Contents
- Cisco Stealthwatch Learning Network License Quick Start Guide
- Learning Network License Introduction
- Installing the Learning Network License System
- Installation Prerequisites
- Communication Ports
- Learning Network License and Licensing
- Controller Host Requirements
- Controller Installation Prerequisites
- ISR Platform Requirements
- ISR G2 Platform Requirements
- ISR 4000 Series Platform Requirements
- Verifying ISR Platform Requirements
- Example ISR Platform Requirements
- ISR Configuration Prerequisites
- ISR License Installation
- Agent and ISR Interaction
- Agent Installation Prerequisites
- Agent Configuration Prerequisites
- Downloading the OVA Files from Cisco
- Obtaining a File's Checksum from cisco.com
- Controller Deployment
- Deploying the OVA File
- Powering On the Virtual Machine
- Controller Virtual Hard Disk Storage
- Controller Virtual Hard Disk Allocation Expansion
- Editing VM Settings to Increase Virtual Hard Disk Size
- Adding a New Virtual Hard Disk Partition Larger than 2 TB
- Updating the Filesystem for the New Virtual Hard Disk Partition
- Controller Virtual Hard Disk Addition
- Editing VM Settings for a New Hard Disk
- Adding a New Hard Disk
- Updating the Filesystem for the New Hard Disk
- Custom Controller Web UI Certificates
- Uploading a Private Key Password
- Uploading Custom Controller Web UI Certificates
- Configuring the Controller with the Setup Script
- Resetting the Administrator Password
- Disabling Host Time Synchronization
- Logging into the Controller Web UI
- Verifying NTP Configuration on the Controller
- NTP Configuration
- Configuring NTP on the ISR
- NetFlow Configuration
- Configuring NetFlow
- Agent Deployment to a UCS E-Series Blade Server
- Configuring Virtual Switches
- UCS E-Series Blade Server Deployment
- Deploying the OVA File
- Powering on the Virtual Machine
- Powering On the Virtual Machine
- Agent Configuration Overview
- Configuring an Agent with the Setup Script
- Disabling the Host Time Synchronization
- Verifying NTP Configuration on the Agent
- Controller and Agent Communications Overview
- Pinging Agents from the Controller
- Agent Administrator Settings
- Enable Trust on First Use
- Storing ISR Authentication Information
- Restarting Agent Processes
- Controller Certificate Management
- Updating the Controller Configuration
- Restarting Controller Processes
- Smart Licensing Overview
- Logging into the Controller Web UI
- Registering the Controller Instance
- Restarting the Controller Processes
- Controller Management of Agents
- Interface Configuration
- Adding an Agent to the Controller
- Initial Learning Phase Overview
- Next Steps
- For Assistance
Cisco Stealthwatch Learning Network License Quick Start Guide
The following details essential information on deploying and configuring your Cisco Stealthwatch Learning Network License system.
Learning Network License Introduction
The Learning Network License system is a hyper-distributed analytics architecture that inspects your network traffic and applies machine learning algorithms to perform a behavioral analysis. As a result, the system can identify anomalous behavior, such as malware, distributed botnets, data exfiltration, and more.
You deploy multiple agents to your network edge to inspect traffic. These agents report the anomalies in real-time to the controller for additional system and user analysis. Based on the anomalies, you can provide relevance feedback, which the system incorporates into internal traffic models. This allows the system to better identify and report anomalies of interest.
You can also configure mitigations based on anomaly properties, such as hosts involved and application traffic transferred. These mitigations reduce or eliminate the impact of detected anomalies now and in the future. The combination of behavioral analysis, user feedback, and traffic mitigation customizes the system to address the threats specific to your network and better protect your users.
Installing the Learning Network License System
ProcedureThe following provides a high-level overview to installing the Learning Network License system.
Step 1 Ensure your ISRs support installing the Learning Network License system, have the proper licenses, and have installed a UCS E-Series blade server running an ESXi host. See Installation Prerequisites for more information. Step 2 Deploy a separate ESXi host to run the controller. See Controller Host Requirements for more information. Step 3 Download the agent and controller OVA files at http://www.cisco.com/c/en/us/support/security/ stealthwatch-learning-network-license/tsd-products-support-series-home.html. See Downloading the OVA Files from Cisco for more information. Step 4 Deploy the controller to the ESXi host using vSphere Client. Power on the virtual machine, and log into the controller VM console using the default administrator username (sln) and default administrator password (cisco). See Controller Deployment for more information. Step 5 Run the setup-system setup script from the controller command line. Follow the script prompts to configure the network connection, NTP servers, and generate public key certificates. Verify your NTP configuration from the controller VM console. See Configuring the Controller with the Setup Script and Verifying NTP Configuration on the Controller for more information. Step 6 Update the sca.conf controller configuration file to configure public key certificate management settings, then restart the controller processes. See Updating the Controller Configuration and Restarting Controller Processes for more information. Step 7 Configure NTP servers and Flexible NetFlow on your ISR. See NTP Configuration and Configuring NetFlow for more information. Step 8 Configure additional virtual switches on the UCS E-Series blade server ESXi host, using the vmnic0 and vmnic1 physical adaptors. See Configuring Virtual Switches for more information. Step 9 Verify your UCS E-Series blade server configuration. See UCS E-Series Blade Server Deploymentfor more information. Step 10 Deploy the agent to an ISR running a UCS E-Series blade server with an ESXi host. See Deploying the OVA File for more information. Step 11 Log into the agent VM console and configure network settings. See Configuring an Agent with the Setup Script for more information. Step 12 Run the agent administrator script to manage public key certificate trust settings, then restart the agent's processes. See Agent Administrator Settings for more information. Step 13 Run the controller administrator script to trust the agent public key certificates. See Controller Certificate Management for more information. Step 14 Log into the controller web UI with your administrator credentials. Register your controller with Smart Licensing. From the controller VM console, restart the controller's processes. See Registering the Controller Instance and Restarting the Controller Processes for more information. Step 15 Log into the controller web UI, then manage and configure your agents with the controller as described in Controller Management of Agents. Step 16 Allow the system an initial learning phase to create a baseline model of your network traffic. See Initial Learning Phase Overview for more information.
Installation Prerequisites
When you deploy the Learning Network License system, obtain or configure the following:
open ports for system functionality
an ESXi host for the controller
an ISR with a UCS E-Series blade server to run the agent
the proper licensing for your ISR
the controller and agent OVA files
Communication Ports
Learning Network License requires several open ports for functionality, to allow communication between the controller and agents, and to allow users to access the controller UI. If a firewall or other security appliance sits between the controller and agents, or between the user and the controller, open these ports.
The following diagram illustrates this system functionality.
Users, such as system administrators, can log into the controller web UI, and SSH login to agents.
The controller sends information, such as mitigations, to the agent, and contacts NTP servers to synchronize time.
The agent sends information, such as anomalies, log files, configuration files, and PCAP files, to the controller, and contacts NTP servers to synchronize time.
The following diagram illustrates the open ports and directionality. See Table 1 for more information on these ports.
Table 1 Default Communication Ports for Learning Network License Features and Operation Port
Description
Direction
Is Open for any...
To...
22/TCP
SSH/SCP
outbound from agent eth0 interface Management IP, inbound to controller IP
IP associated with the controller, Management IP associated with the agent
transfer log files and configuration files
22/TCP
SSH
outbound from host IP, inbound to agent eth0 interface Management IP
host IP that wants to SSH login to the agent
optionally enable remote access to the agent shell
22/TCP
SSH
inbound from host IP to controller IP
host IP that wants to SSH login to the controller
optionally enable SSH login to the controller
123/UDP
NTP
outbound from the controller IP to an external NTP server
IP associated with the controller
synchronize time
123/UDP
NTP
outbound from an agent eth0 interface Management IP when deployed to a UCS E-Series blade server
IP associated with the agent
synchronize time
443/TCP
HTTPS
inbound from user IP to controller IP
host IP that wants to access the controller UI
access the controller UI
9091/TCP
TLS
outbound from controller IP to agent eth0 interface Management IP
IP associated with the controller
allow the controller to communicate with the agent
9092/TCP
packet buffer capture (PBC)
outbound from controller IP to agent eth0 interface Management IP
IP associated with the controller
enable PBC
Learning Network License and Licensing
To properly deploy your Learning Network License system, you must obtain the proper IOS Licenses for your ISRs, as well as the proper Smart Licenses for Learning Network License.
To run an agent on an ISR, you must activate an IP Base (ipbasek9) IOS license, and a Data (datak9) or App (appxk9) IOS license. See http://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.html for more information on activating the licenses.
You must also obtain the appropriate Smart License entitlement for each controller and agent you deploy.
Table 2 Smart License Entitlement Types Learning Network License Component
License Entitlement and Description
Associated File Downloads and Description
controller
L-SW-SCA-K9 - SCA Virtual Manager
sln-sca-k9-<ver>.ova - single controller OVA
agent installed on a UCS E-Series blade server
L-SW-LN-UCS-1Y-K9 - Cisco Stealthwatch Learning Network License for UCS Series 1 Yr Term
sln-dla-ucse-k9-<ver>.ova - agent deployed to a UCS E-Series blade server
agent installed on a UCS E-Series blade server
L-SW-LN-UCS-3Y-K9 - Cisco Stealthwatch Learning Network License for UCS Series 3 Yr Term
sln-dla-ucse-k9-<ver>.ova - agent deployed to a UCS E-Series blade server
Note
After you download a file from cisco.com, generate an MD5 or SHA512 checksum, and make sure it matches the MD5 or SHA512 checksum provided on cisco.com. If the checksums do not match, redownload the file. If the checksums still do not match, contact Cisco Support.
For more information on Smart Licensing, see http://www.cisco.com/web/ordering/smart-software-manager/smart-accounts.html.
In addition, you must generate a registration token in the Cisco Smart Software Manager (http://www.cisco.com/web/ordering/smart-software-manager/index.html), then use this to register your controller. Each time you manage and enable an agent with the controller, the controller automatically requests a license entitlement for the agent.
For more information about the Cisco Smart Software Manager, see the Cisco Smart Software Manager User Guide.
Controller Host Requirements
You can host a controller virtual appliance on a VMware ESXi Version 5.5 hosting environment. You can also enable VMware tools on all supported ESXi versions. For information on the full functionality of VMware Tools, see the VMware website (http://www.VMware.com). For help creating a hosting environment, see the VMware ESXi documentation.
Virtual appliances use Open Virtual Format (OVF) packaging. Cisco provides the controller and agent virtual appliances in Open Virtual Appliance (OVA) format, an archive version of the OVF file.
The computer that serves as the controller ESXi host must meet the following requirements:
It must have a 64-bit CPU that provides virtualization support, either Intel® Virtualization Technology (VT) or AMD Virtualization™ (AMD-V™) technology.
Virtualization must be enabled in the BIOS settings.
To host virtual devices, the computer must have network interfaces compatible with Intel e1000 drivers (such as PRO 1000MT dual port server adapters or PRO 1000GT desktop adapters).
This host must have network connectivity to all ISRs where you will install your agents.
Users such as administrators and analysts should be able to establish a connection to this host, to access the controller user interface.
For more information, see the VMware website: http://www.vmware.com/resources/guides.html.
Note
Installing the controller on an ISR is not supported.
Controller Installation Prerequisites
Controller Download
Cisco provides the controller as an OVA file: sln-sca-k9-<ver>.ova. Download the file at http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html.
Note
After you download a file from cisco.com, generate an MD5 or SHA512 checksum, and make sure it matches the MD5 or SHA512 checksum provided on cisco.com. If the checksums do not match, redownload the file. If the checksums still do not match, contact Cisco Support.
You must also download and install the latest version of VMware vSphere Client to install the virtual machine. Cisco recommends you also download and install VMware ESXi version 5.5 to run the virtual machine. Download the files at https://my.vmware.com/web/vmware/downloads.
Controller Virtual Appliance Settings
Each virtual appliance you create requires a certain amount of memory, CPUs, and hard disk space on the ESXi host. Do not decrease the default settings, as they are the minimum required to run the system software. The following table lists the default settings.
Table 3 Default Controller Virtual Appliance Settings Setting
Default
memory
24576 MB (24 GB)
virtual CPUs (vCPU)
4
virtual NICs
hard disk provisioned size
200 GB
When you start the VM, the controller determines the amount of physical RAM available, and updates the configuration to allow use of up to half of that RAM.
Cisco recommends you increase VM settings, depending on the size of your Learning Network License deployment. See the following table for recommendations.
Table 4 Recommended Controller VM Settings Learning Network License Deployment Size
Recommended VM Settings
1 to 50 agents
24576 MB (24 GB) of RAM
8 vCPU
400 GB of hard disk provisioned size
51 to 1000 agents
65536 MB (64 GB) of RAM
16 vCPU
4 TB of hard disk provisioned size
Note
The number of vCPUs is determined by multiplying the number of virtual sockets by the number of cores per socket.
See Controller Virtual Hard Disk Storage for more information on increasing the hard disk storage size.
If you increase the memory, number of vCPUs and cores/socket (default is 4), or the hard disk size, see http://www.vmware.com/ for more information and best practices.
Information Needed During Installation
When you run the setup script, provide the following information to configure the controller:
Table 5 Controller Installation Settings Setting
Description
eth0 interface IPv4 address, netmask, and gateway
transfer management traffic with agent, and provide access to controller web UI
eth0 interface hostname
hostname for the controller
eth0 interface DNS servers and DNS search suffixes
DNS context for anomalies
NTP server IPv4 addresses
synchronize time in Learning Network License system
The setup script allows you the option of generating self-signed certificates. If you generate a certificate for the controller web UI server, you can define the following subject distinguished name components:
Table 6 Self-Signed Certificate Subject Distinguished Name Options Option
Description
Country Name
A two-letter ISO 3166-1 country code
State or Province Name
Full name of the state or province where your organization is located
Locality Name
The city where your organization is located
Organization Name
Your organization's name
Organizational Unit Name
Your organization's division's name
Common Name
A host and domain name associated with the certificate
Email Address
A contact email address
Learning Network License requires a server certificate to encrypt controller/agent communications, and a server certificate to encrypt user connections to the controller web user interface.
ISR Platform Requirements
Several G2 ISRs (Cisco 2921, Cisco 2951, Cisco 3945, and Cisco 3945E), and 4000 Series ISRs (Cisco 4331, Cisco 4351, Cisco 4451) support hosting an agent on a UCS E-Series blade server. The UCS E-Series server must run a vSphere ESXi hypervisor. For more information on the G2 ISRs, see http://www.cisco.com/c/en/us/td/docs/routers/access/1900/roadmap/ISRG2_roadmap.html. For more information on the 4000 Series ISRs, see http://www.cisco.com/c/en/us/td/docs/routers/access/4400/roadmap/isr4400roadmap.html.
ISR G2 Platform Requirements
Table 7 ISR G2 Platform Requirements ISR Component
Required
Model
DRAM
2560 MB (2.5 GB) (Cisco 2921) or 1844 MB (1.8 GB) (Cisco 2951, 3945, 3945E)
Image
IOS Release 15.5(3)M1 or greater
NBAR2 Protocol Pack
Version 17.0 or greater
Licenses
Cisco 2921, 2951:
Cisco 3945, 3945E:
SL-39-IPB-K9 - IP Base license, and
SL-39-DATA-K9 - Data license
See http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/software-activation-on-integrated-services-routers-isr/white_paper_c11_556985.html#wp9001357 for more information.
UCS E-Series Blade Server
One of the following models with 8192 MB (8 GB) of RAM and 155 GB free storage space, running vSphere ESXi Hypervisor Version 5.0 or greater:
ISR 4000 Series Platform Requirements
Table 8 ISR 4000 Series Platform Requirements ISR Component
Required
Model
Cisco 4331,
Cisco 4351, or
Cisco 4451
Control Plane DRAM
8192 MB (8 GB)
Complex Programmable Logic Device
Version 15010638 or greater
Image
IOS-XE Release 15.4(3)S1 through 15.5(3)Sx
NBAR2 Protocol Pack
Version 15.0.0 or greater (IOS-XE 15.4(3)S1 through 15.5(3)S)
Version 17.0.0 or greater (IOS-XE 15.5(3)S, rebuild 2 or greater
Licenses
Cisco 4331:
SL-4330-IPB-K9 - IP Base license, and
SL-4330-APP-K9 - AppX license
Cisco 4351:
SL-4350-IPB-K9 - IP Base license, and
SL-4350-APP-K9 - AppX license
Cisco 44XX:
See http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/guide-c07-732797.html#_Toc424288435 for more information.
UCS E-Series Blade Server
One of the following models with 8192 MB (8 GB) of RAM, 155 GB free storage space, running vSphere ESXi Hypervisor Version 5.0 or greater:
Verifying ISR Platform Requirements
Before You BeginProcedure
Log into the ISR console.
Command or Action Purpose
Step 1 enable
Example:Router> enableEnable privileged EXEC mode.
Step 2 show version
Example:Router# show versionShow version information, including image version, installed ISR licenses, and control plane DRAM.
Step 3 show platform
Example:Router# show platformShow the Complex Programmable Logic Device version.
Step 4 show ip nbar protocol-pack active
Example:Router# show ip nbar protocol-pack activeShow the NBAR2 protocol pack version.
Step 5 exit
Example:Router# exitExit privileged EXEC mode.
Example ISR Platform Requirements
Issuing the show version command to your ISR allows you to view your image version, installed licenses, and the total control plane DRAM on the ISR. These are italicized below. Note that appxk9 corresponds to the AppX license, and ipbasek9 corresponds to the IP Base license.
Router> enable Router# show version Cisco IOS XE Software, Version 2016-05-16_22.05.paj Cisco IO Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5(3)s2, RELEASE SOFTWARE (fc2) ... Technology Package License Information: ––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––- Technology Technology-package Technology-package Current Type Next reboot –––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––-- appxk9 appxk9 RightToUse appxk9 [AppX license] uck9 None None None securityk9 None None None ipbase ipbasek9 Permanent ipbasek9 [IP Base license] cisco ISR4431/K9 (1RU) processor with 7799569K/6147K bytes of memory. ...Issuing the show platform command to your ISR allows you to view the Complex Programmable Logic Device (CPLD) version, italicized below.
Router# show platform Chassis type: ISR4431/K9 Slot Type State Insert time (ago) –––––––––- ––––––––––––––––– –––––––––––––––––––––––– –––––––––––––––––-- ... Slot CPLD Version Firmware Version –––––––––- –––––––––––––––––––––– –––––––––––––––––––––––––––––––––––––-- 0 15010638 15.4(2r)S R0 15010638 15.4(2r)S F0 15010638 15.4(2r)S
ISR Configuration Prerequisites
Information Needed for ISR Configuration
When you configure the ISR's NTP servers and flexible NetFlow, provide the following information:
Table 9 ISR Configuration Settings Setting
Description
loopback interface IPv4 address or router management interface
configure NTP server connectivity. Use a loopback interface if you have one configured, or the router management interface if you do not.
NTP server IPv4 addresses
synchronize time in Learning Network License system
agent eth1 IPv4 address for NetFlow exporter
pass NetFlow packets from the ISR to the agent
ISR License Installation
To run a agent on an ISR-G2, you must activate an IP Base (ipbasek9) IOS license, and a Data (datak9) IOS license. To run a agent on an ISR 4000 Series, you must activate an IP base (ipbasek9) IOS license, and an App (appxk9) IOS license. See http://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.html for more information on activating the licenses.
Agent and ISR Interaction
The following diagram illustrates the interaction between a agent and its host ISR.
The diagram shows an agent deployed to a UCS E-Series blade server on the host ISR. The agent contains three interfaces:
The eth0 interface, which connects to the UCS-E front panel GE2 port. This is the Management interface, which handles controller/agent communication, including mitigations and anomalies.
Configure eth0 with a routable IP address the controller can reach.
The eth1 interface, which connects to the UCS-E internal GE0 port, which connects to the router ucs.../0 interface. This is the Control interface, which handles agent/router communication, including passing NetFlow packets from the router to the agent, and passing mitigations from the agent to the router.
Traffic over the control connection does not leave the router. Configure the eth1 interface and the ucs.../0 interface using private IP addresses.
The eth2 interface, which connects to the UCS-E internal GE1 port, which connects to the router ucs.../1 interface. This is the Data Transfer interface, which handles raw packet data passed from the router to the agent. These raw packets are used for packet buffer capture and deep packet inspection.
Traffic over the data connection does not leave the router. Configure the eth2 interface and the ucs.../1 interface using private IP addresses.
Agent Installation Prerequisites
The agent runs as a virtual machine deployed to a UCS E-Series blade server. The server must run a VMware ESXi Version 5.5 hypervisor. You can also enable VMware tools on all supported ESXi versions. For information on the full functionality of VMware Tools, see the VMware website (http://www.VMware.com). For help creating a hosting environment, see the VMware ESXi documentation. See ISR 4000 Series Platform Requirements for more information.
Note
You must download the UCS E-Series blade server OVA file. You cannot install the virtual service OVA file on a UCS E-Series blade server.
Agent Configuration Prerequisites
Agent OVA Download
Cisco provides the agent as an OVA file: sln-dla-ucse-k9-<ver>.ova. Download the file at http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html.
Note
After you download a file from cisco.com, generate an MD5 or SHA512 checksum, and make sure it matches the MD5 or SHA512 checksum provided on cisco.com. If the checksums do not match, redownload the file. If the checksums still do not match, contact Cisco Support.
If you install the agent on a UCS E-Series blade server, you must also download and install the latest version of VMware vSphere Client to install the virtual machine. Download the file at https://my.vmware.com/web/vmware/downloads.
Agent Virtual Appliance Settings
Each agent you deploy to a UCS E-Series blade server requires a certain amount of memory, CPUs, and hard disk space. Do not decrease the default settings, as they are the minimum required to run the system software. However, to improve performance, you can increase the memory and number of CPUs, depending on your available resources. The following table lists the default settings.
Information Needed for the Setup Script
When you run the agent setup script, you must provide the following information to configure the agent:
Table 11 Agent on a UCS E-Series Blade Server Setup Script Settings Setting
Description
eth0 interface routable IPv4 address, netmask, and gateway
transfer management traffic with controller
optional eth0 interface DNS servers and DNS search suffixes
export files from the agent to other hosts
eth0 interface hostname
hostname for the agent
eth1 interface private IPv4 address and netmask
pass NetFlow packets to the agent, and pass mitigations and interface configuration to the agent
eth2 interface private IPv4 address and netmask
pass raw packets from ISR to agent for deep packet inspection (DPI) and packet buffer capture (PBC)
NTP server IPv4 addresses
synchronize time in Learning Network License system
Learning Network License requires a server certificate to encrypt controller/agent communications. The agent generates one automatically, but you can also upload one your organization generates.
Downloading the OVA Files from Cisco
Procedure
Note
After you download a file from cisco.com, generate an MD5 or SHA512 checksum, and make sure it matches the MD5 or SHA512 checksum provided on cisco.com. If the checksums do not match, redownload the file. If the checksums still do not match, contact Cisco Support.
Step 1 In your web browser, navigate to http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html. Enter your username and password when prompted. Step 2 Download the controller OVA file: sln-sca-k9-<ver>.ova Step 3 Download an agent OVA file:
- sln-dla-ucse-k9-<ver>.ova - contains the agent to be deployed on an ISR's UCS E-Series blade server
Controller Deployment
Cisco provides the controller as a downloadable OVA file. You can deploy this OVA file to a host running an ESXi hypervisor.
Before you start the controller VM, you can update the memory, number of vCPUs, and hard disk space in vSphere vCenter. If you increase the memory, you must start the VM, then run the setup-system script. After you run the script, the VM is updated with proper memory settings.
If your controller is already running, and you want to update the memory settings, run the setup-system script, stop the VM, update the memory settings, and start the VM. On restart, the VM is updated with proper memory settings.
See Controller Installation Prerequisites for more information on recommended controller VM settings, based on deployment size.
Note
For a given version of the Learning Network License system, only the version of Ubuntu Linux shipped with the controller and agents is supported. Do NOT upgrade Ubuntu Linux on the controller or agent VMs.
The first time you log into the virtual machine, the system prompts you to change the default administrator password.
Deploying the OVA File
As you map destination networks to interfaces, note that only eth0 is enabled by default. For many deployments, controller management traffic, agent traffic, and controller web UI user traffic are reachable from the same controller network interface. In this case, you can map that destination network to the eth0 interface. You can also leave the eth1 and eth2 interfaces disabled, and mapped to a separate destination network.
However, if these traffic types are reachable via different controller network interfaces, you can enable eth1, eth2, or both eth1 and eth2, then map them to the appropriate destination networks.
Before You BeginProcedure
Download the OVA file.
Download VMware vSphere Client from https://my.vmware.com/web/vmware/downloads and install it.
What to Do Next
Powering On the Virtual Machine
Procedure
Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you deployed the virtual machine. Step 2 Select . Step 3 Select the virtual machine from the navigation tree. Step 4 Select . Step 5 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.
Note To shift your focus from the virtual machine console to your local host, press Ctrl-Alt.
Step 6 Log in with the default administrator username (sln) and the default administrator password (cisco). When prompted, change the default administrator password.
Controller Virtual Hard Disk Storage
By default, the controller OVA ships configured with a 200 GB hard disk. Based on your deployment and the recommended settings, you can configure the deployed controller VM to expand the available hard disk storage space by either:
increasing the existing virtual hard disk storage allocation with an expanded partition or another partition, when the existing VMware storage area has sufficient space, or
adding a new virtual hard disk, when the existing VMware storage area has insufficient space.
Note
Follow the procedures carefully. Failure to follow them can result in corruption or loss of the controller VM filesystem.
Controller Virtual Hard Disk Allocation Expansion
To add space to the controller VM hard disk, configure the VM's settings in VMware vSphere to increase the size of the hard disk. Then, from the VM's command line, run parted to extend an existing virtual hard disk partition. Finally, issue commands to expand the filesystem size for the new hard disk.
Note
You can only extend a hard disk partition to 2 TB. If you need more space, you can use cfdisk to instead add another virtual hard disk partition.
By default, the controller ships with one virtual hard disk, sda and up to partition number 5 (sda5). The first time you add a partition to this virtual hard disk, increment the name by one (sda6). If you want to add another partition, increment the name of the most recent hard disk partition by 1 (sda7, sda8, and so on).
Editing VM Settings to Increase Virtual Hard Disk Size
Procedure
Step 1 Select . Step 2 Right-click the controller VM and select Edit Settings. Step 3 In the Hardware tab, select Hard disk 1. Step 4 Enter a new Provisioned Size to update the virtual hard disk provision. Step 5 Click OK. Step 6 Right-click the controller VM and select . Wait for the VM to power off. Step 7 Right-click the controller VM and select .
Adding a New Virtual Hard Disk Partition Larger than 2 TB
ProcedureUse cfdisk to create a new virtual hard disk partition larger than 2 TB. The controller OVA contains one virtual hard disk by default, sda. This virtual hard disk contains partitions up to number five (sda5). The following task assumes you have not created another virtual hard disk partition, directing you to increment the highest virtual hard disk partition name by one to create the sda6 partition. If you have created other virtual hard disk partitions for the sda virtual hard disk, increment the new partition name based on the existing virtual hard disk partitions (sda7, sda8, etc.).
Command or Action Purpose
Step 1 sudo cfdisk /dev/sda, then enter your password when prompted
Example:user@host:~$ sudo cfdisk /dev/sdaRun the cfdisk partition editor to create the sda6 partition. Step 2 Move your cursor to the last line containing Free space, and verify the size column roughly matches the amount of space you added. Verify that the partition size is correct. If it is not, restart the controller VM and restart this procedure from the beginning. Step 3 n to create a new partition Create a new partition. Step 4 Select Logical and press Enter. Create a logical partition. Step 5 Press Enter to accept the default size. Create the partition with the free space displayed. Step 6 t to change the filesystem type to 8E Change the filesystem type to 8E (Linux LVM). Step 7 W to write the new partition table, then yes to confirm Write the new partition table. Step 8 q to quit cfdisk Quit cfdisk. Updating the Filesystem for the New Virtual Hard Disk Partition
ProcedureThe controller VM was provisioned with Linux LVM2 (Logical Volume Manager) tools. The following procedures uses the LVM2 tools to register the new partition as a physical volume, add the new physical volume to the existing volume group, and extend the logical volume over the new physical volume while simultaneously resizing the Linux filesystem to recognize the additional space.
Command or Action Purpose
Step 1 sudo partprobe -s
Example:user@host:~$ sudo partprobe -s
Update the /dev filesystem to include /dev/sda6 as a new virtual hard disk partition.
Step 2 sudo pvcreate /dev/sda6
Example:user@host:~$ sudo pvcreate /dev/sda6
Create a physical volume for a new partition on the sda virtual hard disk.
Step 3 sudo vgdisplay
Example:user@host:~$ sudo vgdisplay
View the name of the volume group. Step 4 sudo vgextend <volume-group> /dev/sda6
Example:user@host:~$ sudo vgextend vg00 /dev/sda6
Add the new volume to the volume group. Step 5 sudo lvextend -r /dev/<volume-group>/root /dev/sda6
Example:user@host:~$ sudo lvextend -r /dev/vg00/root /dev/sda6
Add the new volume to the root logical volume and resize the root filesystem.
Controller Virtual Hard Disk Addition
To add a virtual hard disk on the controller VM, configure the VM's settings in VMware vSphere to recognize a new hard disk. Then, from the VM's command line, run cfdisk to create the new virtual hard disk, and issue commands to expand the filesystem size for the new hard disk.
By default, the controller ships with one virtual hard disk, sda. The first time you add a virtual hard disk, increment the name by one (sdb). If you want to add another virtual hard disk, increment the name of the most recent hard disk by 1 (sdc, sdd, and so on).
Editing VM Settings for a New Hard Disk
Procedure
Step 1 Select . Step 2 Right-click the controller VM and select Edit Settings. Step 3 In the Hardware tab, click Add. Step 4 Select Hard Disk and click Next. Step 5 Select Create a new virtual disk and click Next. Step 6 Enter a Disk Size and click Next. Step 7 Click Next to skip the Advanced Options screen. Step 8 Click Finish. Step 9 Click OK in the Virtual Machine Properties window. Step 10 Right-click the controller VM and select . Wait for the VM to power off. Step 11 Right-click the controller VM and select .
Adding a New Hard Disk
ProcedureUse cfdisk to create a disk partition on the new virtual hard disk. The controller OVA contains one virtual hard disk by default, sda. The following task assumes you have not created another virtual hard disk, directing you to increment the existing virtual hard disk name by one to create the sdb virtual hard disk. If you have created other virtual hard disks for the controller, increment the new virtual hard disk name based on the existing virtual hard disks (sdc, sdd, etc.).
Command or Action Purpose
Step 1 sudo cfdisk /dev/sdb, then enter your password when prompted
Example:user@host:~$ sudo cfdisk /dev/sdb1Run the cfdisk partition editor to create the sdb1 partition on the sdb virtual hard disk. The table contains one line, with the free space equal to the total disk size. Step 2 n to create a new partition Create a new partition. Step 3 Select Primary and press Enter. Create a virtual hard disk. Step 4 Press Enter to accept the default size. Create the virtual hard disk with the free space displayed. Step 5 t to change the filesystem type to 8E Change the filesystem type to 8E (Linux LVM). Step 6 W to write the new partition table, then yes to confirm Write the new partition table. Step 7 q to quit cfdisk Quit cfdisk. Updating the Filesystem for the New Hard Disk
Procedure
Command or Action Purpose
Step 1 sudo partprobe -s
Example:user@host:~$ sudo partprobe -s
Update the filesystem to include /dev/sdb as a new virtual hard disk.
Step 2 sudo pvcreate /dev/sdb1
Example:user@host:~$ sudo pvcreate /dev/sdb1
Create a physical volume for a new partition on the sdb hard disk.
Step 3 sudo vgdisplay
Example:user@host:~$ sudo vgdisplay
View the name of the volume group. Step 4 sudo vgextend <volume-group> /dev/sdb1
Example:user@host:~$ sudo vgextend vg00 /dev/sdb1
Add the new volume to the volume group. Step 5 sudo reboot
Example:user@host:~$ sudo reboot
Restart the controller VM.
Step 6 Log into the controller VM console. Log into the controller VM console. Step 7 sudo lvextend -r /dev/<volume-group>/root /dev/sdb1
Example:user@host:~$ sudo lvextend -r /dev/vg00/root /dev/sdb1
Add the new volume to the root logical volume and resize the root filesystem.
Step 8 sudo reboot
Example:user@host:~$ sudo reboot
Restart the controller VM.
Custom Controller Web UI Certificates
The controller web server uses Transport Layer Security (TLS) to encrypt connections to the controller web UI. This requires the server to present a certificate to the client browser. Using the self-signed certificate installed by default does not allow the browser to validate the authenticity of the controller web UI, and leads to browser warnings about an untrusted web server. Instead of using a self-signed certificate, you can upload to the controller a custom public key server certificate and private key generated by your organization. This allows clients that connect to the controller web UI to properly validate the web server's authenticity. Note the following:
You must upload both a server certificate and associated private key. Both must be in PEM format.
You can also upload a trust chain of issuing CA certificates for the server certificate, concatenated with the server certificate in a single PEM file.
You can upload an encrypted private key file. You must also create an additional file (sln_ssl.pass) with the cleartext password required to unencrypt the private key file.
After you make these changes, restart the controller web UI processes.
Note
When you run the setup-system script, do not generate a new controller web UI certificate, as this will overwrite your custom certificate and private key. See Configuring the Controller with the Setup Script for more information.
Uploading a Private Key Password
ProcedureIf your private key file is encrypted, you must create an sln_ssl.pass password file containing the cleartext password. After you create the file, you update the sln_ssl_certs.conf configuration file to point to the password file. See Uploading Custom Controller Web UI Certificates for more information.
What to Do Next
Command or Action Purpose
Step 1 cd /etc/ssl/private/
Example:user@host:~$ cd /etc/ssl/private/Change to the /etc/ssl/private/ directory.
Step 2 cat > sln_ssl.pass, then enter your password as cleartext, then press Ctrl + D.
Example:user@host:~/etc/ssl/private$ cat > sln_ssl.pass private-key-password
Create the sln_ssl.pass password file, containing the private key cleartext password.
Step 3 cat sln_ssl.pass to verify the password
Example:user@host:~/etc/ssl/private$ cat sln_ssl.pass
Verify that the sln_ssl.pass password file contains the correct cleartext password.
Continue updating the configuration for your custom certificate and private key, as described in the next section.
Uploading Custom Controller Web UI Certificates
Before You BeginProcedure
Log into the controller VM console.
Upload your custom controller web UI server certificate, and chain of issuing CA certificates if applicable, in PEM format to the controller at etc/ssl/certs.
Upload your custom controller web UI server certificate private key in PEM format to the controller at /etc/ssl/private.
Command or Action Purpose
Step 1 cd /opt/cisco/sln/viz/conf/
Example:user@host:~$ cd /opt/cisco/sln/viz/conf/Change to the /opt/cisco/sln/viz/conf/ directory.
Step 2 sudo vi sln_ssl_certs.conf, then enter your password when prompted
Example:user@host:~/opt/cisco/sln/viz/conf$ sudo vi sln_ssl_certs.confOpen ssln_ssl_certs.conf in the vi text editor as a superuser.
Step 3 Modify the ssl_certificate filepath to point to the custom server certificate PEM file.
Example:ssl_certificate /etc/ssl/certs/server-certificate.pemUpdate sln_ssl_certs.conf to point to your custom server certificate.
Step 4 Modify the ssl_certificate_key filepath to point to the custom server certificat private key PEM file.
Example:ssl_certificate_key /etc/ssl/certs/server-certificate-key.pemUpdate sln_ssl_certs.conf to point to your custom server certificate private key.
Step 5 If you uploaded an sln_ssl.pass password file, add ssl_password_file and a corresponding filepath after the ssl_certificate_key filepath.
Example:ssl_certificate_key /etc/ssl/certs/server-certificate-key.pem ssl_password_file /etc/ssl/private/sln_ssl.pass
Update sln_ssl_certs.conf to point to your private key password file.
Step 6 Press Esc, then enter :wq!.
Example::wq!Save your changes, then exit the vi text editor.
Step 7 sudo service ciscosln-viz restart
Example:user@host:~/opt/cisco/sln/viz/conf$ sudo service ciscosln-viz restartRestart the controller web UI service.
Configuring the Controller with the Setup Script
ProcedureIf you need multiple interfaces on multiple subnets, when configuring networking, you can also configure eth1 and eth2.
Command or Action Purpose
Step 1 cd ~/
Example:user@host:~$ cd ~/Change directories. Step 2 sudo ./setup-system at the command prompt to run the setup script. Enter the administrator password if prompted.
Example:user@host:~$ sudo ./setup-systemRun the setup script. Step 3 y (configure networking)
Configure networking. Step 4 1 (configure eth0) Configure the eth0 interface. Step 5 hostname, then hostname, then y to confirm Configure the controller VM hostname. You must enter a full qualified domain name. Step 6 ipv4, then ipv4-address, then ipv4-netmask, then ipv4-gateway, then y to confirm Configure the interface's IPv4 address, along with a netmask and gateway. Step 7 dns, then dns-servers, then y to confirm Modify the virtual machine's list of DNS servers. Step 8 search, then domain-suffixes, then y to confirm If you want to configure the domain suffix search list, run the search command. Step 9 view
View the interface's network settings, hostname, and DNS settings. If any of these are missing or incorrect, repeat that configuration. Step 10 exit
Save your changes and continue with interface configuration. Step 11 4 (exit interface configuration) Exit interface configuration and continue. Step 12 y (enable SSH login) Enable SSH login. Step 13 y, then ntp-servers, then y to confirm
Configure NTP servers used to synchronize time between the controller and agent. Enter a space-delimited list of NTP server fully-qualified domain names (FQDNs) or IPv4 addresses. Step 14 y (generate a controller certificate) Generate a controller self-signed certificate, used for encrypting controller/agent communication. Step 15 y (generate a controller web UI certificate), or n if you uploaded a custom certificate Generate a controller web UI self-signed certificate, used for encrypting user connections to the controller web user interface. Step 16 y (specify the distinguished name if you generated a new certificate) Optionally, specify the certificate subject distinguished name (DN). Step 17 country-code, then state, then locality, then organization, then organizational-unit, then common-name, then email if you generated a new certificate
Optionally, provide the DN information. Resetting the Administrator Password
ProcedureAfter you run the setup-system script, reset the controller web UI administrator user account (admin) password. When you reset the password, the system prints a temporary password to the console, valid for 72 hours. You must log into the controller web UI as the admin user account, then update your password.
Command or Action Purpose
Step 1 cd ~/SCA
Example:user@host:~$ cd ~/SCAChange directories to ~/SCA.
Step 2 sudo service ciscosln-sca stop, then enter your password when prompted
Example:user@host:~/SCA$ sudo service ciscosln-sca stopStop the controller processes.
Step 3 ./sca.sh reset-admin-password
Example:user@host:~/SCA$ ./sca.sh reset-admin-password user@host:~/SCA$ Resetting the admin password in sln user@host:~/SCA$ New password is 'AbCd1234' user@host:~/SCA$ Admin password reset done.
Reset the admin user account's password.
Step 4 sudo service ciscosln-sca start
Example:user@host:~/SCA$ sudo service ciscosln-sca startStart the controller processes.
Disabling Host Time Synchronization
After you reset the administrator password, configure the VM to disable host time synchronization. This ensures the VM synchronizes time with the configured NTP servers, instead of the ESXi host.
Before You BeginProcedure
Log into the controller VM console.
Command or Action Purpose Logging into the Controller Web UI
ProcedureWhen you installed the controller, you defined an IP address for the controller web UI, and reset the administrator user account (admin) password. Log in with the temporary password printed to the controller VM console. After you log in once, you must change the password and confirm the new password.
In your web browser, navigate to https://controller-web-ip-address, then enter your controller web username and password when prompted.Verifying NTP Configuration on the Controller
Before You BeginProcedure
Log into the controller VM console.
What to Do Next
Command or Action Purpose
Step 1 ntpq –n –p
Example:user@host:~$ ntpq –n –pDisplay configured NTP servers. If the system does not display configured NTP servers, repeat NTP configuration in Configuring the Controller with the Setup Script. NTP Configuration
To configure NTP server addresses on the ISR, associate the router management interface with the NTP servers. Alternatively, if you have a loopback interface already configured, you can use that instead to reference NTP servers.
Configuring NTP on the ISR
ProcedureYou can enter each command individually. You can also paste the commands from the example below into a text editor, update the variable, then paste all the updated commands into the command line.
enable ntp source GigabitEthernet0/0/0 ntp server <ipv4-addresses> exitIf you have an existing loopback interface, use that as the NTP source interface. Otherwise, use the router management interface.
Command or Action Purpose
Step 1 enable
Example:Router> enableEnable privileged EXEC mode. Enter your password if prompted.
Step 2 ntp source GigabitEthernet0/0/0
Example:Router# ntp source GigabitEthernet0/0/0Use the GigabitEthernet0/0/0 interface to connect to an NTP server.
Step 3 ntp server ipv4-addresses
Example:Router# ntp server 209.165.202.129 209.165.202.130Use the GigabitEthernet0/0/0 interface to connect to an NTP server. Define multiple addresses to specify backup NTP servers.
Step 4 show ntp association
Example:Router# show ntp associationDisplay configured NTP servers. If the system does not display correctly configured NTP servers, repeat the configuration process. Step 5 exit
Example:Router# exitExit privileged EXEC mode.
NetFlow Configuration
To capture information about traffic traversing your network, you must configure the following Flexible NetFlow components in order:
SLN-NF-RECORD - a NetFlow flow record which defines key fields to match traffic, and non-key fields to collect
SLN-NF-EXPORTER - a NetFlow flow exporter that references the agent Control IP address to send NetFlow data to the agent
SLN-NF-MONITOR - a NetFlow flow monitor that references SLN-NF-RECORD to monitor input and output traffic coming over configured branch interfaces, and forwards it to SLN-NF-EXPORTER
The following diagram illustrates NetFlow operation on the ISR.
As input and output traffic passes over the branch facing interfaces, the SLN-NF-MONITOR flow monitor, referencing the SLN-NF-RECORD flow record, monitors the traffic for the key fields. It collects the non-key fields defined in the flow record. The flow monitor sends the flow record to the SLN-NF-EXPORTER flow exporter, which then sends it to the configured ISR ucs.../0 Control IP address.
Configuring NetFlow
Procedure
Command or Action Purpose
Step 1 Copy all the commands, paste them into a text editor, and update collect timestamp [absolute | sys-uptime] first and collect timestamp [absolute | sys-uptime] last. For supported 4000 Series ISRs, use sys-uptime. For other ISRs, use absolute. After you update the commands, paste them into the command line and press Enter to configure the NetFlow record.
Example:configure terminal flow record SLN-NF-RECORD match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect datalink mac source address input collect datalink mac destination address output collect transport tcp flags collect interface input collect interface output collect flow direction collect counter bytes collect counter packets collect timestamp [absolute | sys-uptime] first collect timestamp [absolute | sys-uptime] last collect application name collect routing forwarding-status exitEnter global configuration mode, create the SLN-NF-RECORD flow record, and enter flow record configuration mode. Configure the flow record to match key fields and collect nonkey fields. Exit flow record configuration mode and return to global configuration mode.
Step 2 Copy the following commands into a text editor. Replace <dla-ip-address> with the IP address associated with the agent deployed to the UCS E-Series blade server. You configure this on the agent in a later step.
Example:configure terminal flow exporter SLN-NF-EXPORTER destination <dla-ip-address> transport udp 6666 template data timeout 300 exitUpdate the flow exporter commands with the IP address associated with the agent deployed to the UCS E-blade server. Step 3 Copy the updated commands from the text editor into the command line and press Enter to configure the NetFlow exporter. Enter global configuration mode, create the SLN-NF-EXPORTER flow exporter, and enter flow exporter configuration mode. Configure the flow exporter to send flow records to the destination IP address. Exit flow exporter configuration mode and return to global configuration mode. Step 4 Copy the following commands into the command line, and press Enter to configure the NetFlow flow monitor.
Example:flow monitor SLN-NF-MONITOR cache timeout active 60 cache entries 512000 record SLN-NF-RECORD endCreate the SLN-NF-MONITOR flow monitor, and enter flow monitor configuration mode. Configure the flow monitor to reference the SLN-NF-RECORD flow record, and configure cache settings. Exit flow monitor configuration mode and return to privileged EXEC mode. Step 5 Copy the following commands into a text editor. Replace <name> with the name of an ISR interface that faces the branch's users. Repeat this for all ISR interfaces that face the branch's users.
Example:configure terminal interface <name> ip flow monitor SLN-NF-MONITOR input ip flow monitor SLN-NF-MONITOR output endUpdate the interface commands with every interface name. Step 6 Copy the updated commands from the text editor into the command line and press Enter to assign the NetFlow flow monitor to the specified interface. Specify an ISR interface and enter interface configuration mode. Assign the SLN-NF-MONITOR flow monitor to the interface and monitor incoming and outgoing traffic on the interface. Exit interface configuration mode and return to privileged EXEC mode. Repeat for each ISR interface. Agent Deployment to a UCS E-Series Blade Server
Cisco provides the agent as a downloadable OVA file. You can deploy this OVA file to a UCS E-Series blade server running an ESXi hypervisor on a Cisco 2921, Cisco 3945, Cisco 3945E, Cisco 4331, Cisco 4351, or Cisco 4451 ISR.
Note
For a given version of the Learning Network License system, only the version of Ubuntu Linux shipped with the controller and agents is supported. Do NOT upgrade Ubuntu Linux on the controller or agent VMs.
Configure virtual switches on the blade server, then deploy the agent virtual machine. After you power on the virtual machine, when you first log in, the system prompts you to change the default administrator password.
Configuring Virtual Switches
ProcedureWhen you deploy the ESXi hypervisor on the UCS E-Series blade server, the system automatically creates a virtual switch using the vmnic2 physical adaptor. This is associated with the GE2 external interface.
Configure two additional virtual switches, using the vmnic0 and vmnic1 physical adaptors. The vmnic0 virtual switch connects to the UCS-E GE0 internal interface, and this connects to the ISR UCS...1/0 interface. The vmnic1 virtual switch connects to the UCS-E GE1 internal interface, and this connects to the ISR UCS...1/1 interface.
Step 1 Select Step 2 Select the blade server from the navigation tree. Step 3 Select the Configuration tab. Step 4 In the Hardware pane, click Networking. Step 5 In the View: vSphere Standard Switch pane, click Add Networking. Step 6 In the Connection Types pane, select Virtual Machine and click Next. Step 7 Select Create a vSphere standard switch, vmnic0, and click Next. Step 8 Enter a Network Label and, optionally, a VLAN ID and click Next. Step 9 Click Finish. Step 10 Repeat the procedure for vmnic1.
UCS E-Series Blade Server Deployment
Ensure you have completed the following before deploying the agent:
install the UCS E-Series blade server in the host ISR
configure the server's GE2 interface with a routable IP address
connect an ethernet cable to the server's GE2 interface front panel port, and connect the other end of the cable into a L2 top-of-rack switch or router connected to your network
configure a management network for ESXi using the vmnic2 network adapter
start the UCS-E server and make sure it boots into the ESXi boot menu. If the server does not boot into the ESXi boot menu, see http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/1-0/gs/guide/b_Getting_Started_Guide/b_Getting_Started_Guide_chapter_0111.html#concept_4F2D448A505A4EBBA1A626CDC3D4118C for information on configuring the boot order through CIMC. Configure the hard disk drive (HDD) as first in the boot order, save your changes, then reboot the server.
For more information on configuring ESXi, see https://www.vmware.com/files/pdf/ESXi_management.pdf.
For more information on configuring the UCS E-Series server, see the Getting Start Guide for Cisco UCS E-Series Servers and the Cisco UCS E-Series Network Compute Engine, at https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/3-0/gs/guide/b_3_x_Getting_Started_Guide.html. For more information on UCS E-Series servers, see the Documentation Guide for Cisco UCS E-Series Servers and the Cisco UCS E-Series Network Compute Engine, at http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/1-0/roadmap/e_series_road_map.html
Deploying the OVA File
Before You BeginProcedure
Download the OVA file. See Downloading the OVA Files from Cisco for more information.
Download VMware vSphere Client from https://my.vmware.com/web/vmware/downloads and install it.
Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you want to install the OVA file. Step 2 Select . Step 3 Click Browse to select your OVA file, then click Next. Step 4 Review the OVF Template Details, then click Next. Step 5 Enter a Name, select an inventory location, then click Next. Step 6 Click the Thick Provision Lazy Zeroed radio button, then click Next. Step 7 Select a Destination Network from your inventory to map to a Source Network. You can map the following default networks, then click Next.
- Mgmt Network (vmnic2) to GE2
- NE Control Net (vmnic0) to Ucs.../0
- NE Data Net (vmnic1) to Ucs.../1
Step 8 Review your deployment settings and click Finish.
Note The deployment may take 30 minutes to an hour or longer, depending on your environment.
Step 9 Click Close after the deployment completes.
What to Do NextPowering on the Virtual Machine
Before You BeginProcedure
Deploy the OVA file to the ESXi hypervisor, as described in the previous section.
Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you deployed the virtual machine. Step 2 Select . Step 3 Select the virtual machine from the navigation tree. Step 4 Select . Step 5 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.
Note To shift your focus from the virtual machine console to your local host, press Ctrl-Alt.
Step 6 Log in with the default administrator username (sln) and the default administrator password (cisco). When prompted, change the default administrator password.
Powering On the Virtual Machine
Procedure
Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you deployed the virtual machine. Step 2 Select . Step 3 Select the virtual machine from the navigation tree. Step 4 Select . Step 5 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.
Note To shift your focus from the virtual machine console to your local host, press Ctrl-Alt.
Step 6 Log in with the default administrator username (sln) and the default administrator password (cisco). When prompted, change the default administrator password.
Agent Configuration Overview
Agent configuration through the setup script is similar to the controller setup script. It allows you to define basic network settings and generate a certificate for controller/agent communications.
Configuring an Agent with the Setup Script
ProcedureRun the setup script to configure hostname, interfaces, and generate a public key certificate for the agent. The eth0 interface handles management traffic passed between the agent and controller, and requires a routable IP address. The agent passes anomalies to the controller for further analysis. The eth1 interface handles Netflow and other traffic passed between the ISR and agent, and requires a private IP address. The agent examines this traffic for anomalies. The eth2 interface is for packet buffer capture, passing raw packet data from ISR to agent, and requires a private IP address. The agent passes PCAP archive files to the controller through the management interface when the user requests them from the controller.
What to Do Next
Command or Action Purpose
Step 1 Connect to the ESXi hypervisor where you deployed the virtual machine. Step 2 Select . Step 3 Select the virtual machine from the navigation tree. Step 4 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.
Note To shift your focus from the virtual machine console to your local host, press Ctrl-Alt.
Step 5 Log in with the administrator username (sln) and password (cisco). Update the administrator password when prompted. Step 6 cd ~/
Example:user@host:~$ cd ~/Change directories. Step 7 sudo ./setup-system at the command prompt to run the setup script. Enter the administrator password if prompted.
Example:user@host:~$ sudo ./setup-systemRun the setup script. Step 8 y
Configure network interfaces. Step 9 1) eth0
Example:Enter a number: 1Configure the eth0 interface. Step 10 ipv4, then routable-ipv4-address, then ipv4-netmask, then ipv4-gateway, then y to confirm Configure the interface's routable IPv4 address, along with a netmask and gateway. Step 11 hostname, then hostname, then y to confirm Configure the agent VM hostname. Step 12 dns, then dns-servers, then y to confirm If you want to add the virtual machine's list of DNS servers, run the dns command. Step 13 search, then domain-suffixes, then y to confirm If you want to configure the domain suffix search list, run the search command. Step 14 view
View the interface's network settings, hostname, and DNS settings. If any of these are missing or incorrect, repeat that configuration. Step 15 exit
Save your changes and continue with the setup script. Step 16 2) eth1
Example:Enter a number: 2Configure the eth1 interface. This interface is connected to the first UCS E-Series blade server interface. Step 17 ipv4, then private-ipv4-address, then ipv4-netmask, then optionally ipv4-gateway, then y to confirm Configure the interface's private IPv4 address, along with a netmask and gateway. Because traffic over this interface does not leave the router, you do not have to configure a gateway. Step 18 exit
Save your changes and continue with the setup script. Step 19 3) eth2
Example:Enter a number: 3If you want to use packet buffer capture, configure the eth2 interface. This interface is connected to the second UCS E-Series blade server interface. Step 20 ipv4, then private-ipv4-address, then ipv4-netmask, then optionally ipv4-gateway, then y to confirm Configure the interface's private IPv4 address, along with a netmask and gateway. Because traffic over this interface does not leave the router, you do not have to configure a gateway. Step 21 exit
Save your changes and continue with the setup script. Step 22 4) Exit
Example:Enter a number: 4Exit interface configuration. Step 23 y , if you want to enable SSH login
Example:Do you want to enable SSH service now? (y or n)[n] yEnable SSH login. Step 24 y, then ntp-servers
Example:Do you want to configure NTP servers now? (y or n)[n] yConfigure a space-delimited list of NTP server addresses. Step 25 y (generate self-signed certificate)
Generate an agent self-signed certificate, used for encrypting controller/agent communication. Step 26 y (specify the distinguished name) Optionally, specify the certificate subject distinguished name (DN). Step 27 country-code, then state, then locality, then organization, then organizational-unit, then common-name, then email
Specify the subject distinguished name (DN) on the certificate.
Disabling the Host Time Synchronization
ProcedureAfter you run setup-system, configure the VM to disable host time synchronization. This ensures the VM synchronizes time with the configured NTP servers, instead of the ESXi host.
Command or Action Purpose
Step 1 vmware-toolbox-cmd timesync disable
Example:user@host:~$ vmware-toolbox-cmd timesync disable
Modifies the .vmx virtual machine configuration file to disable time synchronization with the ESXi host.
Verifying NTP Configuration on the Agent
Procedure
Command or Action Purpose
Step 1 ntpq –n –p
Example:user@host:~$ ntpq –n –pDisplay configured NTP servers. If the system does not display configured NTP servers, repeat NTP configuration in Configuring an Agent with the Setup Script. Controller and Agent Communications Overview
Ensure that the controller can ping the agents and communicate. If you cannot ping the agents, check your network settings.
When you ran the agent and controller setup scripts, you also generated public key certificates. The Learning Network License system implements certificate pinning to identify public key certificates. If you enable TOFU, the agent trusts the first certificate it sees the first time it connects to the controller. It generates a certificate fingerprint, and on subsequent connections, compares the stored fingerprint to the passed certificate to verify the identity of the controller. If you do not enable TOFU, you can also generate a certificate fingerprint and upload that to the agent.
On the controller, you can also enable TOFU. On first connection, the controller adds the agent public key certificate to a trusted store. For future connections, when the agent connects to the controller, the controller compares the certificate to those stored in the trusted store. If the certificate matches a certificate in the store, the controller establishes the connection.
To configure the certificates, run the agent administrator script to:
configure the agent to trust the controller certificate
store an ISR login on the agent for communication between the ISR and agent
Then, restart the agent's processes.
After that, enable TOFU on the controller, and then restart the controller processes to ensure the controller recognizes and trusts these certificates.
Pinging Agents from the Controller
If you cannot ping the agents, check your network settings.
Before You BeginProcedure
Log into the controller VM console.
What to Do Next
Command or Action Purpose
Step 1 ping dla-mgmt-ip-address -c 5
Example:user@host:~$ ping 209.165.201.3 -c 5Ping the agent IP address with 5 packets.
Step 2 Repeat the previous step for all remaining agents.
Manage agent certificate trust settings, as described in the next section.
Agent Administrator Settings
The agent administrator script contains options to administrate and troubleshoot your agent, including public key certificate management, and log and debug file management options.
During initial agent installation, you must manage the certificate and trust model. The system uses certificate pinning and verifies a public key certificate against a previously generated certificate fingerprint. You can either enable TOFU, which Cisco recommends, or upload the controller certificate fingerprint.
No certificate fingerprint exists the first time the controller and agent establish a connection. If you enable TOFU, the first time the controller and agent establish a secure connection, the agent trusts the controller certificate, and generates a certificate fingerprint. On subsequent connections, the agent can verify the controller certificate against the pinned fingerprint.
Note
If you enable TOFU on your agent, either manage the agent with the controller soon after, or stop the agent processes until you are ready to continue.
You can also upload the controller certificate fingerprint to the agent before you establish a connection between the two. The agent, on first connection, uses the fingerprint to authorize the certificate.
After you enable TOFU or upload the controller certificate fingerprint, store an ISR login and password on the agent to enable communications between the ISR and agent. Finally, restart the agent processes so the changes can take effect.
Enable Trust on First Use
ProcedureWhat to Do Next
Command or Action Purpose
Step 1 cd ~/DLA
Example:user@host:~$ cd ~/DLAChange directories. Step 2 ./dla_admin
Example:user@host:~/DLA$ ./dla_adminRun the administrator script. Step 3 4) Certificate and trust management
Example:Enter a number: 4Enter the Certificate and trust management menu.
Step 4 1) Manage Certificate Pinning
Example:Enter a number: 1Enter the Certificate Pinning menu. Step 5 1) Enable Trust SCA Certificate on First Use
Example:Enter a number: 1Enable TOFU, to trust the controller certificate the first time it is detected.
Store the host ISR's login information on the agent, as described in Storing ISR Authentication Information.
Storing ISR Authentication Information
Provide the agent a login and password for the host ISR, to ensure proper communication between the agent and ISR.
Before You BeginProcedure
Log into the agent VM console, run the agent administrator script, and return to the Top Level menu.
What to Do Next
Command or Action Purpose
Step 1 5) Password management
Example:Enter a number: 5Access the Password Management menu options. Step 2 1) Change router credentials
Example:Enter a number: 1Update the stored host router login and password information. Step 3 Enter an ISR username and password, then confirm the password when prompted.
Example:Network Element Username: <router-username> Network Element Password: <router-username-password> Re-enter Network Element Password: <router-username-password>Update the stored host router login and password information.
Restart the agent processes, as described in Restarting Agent Processes.
Restarting Agent Processes
Before You BeginProcedure
Log into the agent VM console, run the agent administrator script, and return to the Top Level menu.
What to Do Next
Command or Action Purpose
Update the controller configuration file, as described in Updating the Controller Configuration.
Controller Certificate Management
Modify the controller configuration file to update certificate management settings. You can enable the controller to use self-signed agent certificates, and enable TOFU. After this, restart the controller processes.
Updating the Controller Configuration
The sca.conf configuration file contains several layers of nested brackets. When you update the file to add or update the dla node, make sure that you nest it within the sln bracket. See the following for an example.
sln { dla { security { allowSelfSignedCert = true trustCertOnFirstUse = true certRollover = true } } }
You can also reference ~/SCA/sample_sca.conf for an example of syntax.
Before You BeginProcedure
Log into the controller VM console.
What to Do Next
Command or Action Purpose
Step 1 cd ~/SCA
Example:user@host:~$ cd ~/SCAChange to the /SCA directory. Step 2 sudo vi sca.conf, then input your password when prompted
Example:user@host:~/SCA$ sudo vi sca.confEdit the sca.conf configuration file. Step 3 Update the configuration file to include or modify the configuration. Update the configuration file to include allowSelfSignedCert = true, trustCertOnFirstUse = true, and certRollover = true. Step 4 Press Esc, then enter :wq! and press Enter. Save your changes and exit the editor.
Restart the controller's processes, as described in the next section.
Smart Licensing Overview
To deploy the Learning Network License, you must register your controller with Cisco Smart Licensing. If you do not, your deployment enters Evaluation Mode, a 90-day trial which limits you to a maximum of 10 managed agents, and disables new functionality when the 90 days expire.
Cisco Smart Licensing lets you purchase and manage a pool of licenses centrally. Unlike product authorization key (PAK) licenses, Smart Licenses are not tied to a specific serial number or license key. Smart Licensing lets you assess your license usage and needs at a glance.
In addition, Smart Licensing does not prevent you from deploying agents. You can deploy an agent and purchase the license later. This allows you to deploy and use an agent, and avoid delays due to purchase order approval.
Logging into the Controller Web UI
ProcedureWhen you installed the controller, you defined an IP address for the controller web UI, and reset the administrator user account (admin) password. Log in with the temporary password printed to the controller VM console. After you log in once, you must change the password and confirm the new password.
In your web browser, navigate to https://controller-web-ip-address, then enter your controller web username and password when prompted.Registering the Controller Instance
Before You BeginProcedure
Obtain a registration token from the Smart Software Manager (http://www.cisco.com/web/ordering/smart-software-manager/index.html).
Log into the controller web UI.
Step 1 Select Dashboard. Step 2 Click Smart Licensing. Step 3 Click Register. Step 4 Paste your registration token into the Smart Software Licensing Product Registration field. Step 5 If you want to use a registration token and the current token is still valid, check Reregister this product instance if it is already registered. Step 6 Click Register.
Controller Management of Agents
After you trust public key certificates on both the agent and controller, manage your agents with your controller. You can log into the controller web UI to add each agent.
Interface Configuration
When you configure a Network Element's interface, select a traffic direction, whether you want to enable mitigations on the interface, and whether you want to enable packet buffer capture (PBC) or deep packet inspection (DPI).
Note
Subinterface configuration of PBC/DPI is not supported on 4000 Series ISRs.
The Direction you select for an interface determines how the agent tracks traffic origin from within or outside the branch, populates clusters, and models traffic to identify anomalies. Label each interface based on the following guidelines:
An Internal interface faces the branch and branch hosts. The system applies Learning Network License-related NetFlow on this interface.
An External interface faces the core. This interface passes traffic outside the branch, including other branches, headquarters, or the Internet.
An Unconfigured interface does not qualify as either Internal or External. It is unused, or there is a reason you do not want to monitor the traffic over this interface.
An agent monitors traffic, and creates clusters of hosts with similar characteristics. The agent clusters external hosts, those residing on External interfaces, separately from internal hosts, those residing on Internal interfaces. Traffic between clusters is monitored for anomaly detection.
The agent monitors traffic to or from branch hosts. All traffic to or from an Internal interface, which represents the branch host traffic, is modeled for anomaly detection purposes. Traffic that does not involve an Internal interface is not modeled. See the following table for more information.
Table 12 Interface Direction and Modeled Traffic ...to an Internal interface...
...to an External interface...
...to an Unconfigured interface...
Traffic from an Internal interface...
...is modeled and inspected for anomalous traffic.
...is modeled and inspected for anomalous traffic.
...is modeled and inspected for anomalous traffic.
Traffic from an External interface...
...is modeled and inspected for anomalous traffic.
...is not modeled and inspected for anomalous traffic.
...is not modeled and inspected for anomalous traffic.
Traffic from an Unconfigured interface...
...is modeled and inspected for anomalous traffic.
...is not modeled and inspected for anomalous traffic.
...is not modeled and inspected for anomalous traffic.
You can enable mitigation on Ethernet interfaces and most tunnel interfaces. The system does not support enabling mitigation on tunnel interfaces with multipoint GRE (mGRE) enabled.
Cisco recommends you enable mitigation on all enabled and supported interfaces, regardless of traffic direction. This provides maximum protection if the agent detects an anomaly, and you want to install a QoS policy on the Network Element to prevent the anomaly from being forwarded. If you configure a mitigation tailored to this anomalous traffic, the system installs the corresponding QoS policy on all Network Element interfaces on which you enabled mitigation.
Note
By default, the system checks the Enable Mitigation checkbox for all Ethernet and non-mGRE tunnel interfaces.
If your router interface has subinterfaces, and already has a quality of service (QoS) policy installed at the parent interface level, you can only enable mitigation policies at the parent level for that interface family. Similarly, if the subinterfaces have a QoS policy installed, you can only enable mitigation policies at the subinterface level for that interface family. If you enable a mitigation on a subinterface, the system automatically enables the mitigation on all sibling subinterfaces.
If the interface family does not have a QoS policy installed, you can install a mitigation at the parent interface or subinterface level. Once you configure a mitigation for a parent interface or a subinterface, however, you can only subsequently create mitigations at that level for the interface family.
You can enable PBC or DPI on any interface with the word Ethernet in its name, with the following exceptions:
You can only enable PBC or DPI on a G2 ISR interface if you did not configure it to export IP traffic (ip traffic-export). If you configured IP traffic export on the interface, remove the configuration from the interface before enabling PBC and DPI.
You can only enable PBC or DPI on a 4000 Series ISR parent interface.
This allows you to capture and download PCAP files, or capture DNS query information from traffic.
Note
On a G2 ISR, if you enable PBC or DPI on a parent interface, the system also enables it for all sub-interfaces. Similarly, if you enable PBC or DPI on a G2 ISR sub-interface, the system also enables it for the parent interface and all sibling subinterfaces.
Adding an Agent to the Controller
Procedure
Step 1 Select AGENTS. Step 2 Click Add an Agent. Step 3 Enter the agent eth0 IP address in the Agent IP or hostname field, and an optional Description. Step 4 Click Submit. Step 5 Enter the ucs.../0 interface IPv4 address in the Network Element IP field. This IP address must be reachable by the controller. Step 6 Click Submit. Step 7 For an interface, choose from the Direction drop-down:
- Internal if the interface faces the branch (generally, if NetFlow is configured on the interface)
- External if the interface faces the core (generally, if the interface is passing traffic)
- Unconfigured if you interface is unused, or the interface faces neither the branch nor the core
Step 8 Check the Enable mitigation checkbox to apply mitigation actions to this interface. Step 9 If you want to capture raw packet data and send it from the network element to the agent, take the following steps:
- Check Enable PBC/DPI on one or more interfaces to enable raw packet capture.
- Select a network element interface from the Raw Packet Tx Interface (on NE) drop-down on which the network element passes raw packets to the agent
- Select an agent interface from the Raw Packet Rx Interface (on Agent) drop-down on which the agent receives raw packets from the network element.
Step 10 If you want to enable the packet buffer capture (PBC) feature, check Enable PBC. You must enable capturing raw packet data. Step 11 If you want to capture DNS query information, check Enable DPI/DPS. You must enable capturing raw packet data. Step 12 Click Submit.
What to Do Next
Allow the system time to perform the initial learning phase, as described in Initial Learning Phase Overview.
Initial Learning Phase Overview
After you manage your agents with the controller, allow the system to run for seven days, inspect your network traffic, and build a baseline traffic model.
The Learning Network License system identifies anomalies by comparing detected traffic to the baseline model, and noting deviations. After system deployment, each agent inspects traffic traversing the router. During this initial learning phase, the agent builds a baseline traffic model. The model includes dynamically-generated clusters of hosts, and what types of application traffic are transmitted between clusters at what times of day.
If you log into the controller web UI while the system is learning about your network, you may see very few or no reported anomalies, as the system cannot compare against a baseline yet. Towards the end of the initial learning phase, the system may start reporting anomalies, but without a complete baseline, these anomalies may not be relevant. After the initial learning phase, when each agent completes its baseline model, the system can properly identify anomalous traffic that deviates from the baseline.
For more information, see the Cisco Stealthwatch Learning Network License Configuration Guide.
Next Steps
After you deploy the Learning Network License system, you can perform the following:
Configure audit and event logging. See the Cisco Stealthwatch Learning Network License UCS E-Series Blade Server Installation Guide for more information.
Integrate with an Identity Services Engine (ISE) server by configuring pxGrid integration. See the Cisco Stealthwatch Learning Network License UCS E-Series Blade Server Installation Guide for more information.
Log into the controller web UI to configure user display settings, view anomalies and assign relevance feedback, configure mitigations for an anomaly, and configure external system integration. See the Cisco Stealthwatch Learning Network License Configuration Guide for more information.
For Assistance
Thank you for using Cisco products.
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information about the Firepower System, see What’s New in Cisco Product Documentation at http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.
Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
If you have any questions or require assistance with the Cisco Stealthwatch Learning Network License system, please contact Cisco Support:
Visit the Cisco Support site at http://support.cisco.com.
Email Cisco Support at tac@cisco.com.
Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.
Copyright © 2016, Cisco Systems, Inc. All rights reserved.