37
Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide Cisco Stealthwatch Learning Network License Quick Start Guide 2 Learning Network License Introduction 2 Installation Prerequisites 2 Controller Deployment 13 NTP Configuration 16 NetFlow Configuration 17 Agent Deployment to a UCS E-Series Blade Server 20 Agent Configuration Overview 23 Controller and Agent Communications Overview 26 Initial Learning Phase Overview 34 Next Steps 34 For Assistance 34

Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

  • Upload
    others

  • View
    11

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Cisco Stealthwatch Learning Network License UCS E-Series ServerQuick Start Guide

Cisco Stealthwatch Learning Network License Quick Start Guide 2

Learning Network License Introduction 2

Installation Prerequisites 2

Controller Deployment 13

NTP Configuration 16

NetFlow Configuration 17

Agent Deployment to a UCS E-Series Blade Server 20

Agent Configuration Overview 23

Controller and Agent Communications Overview 26

Initial Learning Phase Overview 34

Next Steps 34

For Assistance 34

Page 2: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Revised: July 11, 2016,

Cisco Stealthwatch Learning Network License Quick StartGuideThe following details essential information on deploying and configuring your Cisco Stealthwatch Learning Network License system.

Learning Network License IntroductionThe Learning Network License system is a hyper-distributed analytics architecture that inspects your network traffic and appliesmachine learning algorithms to perform a behavioral analysis. As a result, the system can identify anomalous behavior, such asmalware, distributed botnets, data exfiltration, and more.

You deploy multiple agents to your network edge to inspect traffic. These agents report the anomalies in real-time to the controllerfor additional system and user analysis. Based on the anomalies, you can provide relevance feedback, which the system incorporatesinto internal traffic models. This allows the system to better identify and report anomalies of interest.

You can also configure mitigations based on anomaly properties, such as hosts involved and application traffic transferred. Thesemitigations reduce or eliminate the impact of detected anomalies now and in the future. The combination of behavioral analysis, userfeedback, and traffic mitigation customizes the system to address the threats specific to your network and better protect your users.

Installation PrerequisitesWhen you deploy the Learning Network License system, obtain or configure the following:

• open ports for system functionality

• an ESXi host for the controller

• an ISR with a UCS E-Series blade server to run the agent

• the proper licensing for your ISR

• the controller and agent OVA files

Communication PortsLearning Network License requires several open ports for functionality, to allow communication between the controller and agents,and to allow users to access the controller UI. If a firewall or other security appliance sits between the controller and agents, orbetween the user and the controller, open these ports.

2

Page 3: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

The following diagram illustrates this system functionality.

Figure 1: System Functionality Requiring Open Ports

• Users, such as system administrators, can log into the controller web UI, and SSH login to agents.

• The controller sends information, such as mitigations, to the agent, and contacts NTP servers to synchronize time.

• The agent sends information, such as anomalies, log files, configuration files, and PCAP files, to the controller, and contactsNTP servers to synchronize time.

The following diagram illustrates the open ports and directionality. See Table 1: Default Communication Ports for Learning NetworkLicense Features and Operation, on page 4 for more information on these ports.

Figure 2: Open Ports for System Functionality

3

Page 4: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Table 1: Default Communication Ports for Learning Network License Features and Operation

To...Is Open for any...DirectionDescriptionPort

transfer log files andconfiguration files

IP associated with thecontroller,ManagementIP associated with theagent

outbound from agenteth0 interfaceManagement IP,inbound to controller IP

SSH/SCP22/TCP

optionally enableremote access to theagent shell

host IP that wants toSSH login to the agent

outbound from host IP,inbound to agent eth0interface ManagementIP

SSH22/TCP

optionally enable SSHlogin to the controller

host IP that wants toSSH login to thecontroller

inbound from host IP tocontroller IP

SSH22/TCP

synchronize timeIP associated with thecontroller

outbound from thecontroller IP to anexternal NTP server

NTP123/UDP

synchronize timeIP associated with theagent

outbound from an agenteth0 interfaceManagement IP whendeployed to a UCSE-Series blade server

NTP123/UDP

access the controller UIhost IP that wants toaccess the controller UI

inbound from user IP tocontroller IP

HTTPS443/TCP

allow the controller tocommunicate with theagent

IP associated with thecontroller

outbound fromcontroller IP to agenteth0 interfaceManagement IP

TLS9091/TCP

enable PBCIP associated with thecontroller

outbound fromcontroller IP to agenteth0 interfaceManagement IP

packet buffer capture(PBC)

9092/TCP

Learning Network License and LicensingTo properly deploy your Learning Network License system, you must obtain the proper IOS Licenses for your ISRs, as well as theproper Smart Licenses for Learning Network License.

To run an agent on an ISR, you must activate an IP Base (ipbasek9) IOS license, and a Data (datak9) or App (appxk9) IOS license.See http://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.html for more information on activating thelicenses.

4

Page 5: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

You must also obtain the appropriate Smart License entitlement for each controller and agent you deploy.

Table 2: Smart License Entitlement Types

Associated File DownloadsLicense Entitlement and DescriptionLearning Network License Component

sln-sca-k9-<ver>.ovaL-SW-SCA-K9 - Cisco StealthwatchLearning Network License CentralizedAgent Manager

controller

sln-dla-ucse-k9-<ver>.ovaL-SW-LN-UCS-1Y-K9 - Cisco StealthwatchLearning Network License for UCSSeries 1 Yr Term

agent installed on a UCS E-Series bladeserver

sln-dla-ucse-k9-<ver>.ovaL-SW-LN-UCS-3Y-K9 - Cisco StealthwatchLearning Network License for UCSSeries 3 Yr Term

agent installed on a UCS E-Series bladeserver

For more information on Smart Licensing, see http://www.cisco.com/web/ordering/smart-software-manager/smart-accounts.html.

In addition, you must generate a registration token in the Cisco Smart Software Manager (http://www.cisco.com/web/ordering/smart-software-manager/index.html), then use this to register your controller. Each time you manage and enable an agent with thecontroller, the controller automatically requests a license entitlement for the agent.

For more information about the Cisco Smart Software Manager, see the Cisco Smart Software Manager User Guide.

Controller Host RequirementsYou can host a controller virtual appliance on a VMware ESXi Version 5.5 hosting environment. You can also enable VMware toolson all supported ESXi versions. For information on the full functionality of VMware Tools, see the VMware website (http://www.VMware.com). For help creating a hosting environment, see the VMware ESXi documentation.

Virtual appliances use Open Virtual Format (OVF) packaging. Cisco provides the controller and agent virtual appliances in OpenVirtual Appliance (OVA) format, an archive version of the OVF file.

The computer that serves as the controller ESXi host must meet the following requirements:

• It must have a 64-bit CPU that provides virtualization support, either Intel® Virtualization Technology (VT) or AMDVirtualization™ (AMD-V™) technology.

• Virtualization must be enabled in the BIOS settings.

• To host virtual devices, the computer must have network interfaces compatible with Intel e1000 drivers (such as PRO 1000MTdual port server adapters or PRO 1000GT desktop adapters).

• This host must have network connectivity to all ISRs where you will install your agents.

• Users such as administrators and analysts should be able to establish a connection to this host, to access the controller userinterface.

For more information, see the VMware website: http://www.vmware.com/resources/guides.html.

5

Page 6: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Installing the controller on an ISR is not supported.Note

Controller Installation Prerequisites

Controller Download

Cisco provides the controller as an OVA file: sln-sca-k9-<ver>.ova. Download the file at http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html.

You must also download and install the latest version of VMware vSphere Client to install the virtual machine. Cisco recommendsyou also download and install VMware ESXi version 5.5 to run the virtual machine. Download the files at https://my.vmware.com/web/vmware/downloads.

Controller Virtual Appliance Settings

Each virtual appliance you create requires a certain amount of memory, CPUs, and hard disk space on the ESXi host. Do not decreasethe default settings, as they are the minimum required to run the system software. The following table lists the default settings.

Table 3: Default Controller Virtual Appliance Settings

DefaultSetting

24576 MB (24 GB)memory

4virtual CPUs (vCPU)

• vNIC 0 - Main Network

• vNIC 1 (disconnected) - Alt1Network

• vNIC 2 (disconnected) - Alt2Network

virtual NICs

200 GBhard disk provisioned size

Cisco recommends you increase VM settings, depending on the size of your Learning Network License deployment. See the followingtable for recommendations.

Table 4: Recommended Controller VM Settings

Recommended VM SettingsLearning Network License Deployment Size

24576 MB (24 GB) of RAM

8 vCPU

400 GB of hard disk provisioned size

1 to 50 agents

6

Page 7: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Recommended VM SettingsLearning Network License Deployment Size

65536 MB (64 GB) of RAM

16 vCPU

4 TB of hard disk provisioned size

51 to 1000 agents

If you increase the memory, number of vCPUs and cores/socket (default is 4), or the hard disk size, see http://www.vmware.com/for more information and best practices.

Information Needed During Installation

When you run the setup script, provide the following information to configure the controller:

Table 5: Controller Installation Settings

DescriptionSetting

transfer management traffic with agent, and provide access tocontroller web UI

eth0 interface IPv4 address, netmask, and gateway

hostname for the controllereth0 interface hostname

DNS context for anomalieseth0 interface DNS servers and DNS search suffixes

synchronize time in Learning Network License systemNTP server IPv4 addresses

The setup script allows you the option of generating self-signed certificates. If you generate a certificate for the controller web UIserver, you can define the following subject distinguished name components:

Table 6: Self-Signed Certificate Subject Distinguished Name Options

DescriptionOption

A two-letter ISO 3166-1 country codeCountry Name

Full name of the state or province where your organization is locatedState or Province Name

The city where your organization is locatedLocality Name

Your organization's nameOrganization Name

Your organization's division's nameOrganizational Unit Name

A host and domain name associated with the certificateCommon Name

A contact email addressEmail Address

7

Page 8: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Learning Network License requires a server certificate to encrypt controller/agent communications, and a server certificate to encryptuser connections to the controller web user interface.

Agent and ISR InteractionThe following diagram illustrates the interaction between a agent and its host ISR.

Figure 3: ISR and Agent on a UCS E-Series Blade Server Interaction

The diagram shows an agent deployed to a UCS E-Series blade server on the host ISR. The agent contains three interfaces:

• The eth0 interface, which connects to the UCS-E front panel GE2 port. This is the Management interface, which handlescontroller/agent communication, including mitigations and anomalies.

Configure eth0 with a routable IP address the controller can reach.

• The eth1 interface, which connects to the UCS-E internal GE0 port, which connects to the router ucs.../0 interface. This is theControl interface, which handles agent/router communication, including passing NetFlow packets from the router to the agent,and passing mitigations from the agent to the router.

Traffic over the control connection does not leave the router. Configure the eth1 interface and the ucs.../0 interface using privateIP addresses.

8

Page 9: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

• The eth2 interface, which connects to the UCS-E internal GE1 port, which connects to the router ucs.../1 interface. This is theData Transfer interface, which handles raw packet data passed from the router to the agent. These raw packets are used forpacket buffer capture and deep packet inspection.

Traffic over the data connection does not leave the router. Configure the eth2 interface and the ucs.../1 interface using privateIP addresses.

Agent Installation PrerequisitesThe agent runs as a virtual machine deployed to a UCS E-Series blade server. The server must run a VMware ESXi Version 5.5hypervisor. You can also enable VMware tools on all supported ESXi versions. For information on the full functionality of VMwareTools, see the VMware website (http://www.VMware.com). For help creating a hosting environment, see the VMware ESXidocumentation. See ISR 4000 Series Platform Requirements, on page 11 for more information.

You must download the UCS E-Series blade server OVA file. You cannot install the virtual service OVAfile on a UCS E-Series blade server.

Note

Agent Configuration Prerequisites

Agent OVA Download

Cisco provides the agent as an OVA file: sln-dla-ucse-k9-<ver>.ova. Download the file at http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html.

If you install the agent on a UCS E-Series blade server, you must also download and install the latest version of VMware vSphereClient to install the virtual machine. Download the file at https://my.vmware.com/web/vmware/downloads.

Agent Virtual Appliance Settings

Each agent you deploy to a UCS E-Series blade server requires a certain amount of memory, CPUs, and hard disk space. Do notdecrease the default settings, as they are the minimum required to run the system software. However, to improve performance, youcan increase the memory and number of CPUs, depending on your available resources. The following table lists the default settings.

Table 7: Default agent on a UCS E-Series Blade Virtual Appliance Settings

DefaultSetting

5120 MB (5 GB)memory

4virtual CPUs

155 GBhard disk provisioned size

Information Needed for the Setup Script

When you run the agent setup script, you must provide the following information to configure the agent:

9

Page 10: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Table 8: Agent on a UCS E-Series Blade Server Setup Script Settings

DescriptionSetting

transfer management traffic with controllereth0 interface routable IPv4 address, netmask, and gateway

export files from the agent to other hostsoptional eth0 interface DNS servers and DNS search suffixes

hostname for the agenteth0 interface hostname

pass NetFlow packets to the agent, and pass mitigations andinterface configuration to the agent

eth1 interface private IPv4 address and netmask

pass raw packets from ISR to agent for deep packet inspection(DPI) and packet buffer capture (PBC)

eth2 interface private IPv4 address and netmask

synchronize time in Learning Network License systemNTP server IPv4 addresses

Learning Network License requires a server certificate to encrypt controller/agent communications. The agent generates oneautomatically, but you can also upload one your organization generates.

NTP Configuration

You must provide NTP server addresses synchronized with those configured on the controller and router to ensure synchronizedtime.

ISR Platform RequirementsSeveral G2 ISRs (Cisco 2921, Cisco 2951, Cisco 3945, and Cisco 3945E), and the Cisco 4451 ISR, support hosting an agent on aUCS E-Series blade server. The UCS E-Series server must run a vSphere ESXi hypervisor. For more information on the G2 ISRs,see http://www.cisco.com/c/en/us/td/docs/routers/access/1900/roadmap/ISRG2_roadmap.html

ISR G2 Platform Requirements

Table 9: ISR G2 Platform Requirements

RequiredISR Component

• Cisco 2921,

• Cisco 2951,

• Cisco 3945, or

• Cisco 3945E

Model

2560 MB (2.5 GB) (Cisco 2921) or 1844 MB (1.8 GB) (Cisco2951, 3945, 3945E)

DRAM

10

Page 11: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

RequiredISR Component

IOS Release 15.5(3)M1 or greaterImage

Version 16.0 or greaterNBAR2 Protocol Pack

Cisco 2921, 2951:

• SL-29-IPB-K9 - IP Base license, and

• SL-29-DATA-K9 - Data license

Cisco 3945, 3945E:

• SL-39-IPB-K9 - IP Base license, and

• SL-39-DATA-K9 - Data license

See http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/software-activation-on-integrated-services-routers-isr/white_paper_c11_556985.html#wp9001357 for more information.

Licenses

One of the following models with 8192 MB (8 GB) of RAMand 155 GB free storage space, running vSphere ESXiHypervisor Version 5.0 or greater:

• UCS-E140S-M2/K9,

• UCS-E140D-M1/K9,

• UCS-E140DP-M1/K9,

• UCS-E160D-M1/K9,

• UCS-E160D-M2/K9,

• UCS-E160DP-M1/K9, or

• UCS-E180D-M2/K9

UCS E-Series Blade Server

ISR 4000 Series Platform Requirements

Table 10: ISR 4000 Series Platform Requirements

RequiredISR Component

Cisco 4451Model

8192 MB (8 GB)Control Plane DRAM

Version 15010638 or greaterComplex Programmable Logic Device

11

Page 12: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

RequiredISR Component

IOS-XE Release 15.4(3)S1 through 15.5(3)SxImage

Version 15.0.0 or greater (IOS-XE 15.4(3)S1 through 15.5(3)S)

Version 17.0.0 or greater (IOS-XE 15.5(3)S, rebuild 2 orgreater

NBAR2 Protocol Pack

• SL-44-IPB-K9 - IP Base license, and

• SL-44-DATA-K9 - AppX license

See http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/guide-c07-732797.html#_Toc424288435 formore information.

Licenses

One of the following models with 8192 MB (8 GB) of RAM,155 GB free storage space, running vSphere ESXi HypervisorVersion 5.0 or greater:

• UCS-E140S-M2/K9,

• UCS-E140D-M1/K9,

• UCS-E140DP-M1/K9,

• UCS-E160D-M1/K9,

• UCS-E160D-M2/K9,

• UCS-E160DP-M1/K9, or

• UCS-E180D-M2/K9

UCS E-Series Blade Server

ISR Configuration Prerequisites

Information Needed for ISR Configuration

When you configure the ISR's NTP servers and flexible NetFlow, provide the following information:

Table 11: ISR Configuration Settings

DescriptionSetting

configure NTP server connectivity. Use a loopback interfaceif you have one configured, or the router management interfaceif you do not.

loopback interface IPv4 address or router management interface

synchronize time in Learning Network License systemNTP server IPv4 addresses

pass NetFlow packets from the ISR to the agentagent eth1 IPv4 address for NetFlow exporter

12

Page 13: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

ISR License Installation

To run a agent on an ISR-G2, you must activate an IP Base (ipbasek9) IOS license, and a Data (datak9) IOS license. To run a agenton an ISR-G3, you must activate an IP base (ipbasek9) IOS license, and an App (appxk9) IOS license. Seehttp://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.html for more information on activating the licenses.

Downloading the OVA Files from Cisco

Procedure

Step 1 In your web browser, navigate to http://www.cisco.com/c/en/us/support/security/stealthwatch-learning-network-license/tsd-products-support-series-home.html. Enter your username and password when prompted.

Step 2 Download the controller OVA file: sln-sca-k9-<ver>.ovaStep 3 Download an agent OVA file:

• sln-dla-ucse-k9-<ver>.ova - contains the agent to be deployed on an ISR's UCS E-Series blade server

Controller DeploymentCisco provides the controller as a downloadable OVA file. You can deploy this OVA file to a host running an ESXi hypervisor.

Before you start the controller VM, you can update the memory, number of vCPUs, and hard disk space in vSphere vCenter. If youincrease the memory, you must start the VM, then run the setup-system script. After you run the script, the VM is updated withproper memory settings.

If your controller is already running, and you want to update the memory settings, run the setup-system script, stop the VM, updatethe memory settings, and start the VM. On restart, the VM is updated with proper memory settings.

See Controller Installation Prerequisites, on page 6 for more information on recommended controller VM settings, based ondeployment size.

The first time you log into the virtual machine, the system prompts you to change the default administrator password.

Deploying the OVA File

Before You Begin

• Download the OVA file.

• Download VMware vSphere Client from https://my.vmware.com/web/vmware/downloads and install it.

13

Page 14: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Procedure

Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you want to install the OVA file.Step 2 Select File > Deploy OVF Template.Step 3 Click Browse to select your OVA file, then click Next.Step 4 Review the OVF Template Details, then click Next.Step 5 Enter a Name, select an inventory location, then click Next.Step 6 Click the Thick Provision Lazy Zeroed radio button, then click Next.Step 7 Select a Destination Network from your inventory to map to a Source Network. You can map the following default

networks, then click Next.

• eth0 to Main Network

• eth1 (disconnected) to Alt1 Network

• eth2 (disconnected) to Alt2 NetworkIf you only need to configure eth0, you canmap eth1 and eth2 to the same network.Note

Step 8 Review your deployment settings and click Finish.The deployment may take 30minutes to an hour or longer, depending on your environment.Note

Step 9 Click Close after the deployment completes.

What to Do Next

• Power on the virtual machine and login, as described in the next section.

Powering On the Virtual Machine

Before You Begin

• Deploy the OVA file to the ESXi hypervisor, as described in the previous section.

Procedure

Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you deployed the virtual machine.Step 2 Select Home > Inventory > VMs and Templates.Step 3 Select the virtual machine from the navigation tree.Step 4 Select Inventory > Virtual Machine > Power > Power On.Step 5 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.

To shift your focus from the virtual machine console to your local host, pressCtrl-Alt.Note

14

Page 15: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Step 6 Log in with the default administrator username (sln) and the default administrator password (cisco). When prompted,change the default administrator password.

What to Do Next

• Run the setup script to configure the virtual machine, as described in the next section.

Configuring the Controller with the Setup ScriptIf you need multiple interfaces on multiple subnets, when configuring networking, you can also configure eth1 and eth2.

Before You Begin

• Log into the controller VM console.

Procedure

PurposeCommand or Action

Change directories.cd ~/

Example:

Step 1

user@host:~$ cd ~/

Run the setup script.sudo ./setup-system at the command promptto run the setup script. Enter the administratorpassword if prompted.

Step 2

Example:user@host:~$ sudo ./setup-system

Configure networking.y (configure networking)Step 3

Configure the eth0 interface.1 (configure eth0)Step 4

Configure the controller VM hostname. You must enter a fullqualified domain name.

hostname, then hostname, then y to confirmStep 5

Configure the interface's IPv4 address, along with a netmaskand gateway.

ipv4, then ipv4-address, then ipv4-netmask,then ipv4-gateway, then y to confirm

Step 6

Modify the virtual machine's list of DNS servers.dns, then dns-servers, then y to confirmStep 7

If you want to configure the domain suffix search list, run thesearch command.

search, then domain-suffixes, then y to confirmStep 8

View the interface's network settings, hostname, and DNSsettings. If any of these are missing or incorrect, repeat thatconfiguration.

viewStep 9

Save your changes and continue with interface configuration.exitStep 10

Exit interface configuration and continue.4 (exit interface configuration)Step 11

15

Page 16: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

Enable SSH login.y (enable SSH login)Step 12

Configure NTP servers used to synchronize time between thecontroller and agent. Enter a space-delimited list of NTP serverfully-qualified domain names (FQDNs) or IPv4 addresses.

y, then ntp-servers, then y to confirmStep 13

Generate a controller self-signed certificate, used for encryptingcontroller/agent communication.

y (generate certificate)Step 14

Generate a controller web UI self-signed certificate, used forencrypting user connections to the controller web user interface.

y (generate certificate)Step 15

Optionally, specify the certificate subject distinguished name(DN).

y (specify the distinguished name)Step 16

Optionally, provide the DN information.country-code, then state, then locality, thenorganization, then organizational-unit, thencommon-name, then email

Step 17

Verifying NTP Configuration on the Controller

Before You Begin

• Log into the controller VM console.

Procedure

PurposeCommand or Action

Display configured NTP servers. If the system does not display configuredNTP servers, repeat NTP configuration in Configuring the Controller withthe Setup Script, on page 15.

ntpq –n –p

Example:

Step 1

user@host:~$ ntpq –n –p

What to Do Next

• Configure NTP and NetFlow, as described in the next section.

NTP ConfigurationTo configure NTP server addresses on the ISR, associate the router management interface with the NTP servers. Alternatively, if youhave a loopback interface already configured, you can use that instead to reference NTP servers.

16

Page 17: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Configuring NTP on the ISRYou can enter each command individually. You can also paste the commands from the example below into a text editor, update thevariable, then paste all the updated commands into the command line.enablentp source GigabitEthernet0/0/0ntp server <ipv4-addresses>exitIf you have an existing loopback interface, use that as the NTP source interface. Otherwise, use the router management interface.

Procedure

PurposeCommand or Action

Enable privileged EXEC mode. Enter your password ifprompted.

enable

Example:

Step 1

Router> enable

Use the GigabitEthernet0/0/0 interface to connect to an NTPserver.

ntp source GigabitEthernet0/0/0

Example:

Step 2

Router# ntp source GigabitEthernet0/0/0

Use the GigabitEthernet0/0/0 interface to connect to an NTPserver. Definemultiple addresses to specify backupNTP servers.

ntp server ipv4-addresses

Example:

Step 3

Router# ntp server 209.165.202.129

209.165.202.130

Display configured NTP servers. If the system does not displaycorrectly configured NTP servers, repeat the configurationprocess.

show ntp association

Example:

Step 4

Router# show ntp association

Exit privileged EXEC mode.exit

Example:

Step 5

Router# exit

NetFlow ConfigurationTo capture information about traffic traversing your network, you must configure the following Flexible NetFlow components inorder:

• SLN-NF-RECORD - a NetFlow flow record which defines key fields to match traffic, and non-key fields to collect

• SLN-NF-EXPORTER - a NetFlow flow exporter that references the agent Control IP address to send NetFlow data to the agent

17

Page 18: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

• SLN-NF-MONITOR - a NetFlow flow monitor that references SLN-NF-RECORD to monitor input and output traffic coming overconfigured branch interfaces, and forwards it to SLN-NF-EXPORTER

The following diagram illustrates NetFlow operation on the ISR.

Figure 4: NetFlow Operation on the ISR

As input and output traffic passes over the branch facing interfaces, the SLN-NF-MONITOR flowmonitor, referencing the SLN-NF-RECORDflow record, monitors the traffic for the key fields. It collects the non-key fields defined in the flow record. The flow monitor sendsthe flow record to the SLN-NF-EXPORTER flow exporter, which then sends it to the configured ISR ucs.../0 Control IP address.

Configuring NetFlow

Procedure

PurposeCommand or Action

Enter global configuration mode, create theSLN-NF-RECORD flow record, and enter flow record

Copy all the commands, paste them into a text editor, and updatecollect timestamp [absolute | sys-uptime] first and collect

Step 1

configuration mode. Configure the flow record totimestamp [absolute | sys-uptime] last. For supported G3match key fields and collect nonkey fields. Exit flowISRs, use sys-uptime. For other ISRs, use absolute. After you

18

Page 19: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

update the commands, paste them into the command line and pressEnter to configure the NetFlow record.

record configuration mode and return to globalconfiguration mode.

Example:configure terminalflow record SLN-NF-RECORD

match ipv4 protocolmatch ipv4 source addressmatch ipv4 destination addressmatch transport source-portmatch transport destination-portcollect datalink mac source address inputcollect datalink mac destination address outputcollect transport tcp flagscollect interface inputcollect interface outputcollect flow directioncollect counter bytescollect counter packetscollect timestamp [absolute | sys-uptime] firstcollect timestamp [absolute | sys-uptime] lastcollect application namecollect routing forwarding-statusexit

Update the flow exporter commands with the IPaddress associated with the agent deployed to the UCSE-blade server.

Copy the following commands into a text editor. Replace<dla-ip-address> with the IP address associated with the agentdeployed to the UCS E-Series blade server. You configure this onthe agent in a later step.

Step 2

Example:configure terminalflow exporter SLN-NF-EXPORTER

destination <dla-ip-address>transport udp 6666template data timeout 300exit

Enter global configuration mode, create theSLN-NF-EXPORTER flow exporter, and enter flow

Copy the updated commands from the text editor into the commandline and press Enter to configure the NetFlow exporter.

Step 3

exporter configuration mode. Configure the flowexporter to send flow records to the destination IPaddress. Exit flow exporter configuration mode andreturn to global configuration mode.

Create the SLN-NF-MONITOR flow monitor, andenter flowmonitor configuration mode. Configure the

Copy the following commands into the command line, and pressEnter to configure the NetFlow flow monitor.

Step 4

flowmonitor to reference the SLN-NF-RECORD flowExample:flow monitor SLN-NF-MONITOR

cache timeout active 60

record, and configure cache settings. Exit flowmonitorconfiguration mode and return to privileged EXECmode.

cache entries 512000record SLN-NF-RECORDend

Update the interface commands with every interfacename.

Copy the following commands into a text editor. Replace <name>with the name of an ISR interface that faces the branch's users.Repeat this for all ISR interfaces that face the branch's users.

Step 5

19

Page 20: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

Example:configure terminalinterface <name>

ip flow monitor SLN-NF-MONITOR inputip flow monitor SLN-NF-MONITOR output

end

Specify an ISR interface and enter interfaceconfiguration mode. Assign the SLN-NF-MONITOR

Copy the updated commands from the text editor into the commandline and press Enter to assign the NetFlow flow monitor to thespecified interface.

Step 6

flow monitor to the interface and monitor incomingand outgoing traffic on the interface. Exit interfaceconfiguration mode and return to privileged EXECmode. Repeat for each ISR interface.

Agent Deployment to a UCS E-Series Blade ServerCisco provides the agent as a downloadable OVA file. You can deploy this OVA file to a UCS E-Series blade server running an ESXihypervisor on a Cisco 2921, Cisco 3945, Cisco 3945E, or Cisco 4451 ISR.

Configure virtual switches on the blade server, then deploy the agent virtual machine. After you power on the virtual machine, whenyou first log in, the system prompts you to change the default administrator password.

Configuring Virtual SwitchesWhen you deploy the ESXi hypervisor on the UCS E-Series blade server, the system automatically creates a virtual switch using thevmnic2 physical adaptor. This is associated with the GE2 external interface.

Configure two additional virtual switches, using the vmnic0 and vmnic1 physical adaptors. The vmnic0 virtual switch connects to theUCS-E GE0 internal interface, and this connects to the ISR UCS...1/0 interface. The vmnic1 virtual switch connects to the UCS-EGE1 internal interface, and this connects to the ISR UCS...1/1 interface.

Before You Begin

• Open VMware vSphere Client and connect to the ESXi hypervisor.

Procedure

Step 1 Select View > Inventory > Hosts and Clusters

20

Page 21: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Step 2 Select the blade server from the navigation tree.Step 3 Select the Configuration tab.Step 4 In the Hardware pane, click Networking.Step 5 In the View: vSphere Standard Switch pane, click Add Networking.Step 6 In the Connection Types pane, select Virtual Machine and click Next.Step 7 Select Create a vSphere standard switch, vmnic0, and click Next.Step 8 Enter a Network Label and, optionally, a VLAN ID and click Next.Step 9 Click Finish.Step 10 Repeat the procedure for vmnic1.

UCS E-Series Blade Server DeploymentEnsure you have completed the following before deploying the agent:

• install the UCS E-Series blade server in the host ISR

• configure the server's GE2 interface with a routable IP address

• connect an ethernet cable to the server's GE2 interface front panel port, and connect the other end of the cable into a L2 top-of-rackswitch or router connected to your network

• configure a management network for ESXi using the vmnic2 network adapter

• start the UCS-E server and make sure it boots into the ESXi boot menu. If the server does not boot into the ESXi boot menu,see http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/1-0/gs/guide/b_Getting_Started_Guide/b_Getting_Started_Guide_chapter_0111.html#concept_4F2D448A505A4EBBA1A626CDC3D4118C for information on configuring the bootorder through CIMC. Configure the hard disk drive (HDD) as first in the boot order, save your changes, then reboot the server.

For more information on configuring ESXi, see https://www.vmware.com/files/pdf/ESXi_management.pdf.

For more information on configuring the UCS E-Series server, see the Getting Start Guide for Cisco UCS E-Series Servers and theCisco UCS E-Series Network Compute Engine, at https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/3-0/gs/guide/b_3_x_Getting_Started_Guide.html. For more information on UCS E-Series servers, see the Documentation Guide for Cisco UCSE-Series Servers and the Cisco UCS E-Series Network Compute Engine, at http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/e/1-0/roadmap/e_series_road_map.html

Deploying the OVA File

Before You Begin

• Download the OVA file.

• Download VMware vSphere Client from https://my.vmware.com/web/vmware/downloads and install it.

21

Page 22: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Procedure

Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you want to install the OVA file.Step 2 Select File > Deploy OVF Template.Step 3 Click Browse to select your OVA file, then click Next.Step 4 Review the OVF Template Details, then click Next.Step 5 Enter a Name, select an inventory location, then click Next.Step 6 Click the Thick Provision Lazy Zeroed radio button, then click Next.Step 7 Select a Destination Network from your inventory to map to a Source Network. You can map the following default

networks, then click Next.

• eth0 to Main Network

• eth1 (disconnected) to Alt1 Network

• eth2 (disconnected) to Alt2 NetworkIf you only need to configure eth0, you canmap eth1 and eth2 to the same network.Note

Step 8 Review your deployment settings and click Finish.The deployment may take 30minutes to an hour or longer, depending on your environment.Note

Step 9 Click Close after the deployment completes.

What to Do Next

• Power on the virtual machine and login, as described in the next section.

Powering On the Virtual Machine

Before You Begin

• Deploy the OVA file to the ESXi hypervisor, as described in the previous section.

Procedure

Step 1 Open vSphere Client, and connect to the ESXi hypervisor where you deployed the virtual machine.Step 2 Select Home > Inventory > VMs and Templates.Step 3 Select the virtual machine from the navigation tree.Step 4 Select Inventory > Virtual Machine > Power > Power On.Step 5 Click the Console tab, then click in the console pane to shift your focus to the virtual machine console.

To shift your focus from the virtual machine console to your local host, pressCtrl-Alt.Note

22

Page 23: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Step 6 Log in with the default administrator username (sln) and the default administrator password (cisco). When prompted,change the default administrator password.

What to Do Next

• Run the setup script to configure the virtual machine, as described in the next section.

Agent Configuration OverviewAgent configuration through the setup script is similar to the controller setup script. It allows you to define basic network settingsand generate a certificate for controller/agent communications.

Configuring an Agent with the Setup ScriptRun the setup script to configure hostname, interfaces, and generate a public key certificate for the agent. The eth0 interface handlesmanagement traffic passed between the agent and controller, and requires a routable IP address. The agent passes anomalies to thecontroller for further analysis. The eth1 interface handles Netflow and other traffic passed between the ISR and agent, and requiresa private IP address. The agent examines this traffic for anomalies. The eth2 interface is for packet buffer capture, passing raw packetdata from ISR to agent, and requires a private IP address. The agent passes PCAP archive files to the controller through the managementinterface when the user requests them from the controller.

Before You Begin

• Log into the agent's console.

Procedure

PurposeCommand or Action

Connect to the ESXi hypervisor where you deployedthe virtual machine.

Step 1

Select Home > Inventory > VMs and Templates.Step 2

Select the virtual machine from the navigation tree.Step 3

To shift your focus from the virtual machineconsole to your local host, press Ctrl-Alt.

NoteClick the Console tab, then click in the console paneto shift your focus to the virtual machine console.

Step 4

Log in with the administrator username (sln) andpassword (cisco). Update the administrator passwordwhen prompted.

Step 5

Change directories.cd ~/

Example:

Step 6

user@host:~$ cd ~/

23

Page 24: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

Run the setup script.sudo ./setup-system at the command prompt to runthe setup script. Enter the administrator password ifprompted.

Step 7

Example:user@host:~$ sudo ./setup-system

Configure network interfaces.yStep 8

Configure the eth0 interface.1) eth0

Example:

Step 9

Enter a number: 1

Configure the interface's routable IPv4 address, along witha netmask and gateway.

ipv4, then routable-ipv4-address, thenipv4-netmask, then ipv4-gateway, then y to confirm

Step 10

Configure the agent VM hostname.hostname, then hostname, then y to confirmStep 11

If you want to add the virtual machine's list of DNS servers,run the dns command.

dns, then dns-servers, then y to confirmStep 12

If you want to configure the domain suffix search list, runthe search command.

search, then domain-suffixes, then y to confirmStep 13

View the interface's network settings, hostname, and DNSsettings. If any of these are missing or incorrect, repeat thatconfiguration.

viewStep 14

Save your changes and continue with the setup script.exitStep 15

Configure the eth1 interface. This interface is connectedto the first UCS E-Series blade server interface.

2) eth1

Example:

Step 16

Enter a number: 2

Configure the interface's private IPv4 address, along witha netmask and gateway. Because traffic over this interface

ipv4, then private-ipv4-address, thenipv4-netmask, then optionally ipv4-gateway, theny to confirm

Step 17

does not leave the router, you do not have to configure agateway.

Save your changes and continue with the setup script.exitStep 18

If you want to use packet buffer capture, configure theeth2 interface. This interface is connected to the secondUCS E-Series blade server interface.

3) eth2

Example:

Step 19

Enter a number: 3

Configure the interface's private IPv4 address, along witha netmask and gateway. Because traffic over this interface

ipv4, then private-ipv4-address, thenipv4-netmask, then optionally ipv4-gateway, theny to confirm

Step 20

does not leave the router, you do not have to configure agateway.

Save your changes and continue with the setup script.exitStep 21

24

Page 25: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

Exit interface configuration.4) Exit

Example:

Step 22

Enter a number: 4

Enable SSH login.y , if you want to enable SSH login

Example:

Step 23

Do you want to enable SSH service now? (y or

n)[n] y

Configure a space-delimited list of NTP server addresses.y, then ntp-servers

Example:

Step 24

Do you want to configure NTP servers now? (y

or n)[n] y

Generate an agent self-signed certificate, used forencrypting controller/agent communication.

y (generate self-signed certificate)Step 25

Optionally, specify the certificate subject distinguishedname (DN).

y (specify the distinguished name)Step 26

Specify the subject distinguished name (DN) on thecertificate.

country-code, then state, then locality, thenorganization, then organizational-unit, thencommon-name, then email

Step 27

What to Do Next

• Verify the NTP configuration settings, as described in the next section.

Verifying NTP Configuration on the Agent

Before You Begin

• Log into the agent VM console.

Procedure

PurposeCommand or Action

Display configured NTP servers. If the system does not display configuredNTP servers, repeat NTP configuration in Configuring an Agent with theSetup Script, on page 23.

ntpq –n –p

Example:

Step 1

user@host:~$ ntpq –n –p

25

Page 26: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

What to Do Next

• Configure public key certificate trust settings, as described in the next section.

Controller and Agent Communications OverviewEnsure that the controller can ping the agents and communicate. If you cannot ping the agents, check your network settings.

When you ran the agent and controller setup scripts, you also generated public key certificates. The Learning Network License systemimplements certificate pinning to identify public key certificates. If you enable TOFU, the agent trusts the first certificate it sees thefirst time it connects to the controller. It generates a certificate fingerprint, and on subsequent connections, compares the storedfingerprint to the passed certificate to verify the identity of the controller. If you do not enable TOFU, you can also generate a certificatefingerprint and upload that to the agent.

On the controller, you can also enable TOFU. On first connection, the controller adds the agent public key certificate to a trustedstore. For future connections, when the agent connects to the controller, the controller compares the certificate to those stored in thetrusted store. If the certificate matches a certificate in the store, the controller establishes the connection.

To configure the certificates, run the agent administrator script to:

• configure the agent to trust the controller certificate

• store an ISR login on the agent for communication between the ISR and agent

Then, restart the agent's processes.

After that, enable TOFU on the controller, and then restart the controller processes to ensure the controller recognizes and trusts thesecertificates.

Pinging Agents from the ControllerIf you cannot ping the agents, check your network settings.

Before You Begin

• Log into the controller VM console.

Procedure

PurposeCommand or Action

Ping the agent IP address with 5 packets.ping dla-mgmt-ip-address -c 5

Example:

Step 1

user@host:~$ ping 209.165.201.3 -c 5

Repeat the previous step for all remaining agents.Step 2

What to Do Next

• Manage agent certificate trust settings, as described in the next section.

26

Page 27: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Agent Administrator SettingsThe agent administrator script contains options to administrate and troubleshoot your agent, including public key certificatemanagement,and log and debug file management options.

During initial agent installation, you must manage the certificate and trust model. The system uses certificate pinning and verifies apublic key certificate against a previously generated certificate fingerprint. You can either enable TOFU, which Cisco recommends,or upload the controller certificate fingerprint.

No certificate fingerprint exists the first time the controller and agent establish a connection. If you enable TOFU, the first time thecontroller and agent establish a secure connection, the agent trusts the controller certificate, and generates a certificate fingerprint.On subsequent connections, the agent can verify the controller certificate against the pinned fingerprint.

If you enable TOFU on your agent, either manage the agent with the controller soon after, or stop theagent processes until you are ready to continue.

Note

You can also upload the controller certificate fingerprint to the agent before you establish a connection between the two. The agent,on first connection, uses the fingerprint to authorize the certificate.

After you enable TOFU or upload the controller certificate fingerprint, store an ISR login and password on the agent to enablecommunications between the ISR and agent. Finally, restart the agent processes so the changes can take effect.

Enable Trust on First Use

Before You Begin

• Log into the agent VM console as sln.

Procedure

PurposeCommand or Action

Change directories.cd ~/DLA

Example:

Step 1

user@host:~$ cd ~/DLA

Run the administrator script../dla_admin

Example:

Step 2

user@host:~/DLA$ ./dla_admin

Enter the Certificate and trust management menu.4) Certificate and trust management

Example:

Step 3

Enter a number: 4

Enter the Certificate Pinning menu.1) Manage Certificate Pinning

Example:

Step 4

Enter a number: 1

27

Page 28: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

Enable TOFU, to trust the controller certificate thefirst time it is detected.

1) Enable Trust SCA Certificate on First Use

Example:

Step 5

Enter a number: 1

What to Do Next

• Store the host ISR's login information on the agent, as described in Storing ISR Authentication Information, on page 28.

Storing ISR Authentication Information

Provide the agent a login and password for the host ISR, to ensure proper communication between the agent and ISR.

Before You Begin

• Log into the agent VM console, run the agent administrator script, and return to the Top Level menu.

Procedure

PurposeCommand or Action

Access the PasswordManagement menu options.5) Password management

Example:

Step 1

Enter a number: 5

Update the stored host router login and passwordinformation.

1) Change router credentials

Example:

Step 2

Enter a number: 1

Update the stored host router login and passwordinformation.

Enter an ISR username and password, then confirm the passwordwhen prompted.

Example:Network Element Username: <router-username>Network Element Password: <router-username-password>

Step 3

Re-enter Network Element Password:<router-username-password>

What to Do Next

• Restart the agent processes, as described in Restarting Agent Processes, on page 29.

28

Page 29: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Restarting Agent Processes

Before You Begin

• Log into the agent VM console, run the agent administrator script, and return to the Top Level menu.

Procedure

PurposeCommand or Action

Access the process management menu options.3) DLA process management

Example:

Step 1

Enter a number: 3

Restart the agent processes.4) Restart DLA processes, then y to confirm

Example:Enter a number: 4Proceed with DLA restart? [confirm] y

Step 2

What to Do Next

• Update the controller configuration file, as described in Updating the Controller Configuration, on page 29.

Controller Certificate ManagementAfter you export all the agent certificates to the controller, modify the controller configuration file. You can enable the controller touse self-signed agent certificates, and enable TOFU. After this, restart the controller processes.

Updating the Controller Configuration

The sca.conf configuration file contains several layers of nested brackets. When you update the file to add or update the dla node,make sure that you nest it within the sln bracket. See the following for an example.sln {dla {security {allowSelfSignedCert = truetrustCertOnFirstUse = truecertRollover = true

}}

}You can also reference ~/SCA/sample_sca.conf for an example of syntax.

Before You Begin

• Log into the controller VM console.

29

Page 30: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Procedure

PurposeCommand or Action

Change to the /SCA directory.cd ~/SCA

Example:

Step 1

user@host:~$ cd ~/SCA

Edit the sca.conf configuration file.sudo vi sca.conf, then input your password whenprompted

Step 2

Example:user@host:~/SCA$ sudo vi sca.conf

Update the configuration file to includeallowSelfSignedCert = true,

Update the configuration file to include or modify the dlanode, as described above.

Step 3

trustCertOnFirstUse = true, and certRollover

= true.

Save your changes and exit the editor.Press Esc, then enter :wq! and press Enter.Step 4

What to Do Next

• Restart the controller's processes, as described in the next section.

Restarting Controller Processes

Before You Begin

• Log into the controller VM console.

Procedure

PurposeCommand or Action

Change directories.cd ~/SCA

Example:

Step 1

user@host:~$ cd ~/SCA

Stop the controller processes.sudo ./sca.sh stop

Example:

Step 2

user@host:~/SCA$ sudo ./sca.sh stop

Start the controller processes.sudo ./sca.sh start

Example:

Step 3

30

Page 31: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

PurposeCommand or Action

user@host:~/SCA$ sudo ./sca.sh start

What to Do Next

• Manage your agents with the controller, as described in the next section.

Smart Licensing OverviewTo deploy the Learning Network License, youmust register your controller with Cisco Smart Licensing. If you do not, your deploymententers Evaluation Mode, a 90-day trial which limits you to a maximum of 10 managedagents, and disables new functionality whenthe 90 days expire.

Cisco Smart Licensing lets you purchase and manage a pool of licenses centrally. Unlike product authorization key (PAK) licenses,Smart Licenses are not tied to a specific serial number or license key. Smart Licensing lets you assess your license usage and needsat a glance.

In addition, Smart Licensing does not prevent you from deploying agents. You can deploy agent and purchase the license later. Thisallows you to deploy and use an agent, and avoid delays due to purchase order approval.

Logging into the Learning Network License System

When you installed the controller, you defined an IP address for the controller web UI. If you are logging in for the first time, usethe default login password (cisco) for the admin account. After you log in once, you must change the password and confirm the newpassword.

Procedure

In your web browser, navigate to https://controller-web-ip-address, then enter your controller web username and passwordwhen prompted.

Registering the Controller Instance

Before You Begin

• Obtain a registration token from the Smart Software Manager (http://www.cisco.com/web/ordering/smart-software-manager/index.html).

• Log into the controller web UI.

31

Page 32: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Procedure

Step 1 Select Dashboard.Step 2 Click Smart Licensing.Step 3 Click Register.Step 4 Paste your registration token into the Smart Software Licensing Product Registration field.Step 5 If you want to use a registration token and the current token is still valid, check Reregister this product instance if it is

already registered.Step 6 Click Register.

Restarting the Controller Processes

Procedure

PurposeCommand or Action

Change directories.cd ~/SCA

Example:

Step 1

user@host:~$ cd ~/SCA

Stop the controller processes.sudo ./sca.sh stop

Example:

Step 2

user@host:~/SCA$ sudo ./sca.sh stop

Start the controller processes.sudo ./sca.sh start

Example:

Step 3

user@host:~/SCA$ sudo ./sca.sh start

What to Do Next

• Register your controller with Smart Licensing, as described in the next section.

Controller Management of AgentsAfter you trust public key certificates on both the agent and controller, manage your agents with your controller. You can log intothe controller web UI to add each agent.

32

Page 33: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Adding an Agent to the Controller

Before You Begin

• See Agent Configuration Notes, on page 33 for information on configuring your agents.

Procedure

Step 1 Select DLAS.Step 2 Click Add a DLA.Step 3 Enter the agent eth0 IP address in the DLA IP or hostname field, and an optional Description.Step 4 Click Submit.Step 5 Enter the ucs.../0 interface IPv4 address in the Network Element IP field. This IP address must be reachable by the

controller.Step 6 Click Submit.Step 7 For an interface, choose from the Direction drop-down:

• Internal if the interface faces the branch (generally, if NetFlow is configured on the interface)

• External if the interface faces the core (generally, if the interface is passing traffic)

• Unknown if you interface is unused, or the interface faces neither the branch nor the core

Step 8 Check the Enable mitigation checkbox to apply mitigation actions to this interface.Step 9 If you want to capture raw packet data and send it from the network element to the agent, take the following steps:

• Check Enable PBC/DPI on one or more interfaces to enable raw packet capture.

• Select a network element interface from the Raw Packet Tx Interface (on NE) drop-down on which the networkelement passes raw packets to the agent

• Select an agent interface from the Raw Packet Rx Interface (on DLA) drop-down on which the agent receives rawpackets from the network element.

Step 10 If you want to enable the packet buffer capture (PBC) feature, check Enable PBC. You must enable capturing raw packetdata.

Step 11 If you want to capture DNS query information, check Enable DPI/DPS. You must enable capturing raw packet data.Step 12 Click Submit.

What to Do Next

• Allow the system time to perform the initial learning phase, as described in Initial Learning Phase Overview, on page 34.

Agent Configuration NotesWhen configuring agents, note the following:

33

Page 34: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

• When configuring aDirection on your interface, choose Internal if the interface faces your branch, or if NetFlow is configuredon the interface. Choose External if the interface faces the core, or passes traffic. Choose Unknown if the interface is unused,or it faces neither the branch nor the core.

• If you want to enable packet buffer capture (PBC) or capture DNS query information, youmust first check theEnable PBC/DPIcheckbox.

• You can only check the Enable PBC/DPI checkbox on parent interfaces that contain the word Ethernet in their name.

• Subinterface configuration is not supported on 4000 Series ISRs.

• The system automatically checks the Enable Mitigation checkbox for all Ethernet and tunnel interfaces.

• You can check the Enable Mitigation checkbox for a parent interface or its subinterface, but not both.

Initial Learning Phase OverviewAfter you manage your agents with the controller, allow the system to run for seven days, inspect your network traffic, and build abaseline traffic model.

The Learning Network License system identifies anomalies by comparing detected traffic to the baseline model, and noting deviations.After system deployment, each agent inspects traffic traversing the router. During this initial learning phase, the agent builds a baselinetraffic model. The model includes dynamically-generated clusters of hosts, and what types of application traffic are transmittedbetween clusters at what times of day.

If you log into the controller web UI while the system is learning about your network, you may see very few or no reported anomalies,as the system cannot compare against a baseline yet. Towards the end of the initial learning phase, the system may start reportinganomalies, but without a complete baseline, these anomalies may not be relevant. After the initial learning phase, when each agentcompletes its baseline model, the system can properly identify anomalous traffic that deviates from the baseline.

For more information, see the Cisco Stealthwatch Learning Network License Configuration Guide.

Next StepsAfter you deploy the Learning Network License system, you can perform the following:

• Configure audit and event logging. See theCisco Stealthwatch Learning Network License UCS E-Series Blade Server InstallationGuide for more information.

• Integrate with an Identity Services Engine (ISE) server by configuring pxGrid integration. See the Cisco Stealthwatch LearningNetwork License UCS E-Series Blade Server Installation Guide for more information.

• Log into the controller web UI to configure user display settings, view anomalies and assign relevance feedback, configuremitigations for an anomaly, and configure external system integration. See the Cisco Stealthwatch Learning Network LicenseConfiguration Guide for more information.

For AssistanceThank you for using Cisco products.

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gatheringadditional information about the Firepower System, seeWhat’s New in Cisco Product Documentation at http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.

34

Page 35: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Subscribe toWhat’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSSfeed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

If you have any questions or require assistance with the Cisco Stealthwatch Learning Network License system, please contact CiscoSupport:

• Visit the Cisco Support site at http://support.cisco.com.

• Email Cisco Support at [email protected].

• Call Cisco Support at 1.408.526.7209 or 1.800.553.2447.

35

Page 36: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

© 2016 Cisco Systems, Inc. All rights reserved.

Page 37: Cisco Stealthwatch Learning Network License UCS E-Series … · Cisco Stealthwatch Learning Network License UCS E-Series Server Quick Start Guide CiscoStealthwatchLearningNetworkLicenseQuickStartGuide2

Europe HeadquartersAsia Pacific HeadquartersAmericas HeadquartersCisco Systems International BVAmsterdam, The Netherlands

Cisco Systems (USA) Pte. Ltd.Singapore

Cisco Systems, Inc.San Jose, CA 95134-1706USA

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on theCisco Website at www.cisco.com/go/offices.