add the Security Cloud Control user to the "wheel" group to give it administrative (sudo) privileges.

                        [root@sdc-vm ~]# 
                        usermod -aG wheel
                        Security Cloud Control
 [root@sdc-vm ~]# 
                    

When Docker is installed, there is a user group created. Depending on the version of CentOS/Docker, this may be called either "docker" or "dockerroot". Check the /etc/group file to see which group was created, and then add the sdc user to this group.

 [root@sdc-vm ~]# grep docker /etc/group 
docker:x:993:
[root@sdc-vm ~]# 
[root@sdc-vm ~]# usermod -aG docker sdc 
[root@sdc-vm ~]# 

If the /etc/docker/daemon.json file does not exist, create it, and populate with the contents below. Once created, restart the docker daemon.

                         [root@sdc-vm ~]# 
                        cat /etc/docker/daemon.json
{
 "live-restore": true, 
 "group": "
                        docker
                        " 
} 
[root@sdc-vm ~]# 
                        systemctl restart docker
[root@sdc-vm ~]# 
                    

If you are currently using a vSphere console session, switch over to SSH and log in as the Security Cloud Control user. Once logged in, change to the sdc user. When prompted for a password, enter the password for the Security Cloud Control user.

                        [
                        Security Cloud Control
                        @sdc-vm ~]$ 
                        sudo su sdc
[sudo] password for 
                        Security Cloud Control
                        : <
                        type password for
                        Security Cloud Control
                        user 
                        > 
[sdc@sdc-vm ~]$ 
                    

Change directories to /usr/local/ Security Cloud Control .

Create a new file called bootstrapdata and paste the bootstrap data from Step 1 of the deployment wizrd into this file. Save the file. You can use vi or nano to create the file.

The bootstrap data comes encoded in base64. Decode it and export it to a file called extractedbootstrapdata

                         [sdc@sdc-vm ~]$ 
                        base64 -d /usr/local/
                        Security Cloud Control
                        /bootstrapdata > /usr/local/
                        Security Cloud Control
                        /extractedbootstrapdata 
[sdc@sdc-vm ~]$ 
                    

                        [sdc@sdc-vm ~]$ 
                        cat /usr/local/
                        Security Cloud Control
                        /extractedbootstrapdata
                        Security Cloud Control
                        _TOKEN="<token string>" 
                        Security Cloud Control
                        _DOMAIN="www.defenseorchestrator.com" 
                        Security Cloud Control
                        _TENANT="<tenant-name>" 
<
                        Security Cloud Control
                        _URL>/sdc/bootstrap/
                        Security Cloud Control
                        _acm="https://www.defenseorchestrator.com/sdc/bootstrap/tenant-name/<tenant-name-SDC>" 
ONLY_EVENTING="true" 
                    

Run the following command to export the sections of the decoded bootstrap data to environment variables.

[sdc@sdc-vm ~]$ sed -e 's/^/export /g' extractedbootstrapdata > secenv && source secenv 
[sdc@sdc-vm ~]$ 

Download the bootstrap bundle from Security Cloud Control .

                         [sdc@sdc-vm ~]$ curl -H "Authorization: Bearer $
                        Security Cloud Control
                        _TOKEN" "$
                        Security Cloud Control
                        _BOOTSTRAP_URL" -o $
                        Security Cloud Control
                        _TENANT.tar.gz 
100 10314 100 10314 0 0 10656 0 --:--:-- --:--:-- --:--:-- 10654 
[sdc@sdc-vm ~]$ 
                        ls -l /usr/local/
                        Security Cloud Control
                        /*SDC
-rw-rw-r--. 1 sdc sdc 10314 Jul 23 13:48 /usr/local/
                        Security Cloud Control
                        /
                        
                            Security Cloud Control
                            _<tenant_name>
                        
                    

Extract the Security Cloud Control Connector tarball, and run the bootstrap_sec_only.sh file to install the Security Cloud Control Connector package.

                         [sdc@sdc-vm ~]$ 
                        tar xzvf /usr/local/
                        Security Cloud Control
                        /tenant-name-SDC
<snipped – extracted files> 
[sdc@sdc-vm ~]$ 
[sdc@sdc-vm ~]$ 
                        /usr/local/
                        Security Cloud Control
                        /bootstrap/bootstrap_sec_only.sh
[2018-07-23 13:54:02] environment properly configured 
download: s3://onprem-sdc/toolkit/prod/toolkit.tar to toolkit/toolkit.tar 
toolkit.sh 
common.sh 
es_toolkit.sh 
sec.sh 
healthcheck.sh 
troubleshoot.sh 
no crontab for sdc 
-bash-4.2$ crontab -l 
*/5 * * * * /usr/local/
                        Security Cloud Control
                        /toolkit/es_toolkit.sh upgradeEventing 2>&1 >> /usr/local/
                        Security Cloud Control
                        /toolkit/toolkit.log 
0 2 * * * sleep 30 && /usr/local/
                        Security Cloud Control
                        /toolkit/es_toolkit.sh es_maintenance 2>&1 >> /usr/local/
                        Security Cloud Control
                        /toolkit/toolkit.log 
You have new mail in /var/spool/mail/sdc
                    

Choose one of the following configuration procedures:

• Disable the firewalld service on the CentOS 7 VM (matches the configuration of the Cisco-provided SDC VM)

• Allow the firewalld service to run and add firewall rules to allow event traffic to reach the SEC (more granular approach)

If you chose to disable the firewalld service, log into the CLI of the SDC VM as the "Security Cloud Control" user.

Stop the firewalld service and ensure that it will remain disabled upon subsequent reboots of the VM.

[Security Cloud Control@SDC-VM ~]$ sudo systemctl stop firewalld
Security Cloud Control@SDC-VM ~]$ sudo systemctl disable firewalld

Restart the Docker service to re-insert Docker-specific entries into the local firewall.

[Security Cloud Control@SDC-VM ~]$ sudo systemctl restart docker

If you chose to allow the firewalld service to run, log into the CLI of the SDC VM as the "Security Cloud Control" user.

Add local firewall rules to allow incoming traffic to the SEC from the TCP, UDP, or NSEL ports you configured.

[Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10125/tcp 
Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10025/udp
[Security Cloud Control@SDC-VM ~]$ sudo firewall-cmd --zone=public --permanent --add-port=10425/udp

Restart the firewalld service to make the new local firewall rules both active and persistent.

[Security Cloud Control@SDC-VM ~]$ sudo systemctl restart firewalld

Log in to Security Cloud Control. From the Security Cloud Control Home page, click Firewall.

In the left pane, Administration > Secure Connectors.

Select the Security Cloud Control Connector that you installed using the procedure in the prerequisites above. In the Secure Connectors table, it will be displayed as Secure Event Connector.

Click Deploy an On-Premises Secure Event Connector in the Actions pane on the right.

In step 2 of the wizard, click the link to Copy SEC Bootstrap Data.

Connect to the Secure Connector using SSH and log in as the Security Cloud Control user.

Once logged in, switch to the sdc user. When prompted for a password, enter the password for the "Security Cloud Control" user. Here is an example of those commands:

[cdo@sdc-vm ~]$ sudo su sdc
[sudo] password for cdo: <type password for cdo user>
[sdc@sdc-vm ~]$ 

At the prompt, run the SEC.sh setup script:

[sdc@sdc-vm ~]$ /usr/local/cdo/toolkit/sec.sh setup

At the end of the prompt, paste the bootstrap data you copied in step 4 and press Enter.

Please copy the bootstrap data from Setup Secure Event Connector page of CDO:
 KJHYFuYTFuIGhiJKlKnJHvHfgxTewrtwE RtyFUiyIOHKNkJbKhvhgyRStwterTyufGUihoJpojP9UOoiUY8VHHGFXREWRtygfhVjhkOuihIuyftyXtfcghvjbkhB=

After the SEC is onboarded, the SEC.sh runs a script to check on the health of the SEC. If all the health checks are "green," the health check sends a sample event to the Event Log. The sample event shows up in the Event Log as a policy named "SEC-health-check."

Go to Secure Event Connector Terraform Module on the Terraform Registry and follow the instructions to add the SEC Terraform module to your Terraform code and apply.

Ensure that you print the instance_id and sec_fqdn outputs, because you will need them later in the procedure.

To enable sending of logs from your ASA to the SEC, obtain the certificate chain of the SEC you created and remove the leaf certificate by running this command with the output from Step 3:

rm -f /tmp/cert_chain.pem && openssl s_client -showcerts -verify 5 -connect <FQDN>:10125 < /dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="/tmp/cert_chain.pem"; if(a > 1) print >>out}'

Copy the contents of /tmp/cert_chain.pem to your clipboard.

Take a note of the IP address of the SEC using this command:

nslookup <FQDN>

Log in to Security Cloud Control and start adding a new trustpoint object.

Click Add, copy the CLI commands generated by Security Cloud Control in the Install Certificate page, and click Cancel.

Below enrollment terminal , add no CA-check in a text clipboard.

SSH into your ASA device or use the ASA CLI option in Security Cloud Control and execute these commands:

DataCenterFW-1> en
Password: *****************
DataCenterFW-1# conf t
DataCenterFW-1(config)# <paste your modified ASA CLIs here and press Enter>
DataCenterFW-1(config)# wr mem
Building configuration...
Cryptochecksum: 6634f35f 4c5137f1 ab0c5cdc 9784bdb6

time="2023-05-10T17:13:46.135018214Z" level=info msg="[ip-10-100-5-19.ec2.internal][util.go:67 plugin.createTickers:func1] Events - Processed - 6/s, Dropped - 0/s, Queue size - 0"