Altor Virtual Network Security Analyzer v1.0 Installation Guide

Transcription

1 Altor Virtual Network Security Analyzer v1.0 Installation Guide The Altor Virtual Network Security Analyzer (VNSA) application is deployed as Virtual Appliance running on VMware ESX servers. A single Altor Center VM acts as the management and reporting server, consolidating network traffic information, and providing reports via a WWW user interface. To gather network traffic data, Altor Agent VMs are deployed on each ESX host which is to be monitored. The agent connects to each vswitch via a port group which is configured to operate in promiscuous mode, allowing monitoring of all traffic on that switch. The evaluation version of VNSA is deployed as a single virtual appliance, which includes both the Altor Agent and Altor Center. It can monitor a single ESX host. The installation of the virtual appliances is done via the VMware Infrastructure Client, by adding the VMs to the Virtual Center Inventory. This document describes the installation and setup process for the Altor Center and Altor Agent. Pre-requisites: - ESX Server 3.0.x - Altor Center management and reporting engine runs in a VM - Altor Agent VM runs on the ESX Server to be monitored - Virtual Center Server 2.0.x - Access to the VMware Virtual Infrastructure API must be available to allow auto-discovery of VM resources. This can be tested by connecting the the Virtual Center Host with a WWW browser ( Center IP Address>/ ) - Network Connectivity - The Altor VNSA VM must be accessible via WWW to access the application - The Altor Center must be able to communicate with the Virtual Center Server - Storage - The Virtual Appliance Image will need to be copied to a storage volume available to the ESX Server - Web Browser - The application is accessed via a WWW-based user interface. The supported browsers are Internet Explorer 7 and Firefox 2 or newer. Altor VNSA Virtual Appliance Info: - Compressed size of Virtual Appliance: 350MB - Uncompressed size of system: 4GB - Size of Virtual Disks: 2GB Operating System, 2GB Database - Memory Size: 512MB - Network: 4 Intel e1000 Virtual Ethernet Devices ( 1 Management NIC, 3 Monitoring NICs)

2 Pre-Setup: - Copy VM zip File to VM datastore which is accessible to the ESX server - Can be seen via the VMware Virtual Infrastructure Client: Select the ESX Host, Summary Tab, view the Datastore section of the Resources. - Can be seen on the ESX host via ssh/console, in /vmfs/volumes - Un-Zip VM archive into the data store, for example: - unzip AltorEval_1.0.zip - The unzipping of the VM archive may take several minutes, depending on the speed of the storage volume being used. - Once the contents are extracted, the zip file can be deleted Virtual Center Configuration: - Add new port group to vswitches which are to be monitored. This new port group allows the Altor Agent to monitor all VM communications, without exposing this traffic to any other VMs. - Select the ESX server in Virtual Center - Select the Configuration tab - Select Properties for the desired vswitch - Add a new Virtual Machine Network - Choose a name for the port group, e.g. Altor Promisc - Set the VLAN ID to 4095 (This is a special VMware identifier, to treat this port as a member of ALL VLANs) - Once created, select Edit and enable Promiscuous mode. - If there are multiple vswitches to be monitored, a promiscuous port group must be added to each. Add VM to Inventory: - Select ESX Server in Virtual Center hierarchy tree - Select Summary tab - Right Click on storage volume and select Browse Data Store - Navigate to directory created earlier, where the VM files were extracted. - Right click the.vmx file and choose Add to Inventory and select the desired ESX server.

3 - Select a name for the VM, click next. - Select a resource pool for the VM, click next. - Review the configuration, and click Finish. Configure Network Connections for VM - Select Edit Settings for the VM - Select the Network Adapter 1 in the Hardware list. - Network Adapter 1 is used for management communication, and for access to the Web UI. Connect this to a standard port group (nonpromiscuous) which allows access to the www interface, and to DNS and NTP services. - Network Adapter 2 through 4 are used for monitoring VM activity, and should be connected to the promiscuous mode port group(s) defined earlier. - Network Adapter 2 is configured as Connected and Connect at power on, and simply needs to connected to the correct port group. - To monitor additional vswitches, configure Network Adapter 3 and 4 as Connected and Connect at power on, and attach them to the promiscuous port group on the switch to be monitored. - If new Network Adapters are enabled after initial configuration, the agent VM must be rebooted to recognize the new ports and begin monitoring. - Power ON VM - Configure Altor VNSA host settings (described below in the VM Settings section).

4 Virtual Appliance Configuration The Altor VNSA virtual appliance is pre-configured as much as possible. The only items needed to be configured during installation are the network parameters needed to allow the machines to operate on your network. These include things like: DHCP or Static IP addressing mode, router, DNS server, time server, time zone, etc. Altor VNSA Configuration: The initial configuration of the Center VM is done via a console menu shown below. To access this menu, log in to the console using the default username / password. User Accounts: Basic setup account: Username: altor Password: altor Administrative access to the Operating System: Username: altoradm Password: altor During the initial login, you will be requested to choose new passwords for both the altor and altoradm account. Navigating the Menu: - Use the space bar to toggle the DHCP and Static IP addressing selection - Use Tab to move between input fields After completing the network settings, you will be asked to choose a new password for the system administrative account, altoradm. The final configuration step is to select the correct time zone. Select a region and a city in the the desired time zone. The default value is America/Los Angeles, for the Pacific Time zone. Once this final configuration step is completed, the related system services will be restarted, and the web user interface will be available. Network settings can be modified at any time, by logging in to the console using the ʻaltorʼ account, which will give run the network configuration application. When the network configuration application is run, the network service is stopped. So, the VNSA application interface will be unavailable until the network setting changes are finished.

5 Accessing the Application: The Altor Center is available via a WWW based user interface. Point your browser at the IP address (or host name) of the Altor VNSA VM to access the application. Web UI Initial Password: altor The supported www browsers are Internet Explorer 7 and Mozilla 2 or newer. Some other browsers will work, but have not been thoroughly tested with VNSA. Internet Explorer 6 and Opera browsers do not work with the current version of VNSA. Initial required settings, such as access to Virtual Center to download VM information, are in the Settings area: Select the Update VMs action, to download the VM inventory from Virtual Center. The Update VMs event will happen automatically once per night, by default. If major changes are made, such as adding a new Altor Agent to monitor a new ESX host, the update should be done immediately to update the Altor Centerʼs VM database. If the VMware-Tools package is installed on a VM, its IP address information will be known by Virtual Center, and automatically populated in Altor Center. VMs not running VMware tools will need to have their IP addresses assigned manually, so that Altor Center can associate the network traffic with the VM identity. Please see the VNSA Getting Started Guide for more information an application usage. Known Issues: - Internet Explorer 6 does not correctly format the Network report screens. It is recommended that Firefox or Internet Explorer 7 be used with this version. - The Altor Agent is operating in promiscuous mode on the vswitch span port. Due to the nature of this attachment, packets can be missed causing small statistical errors, or connection errors. The percentage of packets not seen by the Altor Agent should be low, and not materially affect the traffic statistics.