SW 7 2 Installation and Configuration Guide DV 3 0

Cisco Stealthwatch
Installation and Configuration Guide 7.2

Table of Contents
Introduction 9
Overview 9
Virtual Edition (VE) 9
Hardware 9
Audience 9
Process 10
Terminology 10
Abbreviations 11
Before You Begin 12
Hardware 12
Virtual Appliances 13
Installation Methods 13
Compatibility 14
VMware 14
KVM 14
Downloading Software 15
Licensing 15
TLS 15
Third Party Applications 15
Browsers 15
Host Name 16
Domain Name 16
NTP Server 16
Time Zone 16
Hardware Resource Requirements 17
Virtual Edition (VE) Resource Requirements 18
Stealthwatch Management Console VE 19
© 2020 Cisco Systems, Inc. and/or its affiliates. All rights reserved. -2-
Stealthwatch Management Console VE 2000 19
Stealthwatch Management Console VE Models and Capacities 20
Flow Collector VE 21
Flow Sensor VE 22
Flow Sensor VE Network Environments 23
Flow Sensor VE Traffic 23
UDP Director VE 25
Endpoint Concentrator 25
Data Storage 26
Quick Reference Workflows 28
Stealthwatch Hardware 28
Stealthwatch Virtual Edition (VE) 28
1. Installing a Virtual Appliance: Configuring your Firewall and Ports 29
Overview 29
Placing the Appliances 29
Stealthwatch Management Console 29
Stealthwatch Flow Collector 29
Stealthwatch Flow Sensor 30
Important Considerations for Integration 30
TAPs 31
Using Electrical TAPs 31
Using Optical TAPs 32
Using TAPs Outside Your Firewall 32
Placing the Flow Sensor VE Inside Your Firewall 33
SPAN Ports 34
Stealthwatch UDP Director 35
Configuring Your Firewall for Communications 36
Open Ports 36
Stealthwatch Management Console (SMC), Flow Collector, Flow Sensor, 36
and UDP Director
Communication Ports and Protocols 37
Optional Communication Ports 39
2. Downloading VE Installation Files 41
Installation Files 41
1. Log in to Cisco Software Central 41
2. Download Files 42
3a. Installing a Virtual Appliance using VMware vCenter (OVF) 43
Overview 43
Before You Begin 43
Installing a Virtual Appliance Using vCenter (OVF) 44
Process Overview 44
1. Logging in to the VMware Web Client 44
2. Configuring the Flow Sensor to Monitor Traffic 45
Monitoring External Traffic with PCI Pass-Through 45
Monitoring a vSwitch with Multiple Hosts 46
Configuration Requirements 46
Monitoring a vSwitch with a Single Host 49
Configure the Port Group to Promiscous Mode 49
3. Installing the Virtual Appliance 52
4. Defining Additional Monitoring Ports (Flow Sensors only) 56
3b. Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO) 59
Overview 59
Before You Begin 59
Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO) 60
Process Overview 60
1. Logging in to the VMware Web Client 60
2. Booting from the ISO 62
3c. Installing a Virtual Appliance on a KVM Host (ISO) 64
Overview 64
Before You Begin 64
Installing a Virtual Appliance on a KVM Host (ISO) 65
Process Overview 65
1. Installing a Virtual Appliance on a KVM Host 65
Monitoring Traffic 65
Installing a Virtual Appliance on a KVM Host 65
2. Adding NIC and Promiscuous Port Monitoring on an Open vSwitch (Flow
Sensors Only) 72
4. Configuring the IP Addresses 74
Configure the IP Addresses 74
Troubleshooting 78
Certificate Error 78
Accessing the Appliance 78
5. Configuring Your Stealthwatch System 80
Preparation 80
Appliance Setup Tool Requirements 80
Managed 80
SMC Failover 80
Best Practices 81
Configuration Order 82
1. Log In 83
2. Configure the Appliance 83
3. Register the Stealthwatch Management Console 88
4. Add Appliances to Central Management 89
5. Confirm Appliance Status 91
6. Finishing Appliance Configurations 93
UDP Director 94
Configuring Forwarding Rules 94
Configuring High Availability 95
Primary Node and Secondary Node 96
Requirements 96
1. Configure the Primary UDP Director HA 96
2. Configure the Secondary UDP Director HA 98
Flow Sensor 99
1. Configure the Application ID and Payload 99
2. Configure the Flow Sensor to Identify Applications (optional) 102
3. Restart the Appliance 102
Troubleshooting the Endpoint Concentrator 105
7. Installing the Stealthwatch Desktop Client 106
Install the Desktop Client Using Windows 106
Change the Memory Size 107
Install the Desktop Client Using macOS 108
Change the Memory Size 109
8. Verifying Communications 110
Verify NetFlow Data Collection 110
9. Licensing 113
Evaluation Mode 113
Defining an SMC Failover Relationship 114
Enabling the Threat Intelligence Feed 115
License 115
Enable 115
Review Alarms and Security Events 115
Configuring SAML SSO 117
1. Prepare for Configuration 117
2. Upload Certificates to the Trust Store 117
3. Configure the Service Provider 118
4. Enable SSO 119
5. Configure the Identity Provider 120
6. Add an SSO User 120
7. Test SAML Login 121
Troubleshooting 122
Getting Started with Stealthwatch 123
Overview 123
Managing Your Environment 123
Investigating Behavior 123
Responding To Threats 124
Central Management 125
Central Management and Appliance Administration Interface 125
Opening Central Management 126
Opening Appliance Admin 126
Opening Appliance Admin through Central Management 126
Opening Appliance Admin through Direct Login 126
Editing Appliance Configuration 126
Viewing Appliance Statistics 128
Removing an Appliance from Central Management 128
Adding an Appliance to Central Management 129
Enable/Disable SSH 130
Open SSH 130
Enable SSH 130
Disable SSH 131
Installing Patches and Updating Software 132
Troubleshooting 133
Config Channel Down 133
Opening Appliance Administration Interface 133
Replacing the Appliance Identity 134
Changing Appliances After Configuration 134
Changing the Host Name 134
Changing the Network Domain Name 135
Changing IP Address 135
Opening the Appliance Setup Tool 136
System Configuration Overview 136
Changing the Trusted Hosts 137
Resetting Factory Defaults 137
Enabling/Disabling Admin Users 138
Enabling or Disabling Password Reset 138
Resetting Passwords to Default Settings 139
Resetting the Admin Password on the SMC 139
Resetting Admin, Root, Sysadmin Passwords to Default 139
Changing Passwords 141
Changing the Sysadmin Password 142
Changing the Root Password 142
Changing the Admin Password on the SMC 142
Changing the Admin Password on All Other Appliances 143
Contacting Support 144
Introduction
Introduction
Overview
Use this guide to configure the following Cisco Stealthwatch® Enterprise hardware and
Virtual Edition (VE) appliances:
l Stealthwatch Management Console (SMC)

l Stealthwatch Flow Collector
l Stealthwatch Flow Sensor
l Stealthwatch UDP Director
l Endpoint Concentrator
For more information about Stealthwatch, refer to the following online resources:
l Overview:
https://www.cisco.com/c/en/us/products/security/stealthwatch/index.html
l Appliances:
https://www.cisco.com/c/en/us/products/security/stealthwatch/datasheet-
listing.html
Virtual Edition (VE)

You can use this guide to install and configure your virtual appliances.
Hardware
If you are configuring Stealthwatch hardware, install your physical appliances using the
Stealthwatch x210 Series Hardware Installation Guide before you start this
configuration.
Audience
The intended audience for this guide includes network administrators and other
personnel who are responsible for installing and configuring Stealthwatch products.
If you are configuring virtual appliances, we assume you have basic familiarity with
VMware or KVM.
If you prefer to work with a professional installer, please contact your local Cisco Partner
or Cisco Stealthwatch Support.
Introduction
Process
Please note that we have a process for installing and configuring your Stealthwatch
appliances. The configuration includes the following:
l Configuration Order: Make sure you install and configure the appliances
following the instructions in this guide and using the configuration order.
l Certificates: Appliances are installed with a unique, self-signed appliance
identity certificate.
l Central Management: You can manage your appliances from the primary
SMC/Central Manager.
For details, refer to the Release Notes.
Terminology
This guide uses the term “appliance” for any Stealthwatch product, including virtual
products such as the Stealthwatch Flow Sensor Virtual Edition (VE).
A "cluster" is your group of Stealthwatch appliances that are managed by the
Stealthwatch Management Console (SMC).
© 2020 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 10 -
Introduction
Abbreviations
The following abbreviations may appear in this guide:
Abbreviations Definition
DNS Domain Name System (Service or Server)
dvPort Distributed Virtual Port
ESX Enterprise Server X
GB Gigabyte
IDS Intrusion Detection System
IPS Intrusion Prevention System
ISO International Standards Organization
IT Information Technology
KVM Kernel-based Virtual Machine
MTU Maximum Transmission Unit
NTP Network Time Protocol
OVF Open Virtualization Format
SMC Stealthwatch Management Console
TB Terabyte
UUID Universally Unique Identifier
VDS vNetwork Distributed Switch
VE Virtual Edition
VLAN Virtual Local Area Network
VM Virtual Machine
Before You Begin
Before You Begin

Before you begin, review this guide to understand the process as well as the
preparation, time, and resources you'll need to plan for the installation and
configuration.
Hardware
l Installation: Make sure you install your appliance hardware (physical appliances)
using the Stealthwatch x210 Series Hardware Installation Guide before you
configure them using this guide.
l Specifications: Hardware specifications are available on Cisco.com.
l Supported Platforms: To view the supported hardware platforms for each
system version, refer to the Hardware Version and Support Matrix on Cisco.com.
l Work Flow: See Quick Reference Workflows to review the instructions you'll
need to configure your hardware.
Before You Begin
Virtual Appliances
You can use a VMware environment or KVM (Kernel-based Virtual Machine) for the
virtual appliance installation.
Before you start the installation, review the compatibility information and
resource requirements.
Installation Methods
Use the following table to choose an installation method. Also, make sure you review
the compatibility and resource requirements before you start the installation.
Installation
Installation
Method Instructions Details
File
(for reference)
Installing your virtual

3a. VMware
VMware vCenter OVF appliances using VMware
vCenter
vCenter.
VMware ESXi 3b. VMware ESXi Installing your virtual

Stand-Alone Stand-Alone ISO appliances on an ESXi
Server Server stand-alone host server.
KVM and Virtual 3c. KVM and Installing your virtual

Machine Virtual Machine ISO appliances using KVM and
Manager Manager Virtual Machine Manager.
Before You Begin
Compatibility
Whether you plan to install your virtual appliances in a VMware environment or KVM
(Kernel-based Virtual Machine), make sure you review the following compatibility
information:
VMware
l Compatibility: VMware v6.5 or v6.7.
l OVF Deployment: We validated VMware v6.5 using update 2 and the vSphere
flash web client. There may be issues using other clients from vSphere. You can
use the ESXi 6.5 update 2 HTML5 client, but you may encounter system time-
outs.
l VMware Upgrades: We do not support VMware v6.0 with Stealthwatch v7.2.x. If
your Stealthwatch appliances are installed on VMware v6.0, upgrade your VMware
vCenter and ESXi hosts to v6.5 or v6.7 before you upgrade Stealthwatch to v7.2.x.
For instructions, refer to the Stealthwatch Update Guide v7.1.x to 7.2.1 and the
VMware documentation for vSphere 6.0 End of General Support.
l Live migration (for example, with vMotion) from host to host is not supported.
l Snapshots: Virtual machine snapshots are not supported.
Do not install VMware Tools on a Stealthwatch virtual appliance because it will

override the custom version already installed. Doing so would render the virtual
appliance inoperable and require reinstallation.
KVM
l Compatibility: using any compatible Linux distribution.
l KVM Host Versions: There are several methods used to install a virtual machine
on a KVM host. We tested KVM and validated performance using the following
components:
l libvirt 3.0.0
l qemu-KVM 2.8.0
l Open vSwitch 2.6.1
l Linux Kernel 4.4.38
l Virtualization Host: For minimum requirements and best performance, review the
Virtual Edition (VE) Resource Requirements section and see the hardware
specification sheet for your appliance at Cisco.com.
Before You Begin
The system performance is determined by the host environment. Your

performance may vary.
Downloading Software
Use Cisco Software Central to download virtual appliance (VE) installation files, patches,
and software update files. Log in to your Cisco Smart Account at
https://software.cisco.com or contact your administrator. Refer to 2. Downloading VE
Installation Files for instructions.
Licensing
For licensing Stealthwatch, you will use your Smart Account to register your product
instance, manage licenses, run reports, and configure notifications. Log in to your Cisco
Smart Account at https://software.cisco.com or contact your administrator.
When you use Stealthwatch in Evaluation mode, you can use selected features for 90
days. To use Stealthwatch with maximum default functionality, and to add licenses and
features to your account, register your product instance for Smart Software Licensing.
Refer to 9. Licensing for more information.
Make sure you register your product instance before the 90-day evaluation
period expires. When the evaluation period expires, flow collection will stop.
To start flow collection again, register your product instance.
TLS
Stealthwatch requires v1.2.
Third Party Applications

Stealthwatch does not support installing third party applications on appliances.
Browsers
l Compatible Browsers: Stealthwatch supports the latest version of Chrome,
Firefox, and Edge.
l Microsoft Edge: There may be a file size limitation with Microsoft Edge. We do
not recommend using Microsoft Edge to install the VE OVF or ISO files.
Before You Begin
Host Name
A unique host name is required for each appliance. We cannot configure an appliance
with the same host name as another appliance. Also, make sure each appliance host
name meets the Internet standard requirements for Internet hosts.
Domain Name
A fully qualified domain name is required for each appliance. We cannot install an
appliance with an empty domain.
NTP Server
l Configuration: At least 1 NTP server is required for each appliance.
l Problematic NTP: Remove the 130.126.24.53 NTP server if it is in your list of
servers. This server is known to be problematic and it is no longer supported in our
default list of NTP servers.
Time Zone
All Stealthwatch appliances use Coordinated Universal Time (UTC).
l Virtual Host Server: Make sure your virtual host server is set to the correct time.
Make sure the time setting on the virtual host server (where you will be
installing the virtual appliances) is set to the correct time. Otherwise, the
appliances may not be able to boot up.
Hardware Resource Requirements
Hardware Resource Requirements

Use the following table to record the settings that you will need to configure
Stealthwatch appliances.
Flow Flow UDP

Settings Stealthwatch Management Console (SMC)
Collector Sensor Director
Host Name
IP Address 192.168.1.11* 192.168.1.4* 192.168.1.7* 192.168.1.2*
Subnet Mask
Gateway
DNS Server(s)
NTP Server(s)
Mail Relay
*These are default IP addresses. The Flow Collector sFlow default is

192.168.1.5. The default for the Flow Collector 5000 Series Database is
192.168.1.15.
In addition, you could also use the following settings:

Port exporting flow data (usually 2055) ________________________________
SNMP read-only community string of routers _________________________________
___________________________________
Virtual Edition (VE) Resource Requirements

This section provides the resource requirements for the virtual appliances. Use the
tables provided in this section to record settings you will need to install and configure
the Stealthwatch VE appliances.

l Flow Collector
l Flow Sensor
l UDP Director
l Endpoint Concentrator
l Data Storage
Make sure you reserve the required resources for your system. This step is
critical for system performance.
If you choose to deploy Cisco Stealthwatch appliances without the required

resources, you assume the responsibility to closely monitor your appliance
resource utilization and increase resources as needed to ensure proper health
and function of the deployment.
Stealthwatch Management Console VE

To determine the minimum resource allocations for the Stealthwatch Management
Console VE, you should determine the number of Flow Collectors and users expected to
log in to the SMC.
Refer to the following specifications to determine your resource allocations. Also, refer
to Stealthwatch Management Console VE Models and Capacities for additional
information.
Required Required
Concurrent
Flow Collectors Reserved Reserved
Users*
Memory CPUs
1 2 24 GB 3
3 5 32 GB 4
5 10 32 GB 4
*Concurrent users include scheduled reports and people using the SMC client at the
same time.
Stealthwatch Management Console VE 2000

The following specifications are the default settings for the download of the
Stealthwatch Management Console VE 2000, the minimum and an estimate of the
hardware equivalent:
Required
Minimum Hardware
OVF or ISO
Reserved Equivalent*
Memory
RAM 64 GB 64 GB 128 GB
CPU 8 8 28
*These figures are based on the SMC 2010 appliance and physical (non hyper-threaded)
cores.
Stealthwatch Management Console VE Models and

Capacities
These are the Stealthwatch Management Console VE models and their capacities:
SMC VE Required Required

Reserved Reserved
Model Memory CPUs
SMC VE ≤ 63 GB up to 7
SMC VE 2000 ≥ 64 GB 8 or more
Flow Collector VE
To determine your resource requirements for the Flow Collector VE, you should
determine the flows per second expected on the network, and the number of exporters
and hosts it is expected to monitor. Refer to the following specifications to determine
your resource requirements:
Required Required Flow

Flows per
Exporters Hosts Reserved Reserved Collector VE
second
Memory CPUs Model
Up to
Up to 4,500 Up to 250 16 GB 2 FCVE
125,000
Up to Up to
Up to 500 24 GB 3 FCVE
15,000 250,000
Up to Up to Up to
32 GB 4 FCVE
22,500 1000 500,000
Up to Up to Up to
32 GB 5 FCVE
30,000 1000 500,000
Up to Up to Up to
64 GB 6 2000
60,000 1500 750,000
Up to Up to Up to
128 GB 7 4000
120,000 2000 1,000,000
Flow Sensor VE
Stealthwatch offers various types of Flow Sensor VEs depending upon the number of
NICs for the Flow Sensor VE.
l Cache: The Flow Cache Size column indicates the maximum number of active
flows that the Flow Sensor can process at the same time. The cache adjusts with
the amount of reserved memory, and flows are flushed every 60 seconds. Use the
Flow Cache Size to calculate the amount of memory needed for the amount of
traffic being monitored.
l Requirements: Your environment may require more resources depending on a
number of variables, such as average packet size, burst rate, and other network
and host conditions.
Flow Cache
NICs - Required Size
Required
monitoring Minimum (maximum
Reserved Estimated Throughput
ports Reserved number of
CPUs
(1 Gb) Memory concurrent
flows)
1 2 4 GB 850 Mbps 32,766
1,850 Mbps

2 4 8 GB Interfaces configured as PCI 65,537

pass-through (igb/ixgbe
compliant or e1000e
compliant)
3,700 Mbps
4 8 16 GB Interfaces configured as PCI 131,073

pass-through (igb/ixgbe
compliant or e1000e
compliant)
Optional: One or more 10G NICs may be used on the physical VM host.
These figures are based on tests with Cisco UCS C220 M4, which contains the
following:
l Processors: 2 Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40 GHz, 2 sockets, 12 cores

per socket
l Memory: 128 GB
l Storage: 800 GB
l ESXi: VMware vSphere 6.7.0
l Monitoring Interfaces: PCI pass-through with 1 Gbps and 10 Gbps interfaces
Flow Sensor VE Network Environments

Before installing the Flow Sensor VE, make sure you know the type of network
environment you have. This guide covers all types of network environments that a Flow
Sensor VE can monitor.
Compatibility: Stealthwatch supports a VDS environment, but it does not support
VMware Distributed Resource Scheduler (VM-DRS).
Virtual Network Environments: The Flow Sensor VE monitors the following types of
virtual network environments:
l A network with virtual local area network (VLAN) trunking

l Discrete VLANs where one or more VLANs are prohibited from attaching packet
monitoring devices (for example, due to local policy)
l Private VLANs
l Hypervisor hosts rather than VLANs
Integration: For integration information, review Stealthwatch Flow Sensor.
Flow Sensor VE Traffic

The Flow Sensor will process traffic with the following Ethertypes:
Ethertype Protocol
0x8000 Normal IPv4
0x86dd Normal IPv6
0x8909 SXP
0x8100 VLAN
0x88a8
0x9100
VLAN QnQ
0x9200
0x9300
0x8847 MLPS unicast
0x8848 MLPS multicast
The Flow Sensor saves the top-level MPLS label or VLAN ID and exports it. It
bypasses the other labels when it is processing packets.
UDP Director VE
The UDP Director VE requires that the virtual machine meets the following
specifications:
l 8 GB RAM
l Thick or Thin Provisioning: We recommend thick provisioning although thin
provisioning can be used if disk space is limited.
Endpoint Concentrator
These are the requirements for the Endpoint Concentrator 1000:
Required Required
Maximum FPS Rate
Reserved CPU Reserved Memory
2 8 GB 20,000
The capacity of your Flow Collector should be taken into consideration in

determining the number of Endpoint Concentrators needed for your
deployment.
Data Storage
The appliance data storage expands automatically when the appliance reboots. Also,
you may want to expand the appliance resource allocations to improve performance.
Use the following information to allocate storage for each appliance.
Make sure you reserve the required resources for your system. This step is

l Expansion Calculation: The virtual appliance uses approximately 75% of the

server for data storage, leaving 25% for the operating system and cache.
Therefore, always expand the data storage to 40% more than the desired amount.
l FPS Calculation: Allocate a minimum of 1 GB of data storage for every 1,000
flows per second (FPS) your system averages daily multiplied by the number of
days you want to store the flows. For example, if your system averages 2,000 FPS
and you want to store flows for 30 days, allocate a minimum of 60 GB (2 X 30) of
data storage space.
l Syslog: If the External Event processing (syslog) feature is used, more memory
and processing resources are required.
l Data Storage: Use the following table to determine the data storage required for
each appliance.
l Restart: If you increase the virtual machine memory using another method on your
Hypervisor host, restart the appliance after you have saved your changes.
Maximum
Required Addressable
Stealthwatch VE Model Minimum Storage/
Data Storage Hardware
Equivalent
Stealthwatch Management Console VE 150 GB 5.6 TB
Stealthwatch Management Console VE

200 GB 7.2 TB
2000
Flow Collector NetFlow VE 200 GB 1 TB
Flow Collector NetFlow VE 2000 600 GB 2 TB
Flow Collector NetFlow VE 4000 1.5 TB 7.2 TB
Flow Collector sFlow VE 200 GB 1 TB
Flow Collector sFlow VE 2000 600 GB 2 TB
Flow Collector sFlow VE 4000 1.5 TB 7.2 TB
Flow Sensor 100 GB
UDP Director 100 GB
Quick Reference Workflows
Quick Reference Workflows

This guide provides the information you need to install and configure your Stealthwatch
system. We've provided links so you can quickly find the information you need or skip
anything that does not apply to your setup.
Stealthwatch Hardware
Use the following workflow to configure your Stealthwatch hardware so it is managed
and communicating with your other appliances.
1. Use the Stealthwatch x210 Series Hardware Installation Guide to install your
Stealthwatch physical appliances.
2. Review the Introduction section and Hardware Resource Requirements to
plan for the configuration.
3. Go to 5. Configuring Your Stealthwatch System, and follow the instructions to
the end of this guide.
Stealthwatch Virtual Edition (VE)

Use the following workflow to install and configure your virtual appliances.
1. Review the Introduction section and Virtual Edition (VE) Resource
Requirements to plan for the VE installation and configuration.
2. Install your virtual appliances using the following instructions in this guide:
l 1. Installing a Virtual Appliance: Configuring your Firewall and Ports

l 2. Downloading VE Installation Files
l Choose an Installation Method:
l 3a. Installing a Virtual Appliance using VMware vCenter (OVF)
l 3b. Installing a Virtual Appliance on an ESXi Stand-Alone Server
(ISO)
l 3c. Installing a Virtual Appliance on a KVM Host (ISO)
l 4. Configuring the IP Addresses
3. Continue with 5. Configuring Your Stealthwatch System, and follow the
instructions to the end of this guide.
1. Installing a Virtual Appliance: Configuring your Firewall and Ports
1. Installing a Virtual Appliance: Configuring

your Firewall and Ports
Overview
Before you can install your virtual appliance, complete the following procedures to
prepare your network:
1. Placing the Appliances

2. Configuring Your Firewall for Communications
3. Stealthwatch Flow Sensor
Placing the Appliances

Review the placement information for each appliance you are installing.

l Flow Collector
l Flow Sensor
l UDP Director
Stealthwatch Management Console

As the management device, install the Stealthwatch Management Console at a location
on your network that is accessible to all the devices sending data to it.
If you have a failover pair of Stealthwatch Management Consoles, we recommend
installing the primary and the secondary consoles in separate physical locations. This
strategy will enhance a disaster recovery effort should it become necessary.
Stealthwatch Flow Collector

As collection and monitoring devices, the Stealthwatch Flow Collector should be
installed at a location on your network that is accessible to the NetFlow or sFlow devices
sending the data to a Flow Collector, as well as any devices you plan to use to access
the management interface.
When you place a Flow Collector outside a firewall, we recommend that you turn off the
setting Accept traffic from any exporter.
Stealthwatch Flow Sensor

As a passive monitoring device, the Stealthwatch Flow Sensor can sit at multiple points
on your network to observe and record IP activity, thereby protecting network integrity
and detecting security breaches. The Flow Sensor features integrated web-based
management systems that facilitate either centralized or remote management and
administration.
The Flow Sensor VE appliance is most effective when placed at critical segments of your
corporate network as follows:
l Inside your firewall to monitor traffic and determine if a firewall breach has
occurred
l Outside your firewall, monitoring traffic flow to analyze who is threatening your
firewall
l At sensitive segments of your network, offering protection from disgruntled
employees or hackers with root access
l At remote office locations that constitute vulnerable network extensions
l On your business network for protocol use management (for example, on
your transaction services subnet to determine if a hacker is running Telnet or FTP
and compromising your customers' financial data)
Important Considerations for Integration
The Stealthwatch Flow Sensor VE is versatile enough to integrate with a wide variety of
network topologies, technologies, and components. Before you install a Flow Sensor
VE, you must make several decisions about your network and how you want to monitor
it. It is important to review the following:
l Analyze your network's topology and your specific monitoring needs.

l Connect a Flow Sensor so that it receives network transmissions to and from the
monitored network, and, if desired, receives interior network transmissions as
well.
l For optimum performance when using the Flow Sensor to monitor physical
network traffic, configure your Flow Sensor VE with direct access to the underlying
physical host’s NICs (such as using an igb or e1000e compliant PCI pass-through).
The following sections explain how to integrate a Stealthwatch Flow Sensor VE

appliance into your network using the following Ethernet network devices:
l TAPs
l SPAN Ports
While not all network configurations can be discussed here, the examples may help you
determine the best setup for your monitoring needs. These examples provide physical
network scenarios, and the virtual host can be configured in a similar way.
TAPs
When a Test Access Port (TAP) is placed in line with a network connection, it repeats
the connection on a separate port or ports. For example, an Ethernet TAP placed in line
with an Ethernet cable will repeat each direction of transmission on separate ports.
Therefore, use of a TAP is the most reliable way to use the Flow Sensor. The type of
TAP you use depends on your network.
Configuration: For important configuration information, see Flow Sensor in the 5.

Configuring Your Stealthwatch System.
This section explains the following ways to use TAPs:
l Using Electrical TAPs

l Using Optical TAPs
l Using TAPs Outside Your Firewall
l Placing the Flow Sensor VE Inside Your Firewall
In a network using TAPs, the Flow Sensor VE can capture performance monitoring data
only if it is connected to an aggregating TAP that is capturing both inbound and
outbound traffic. If the Flow Sensor VE is connected to a unidirectional TAP that is
capturing only one direction of traffic on each port, then the Flow Sensor VE will not
capture performance monitoring data.
Using Electrical TAPs
The following illustration shows the Stealthwatch Flow Sensor VE connected to an

Ethernet electrical TAP. To achieve this configuration, connect the two TAP ports to the
Flow Sensor VE Monitor Ports 1 and 2, as shown.
Using Optical TAPs
Two splitters are required for fiber-optic–based systems. You can place a fiber-optic
cable splitter in line with each direction of transmission and use it to repeat the optical
signal for one direction of transmission.
The following illustration shows the Flow Sensor connected to a fiber-optic–based

network. To achieve this configuration, connect the outputs of the optical splitters to the
Flow Sensor VE Monitor Ports 1 and 2, as shown.
If the connection between the monitored networks is an optical connection, then the
Stealthwatch Flow Sensor VE appliance is connected to two optical splitters. The
management port is connected to either the switch of the monitored network or to
another switch or hub.
Using TAPs Outside Your Firewall

To have the Flow Sensor VE monitor traffic between your firewall and other networks,
connect the Stealthwatch management port to a switch or port outside of the firewall.
We strongly recommend that you use a TAP for this connection so that failure of the
device does not bring down your entire network.
The following illustration shows an example of this configuration using an Ethernet

electrical TAP. The management port must be connected to the switch or hub of the
monitored network. This setup is similar to the setup that monitors traffic to and from
your network.
If your firewall is performing network address translation (NAT), you can observe only
the addresses that are on the firewall.
Placing the Flow Sensor VE Inside Your Firewall

To monitor traffic between internal networks and a firewall, the Flow Sensor VE must be
able to access all traffic between the firewall and the internal networks. You can
accomplish this by configuring a mirror port that mirrors the connection to the firewall on
the main switch. Make sure that the Flow Sensor VE Monitor Port 1 is connected to the
mirror port, as shown in the following illustration:

To monitor traffic inside your firewall by using a TAP, insert the TAP or optical splitter
between your firewall and the main switch or hub. A TAP configuration is shown below.
An optical splitter configuration is shown below.
SPAN Ports
You can also connect the Flow Sensor VE to a switch. However, because a switch does
not repeat all traffic on each port, the Flow Sensor VE will not perform properly unless
the switch can repeat packets transmitted to and from one or more switch ports. This
type of switch port is sometimes called a mirror port or Switch Port Analyzer (SPAN).
The following illustration shows how you can achieve this configuration by connecting
your network to the Stealthwatch Flow Sensor VE through the management port.
In this configuration, you must configure a switch port (also called a mirror port), to
repeat all traffic to and from the host of interest to the mirror port. The Flow Sensor VE
Monitor Port 1 must be connected to this mirror port. This allows the Flow Sensor to
monitor traffic to and from the network of interest and to other networks. In this
instance, a network may be made up of some or all of the hosts connected to the switch.
A common way of configuring networks on a switch is to zone them into virtual local area
networks (VLANs), which are logical rather that physical connections of hosts. If the
mirror port is configured to mirror all ports on a VLAN or switch, the Flow Sensor VE can
monitor all traffic to, from, and within the network of interest, as well as other networks.
l Configuration: For important configuration information, see Flow Sensor in the

5. Configuring Your Stealthwatch System section.
l Documentation: In all cases, make sure you consult your switch manufacturer's
documentation to determine how to configure the switch mirror port and what
traffic will be repeated to the mirror port.
Stealthwatch UDP Director

The only requirement for the placement of the Stealthwatch UDP Director is that it has
an unobstructed communication path to the rest of your Stealthwatch appliances.
If you are deploying the UDP Director in an environment where Cisco's ACI is
being utilized and Unicast Reverse Path Forwarding (uRPF) or Limit IP
learning to subnet is enabled, the local network may block the forwarded
traffic leaving the UDP Director. You need to spoof the UDP traffic as part of the
forwarding rules so tools collecting the log data are able to know the original
source of traffic.
To ensure a successful operation of the UDP Director in this case, deploy your
UDP Director on a portion of your network where you can disable uRPF or Limit
IP learning to subnet (typically internally). You can place the UDP Director in
an L3 out (no IP learning). If on 4.0+, you can disable endpoint learning on a per
VRF basis.
Configuring Your Firewall for Communications

In order for the appliances to communicate properly, you should configure the network
so that firewalls or access control lists do not block the required connections. Use the
information provided in this section to configure your network so that the appliances can
communicate through the network.
Open Ports
Stealthwatch Management Console (SMC), Flow Collector, Flow Sensor, and
UDP Director
Consult with your network administrator to ensure that the following ports are open and
have unrestricted access:
l TCP 22
l TCP 25
l TCP 389
l TCP 443
l TCP 2393
l TCP 5222
l UDP 53
l UDP 123
l UDP 161
l UDP 162
l UDP 389
l UDP 514
l UDP 2055
l UDP 6343
Use the port information in this section to configure your network so the appliances can
communicate on the network:
l TCP 22
l TCP 443
l UDP 53
l UDP 123
l UDP 161
l UDP 162
l UDP 514
l UDP 2055
l UDP 3514
Communication Ports and Protocols

The following table shows how the ports are used in Stealthwatch:
From (Client) To (Server) Port Protocol
Admin User PC All appliances TCP/443 HTTPS
All appliances Network time source UDP/123 NTP
TCP/389,
Active Directory SMC LDAP
UDP/389
AnyConnect Endpoint Concentrator UDP/2055 NetFlow
Cisco ISE SMC TCP/443 HTTPS
Cisco ISE SMC TCP/5222 XMPP
Endpoint
Flow Collector UDP/2055 NetFlow
Concentrator
External log sources SMC UDP/514 SYSLOG
Flow Collector SMC TCP/443 HTTPS
UDP Director Flow Collector - sFlow UDP/6343 sFlow
UDP Director Flow Collector - NetFlow UDP/2055* NetFlow
3rd Party event management

UDP Director UDP/514 SYSLOG
systems
Flow Sensor SMC TCP/443 HTTPS
Flow Sensor Flow Collector - NetFlow UDP/2055 NetFlow
Identity SMC TCP/2393 SSL
NetFlow Exporters Flow Collector - NetFlow UDP/2055* NetFlow
sFlow Exporters Flow Collector - sFlow UDP/6343* sFlow
SMC Cisco ISE TCP/443 HTTPS
SMC DNS UDP/53 DNS
SMC Flow Collector TCP/443 HTTPS
SMC Flow Sensor TCP/443 HTTPS
SMC Identity TCP/2393 SSL
SMC Flow Exporters UDP/161 SNMP
SMC Endpoint Concentrator UDP/2055 netflow
SMC LDAP TCP/636 TLS
User PC SMC TCP/443 HTTPS
*This is the default NetFlow port, but any UDP port could be configured on
the exporter.
Optional Communication Ports

The following table is for optional configurations determined by your network needs:
All appliances User PC TCP/22 SSH
SMC 3rd Party event management systems UDP/162 SNMP-trap
SMC 3rd Party event management systems UDP/514 SYSLOG
SMC Email gateway TCP/25 SMTP
SMC Threat Intelligence Feed TCP/443 SSL
User PC All appliances TCP/22 SSH
The following diagram shows the various connections used by Stealthwatch. Some of
these ports are optional.
2. Downloading VE Installation Files

Use the following instructions to download the OVF or ISO files for your virtual appliance
installation. Refer to Installation Files to determine the file type.
Installation Files
Appliance
Virtual Machine Details
Installation File
Installing your virtual appliances

3a. VMware vCenter OVF
using VMware vCenter
If you have an ESXi stand-alone

3b. VMware ESXi Stand-
ISO host server, use this method to
Alone Server
install your appliances.
If you are planning to install your

3c. KVM and Virtual Machine virtual appliances using KVM
ISO
Manager and Virtual Machine Manager,
use this method.
1. Log in to Cisco Software Central

1. Log in to Cisco Software Central at https://software.cisco.com.
2. In the Download and Upgrade section, select Software Download.
3. Scroll down until you see the Select a Product field.
4. You can access Stealthwatch files in two ways:
l Search by Name: Type Stealthwatch in the Select a Product field. Press

Enter.
l Search by Menu: Click Browse All. Select Security > Network Visibility
and Segmentation > Stealthwatch.
2. Download Files
1. Select an appliance type.
l Stealthwatch Management Console Virtual Appliance

l Stealthwatch Flow Collector Virtual Appliance
l Stealthwatch Flow Sensor Virtual Appliance
l Stealthwatch UDP Director Virtual Appliance
l Endpoint Concentrator Virtual Appliance
2. Select Stealthwatch System Software.

3. In the Latest Release column, select 7.2.1 (or the version of 7.2.x that you are
installing).
4. Download: Locate the OVF or ISO installation file. Click the Download icon or
Add to Cart icon.
5. Repeat these instructions to download the files for each appliance type.
3a. Installing a Virtual Appliance using VMware vCenter (OVF)
3a. Installing a Virtual Appliance using

VMware vCenter (OVF)
Overview
Use the following instructions to install your virtual appliances using VMware vCenter.
To use an alternative method, refer to the following:
l VMware ESXi Stand-Alone Server: Use 3b. Installing a Virtual Appliance on

an ESXi Stand-Alone Server (ISO).
l KVM: Use 3c. Installing a Virtual Appliance on a KVM Host (ISO).
Before You Begin

Before you begin the installation, complete the following preparation procedures:
1. Compatibility: Review the compatibility requirements in Compatibility.

2. Resource Requirements: Review the Resource Requirements section to
determine the required allocations for the appliance. You can use a resource pool
or alternative method to allocate resources.
3. Firewall: Configure your firewall for communications. Refer to 1. Installing a
Virtual Appliance: Configuring your Firewall and Ports.
4. Files: Download the appliance OVF files. Refer to 2. Downloading VE
Installation Files for instructions.
5. Time: Confirm the time set on the hypervisor host in your VMware environment
(where you will be installing the virtual appliance) shows the correct time.
Otherwise, the virtual appliances may not be able to boot up.
Do not install an untrusted physical or virtual machine on the same physical

cluster/system as your Stealthwatch appliances.

Installing a Virtual Appliance Using vCenter (OVF)

If you have VMware vCenter (or similar), use the following instructions to install a virtual
appliance using the OVF.
Process Overview
Installing a virtual appliance involves completing the following procedures, which are
covered in this chapter:
1. Logging in to the VMware Web Client

2. Configuring the Flow Sensor to Monitor Traffic
3. Installing the Virtual Appliance
4. Defining Additional Monitoring Ports (Flow Sensors only)

To install the virtual appliance, log in to the VMware Web Client.
Some of the menus and graphics may vary from the information shown here.
Please refer to your VMware guide for details related to the software.
1. Log in to your VMware Web Client.
2. Flow Sensors: If the appliance is a Flow Sensor, go to 2. Configuring the Flow
Sensor to Monitor Traffic.
All Other Appliances: If the appliance is not a Flow Sensor, go to 3. Installing

the Virtual Appliance.
2. Configuring the Flow Sensor to Monitor Traffic

The Flow Sensor VE has the ability to provide visibility into VMware environments,
generating flow data for areas that are not flow-enabled. As a virtual appliance
installed inside each hypervisor host, the Flow Sensor VE passively captures Ethernet
frames from the host vSwitch, and it observes and creates flow records containing
valuable session statistics that pertain to conversational pairs, bit rates, and packet
rates. For details, refer to Flow Sensor VE and Stealthwatch Flow Sensor.
Use the following instructions to configure the Flow Sensor VE to monitor traffic on a
vSwitch as follows:
l Monitoring a vSwitch with Multiple Hosts

l Monitoring a vSwitch with a Single Host
Monitoring External Traffic with PCI Pass-Through

You can also configure your Flow Sensor VE for direct network monitoring using a
compliant PCI pass-through.
l Requirements: igb/ixgbe compliant or e1000e compliant PCI pass-through.

l Resource Information: Refer to Flow Sensor VE.
l Integration: Refer to Important Considerations for Integration.
l Instructions: To add PCI network interfaces to the Flow Sensor VE, refer to your
VMware documentation.
Monitoring a vSwitch with Multiple Hosts

Use the instructions in this section to use the Flow Sensor VE to monitor traffic on a
Distributed vSwitch that spans multiple VM hosts or clusters.
This section applies only to VDS networks. If your network is in a non-VDS environment,
go to Monitoring a vSwitch with a Single Host
Configuration Requirements
This configuration has the following requirements:
l Distributed Virtual Port (dvPort): Add a dvPort group with the correct VLAN
settings for each VDS that the Flow Sensor VE will monitor. If the Flow Sensor VE
monitors both VLAN and non-VLAN traffic on the network, you need to create two
dvPort groups, one for each type.
l VLAN Identifier: If your environment uses a VLAN (other than VLAN trunking or a
private VLAN), you need the VLAN identifier to complete this procedure.
l Promiscuous Mode: enabled
l Promiscuous Port: configured to the vSwitch
Complete the following steps to configure the network using a VDS:
1. Click the Networking icon.
2. In the Networking tree, right-click the VDS.

3. Select Distributed Port Group > New Distributed Port Group.
4. Use the New Distributed Port Group dialog box to to configure the port group,
including the specifications in the following steps.
5. Select Name and Location: In the Name field, enter a name to identify this
dvPort group.
6. Configure Settings: In the Number of Ports field, enter the number of Flow
Sensor VEs in your cluster of hosts.
7. Click the VLAN type drop-down list.
l If your environment doesn't use a VLAN, select None.

l If your environment uses a VLAN, select the VLAN type. Configure it as
follows:
VLAN Type Detail
In the VLAN ID field, enter the number

VLAN (between 1 and 4094) that matches the
identifier.
In the VLAN trunk range field, enter 0-

VLAN Trunking
4094 to monitor all VLAN traffic.
Select Promiscuous from the drop-down

Private VLAN
list.
8. Ready to Complete: Review the configuration settings. Click Finish.
9. In the Networking tree, right-click the new dvPort group. Select Edit Settings.
10. Select Security.
11. Click the Promiscuous Mode drop-down list. Select Accept.
12. Click OK to close the dialog box.

13. Does the Flow Sensor VE monitor both VLAN and non-VLAN network traffic?
l If yes, repeat the steps in this section Monitoring a vSwitch with Multiple
Hosts
l If no, continue to the next step.
14. Is there another VDS in the VMware environment that the Flow Sensor VE will
monitor?
l If yes, repeat the steps in this section Monitoring a vSwitch with Multiple
Hosts for the next VDS.
l If no, go to 3. Installing the Virtual Appliance.
Monitoring a vSwitch with a Single Host

Use the instructions in this section to use the Flow Sensor VE to monitor traffic on a
vSwitch with a single host.
This section applies only to non-VDS networks. If your network uses a VDS, go
to Monitoring a vSwitch with Multiple Hosts.
l Promiscuous Port Group: Add a promiscuous port group for each virtual switch
that the Flow Sensor VE will be monitoring.
l Promiscuous Mode: enabled
l Promiscuous Port: configured to the vSwitch
Configure the Port Group to Promiscous Mode

Use the following instructions to add a port group, or edit a port group, and set it to
Promiscous.
1. Log in to your VMware ESXi host environment.

2. Click Networking.
3. Select the Port groups tab.
4. You can create a new port group or edit a port group.
l Create Port Group: Click Add port group.

l Edit Port Group: Select the port group. Click Edit Settings.
5. Use the dialog box to configure the port group. Configure the VLAN ID or VLAN
Trunking:
VLAN Type Detail
Use VLAN ID to specify a single VLAN.
VLAN ID In the VLAN ID field, enter the number

(between 1 and 4094) that matches the
identifier.
Use VLAN Trunking to monitor all VLAN

VLAN Trunking
traffic. The range defaults to 0-4095.
6. Click the Security arrow.
7. Promiscous Mode: Choose Accept.
8. Will the Flow Sensor VE be monitoring another virtual switch in this VMware
environment?
l If yes, go back to 2. Configuring the Flow Sensor to Monitor Traffic, and

repeat all the steps for the next virtual switch.
l If no, go to 3. Installing the Virtual Appliance.
3. Installing the Virtual Appliance

Use the following instructions to install a virtual appliance on your hypervisor host and
define the virtual appliance management and monitoring ports.
1. Locate the virtual appliance software file (OVF.TGZ) that you downloaded from
Cisco Software Central.
2. Unzip or open the file, and then untar it.
l To untar the file, select all the files in the folder and extract them.
l Unzipping TGZ file is a two-step process, and the steps may vary depending
on the software you use.
3. Right-click the host. Select Deploy OVF Template.

4. Use the Deploy OVF template dialog box to configure the appliance as specified
in the following steps.
5. Select an OVF template: Choose the virtual appliance OVF and VMDK files.
6. Select a name and folder: Change the name so it is unique. Select the location
to save your appliance.
7. Select a compute resource: Select the destination compute resource.
8. Review details: Review the details for the OVF deployment. You will adjust the
resources in the following steps.
9. License agreements: Review and accept the End User License Agreement.
10. Select storage: Select a location to store the data files.
l Select Virtual Disk Format: Select Thick Provision Lazy Zeroed or Thick

Provision Eager Zeroed.
Use the Thin Provision format only if your disk space is limited. For more
information, refer to your VMware guide.
l Storage: Review Resource Requirements to allocate sufficient space.
Review Resource Requirements to allocate sufficient resources. This step is


11. Select networks: Select the networks for the virtual appliance.
Flow Sensors: If the appliance is a Flow Sensor, select the port you created.
Refer to 2. Configuring the Flow Sensor to Monitor Traffic for details.
12. Ready to complete: Review the summary of settings. If they are correct, click
Finish.
13. The deployment starts in the background. Monitor the deployment progress in the
Recent Tasks section. Make sure the deployment is completed and shown in the
Inventory tree before you go to the next steps.
14. Flow Sensors: If the appliance is a Flow Sensor and will be monitoring more than
one virtual switch in the VMware environment, or more than one VDS in a cluster,
continue with the next section 4. Defining Additional Monitoring Ports (Flow
Sensors only).
15. Repeat all of the procedures in 3a. Installing a Virtual Appliance using VMware
vCenter (OVF) for the next virtual appliance in your system.
If you have completed installing all virtual appliances in your system, go to 4.

Configuring the IP Addresses.
4. Defining Additional Monitoring Ports (Flow Sensors only)

This procedure is required if the Flow Sensor VE will be monitoring more than one virtual
switch in a VMware environment or more than one VDS in a cluster. If this is not the
monitoring configuration for your Flow Sensor, go to 4. Configuring the
IP Addresses.
To add Flow Sensor VE monitoring ports, complete the following steps:
1. In the Inventory tree, right-click the Flow Sensor VE. Select Edit Settings.
2. Use the Edit Settings dialog box to configure the following specified settings.
3. Click Add New Device. Select Network Adapter.
4. Locate the new network adapter. Click the arrow to expand the menu, and
configure the following:
l New Network: Select an unassigned promiscuous port group.

l Adapter Type: Select VMXNET 3.
l Status: Check the Connect at Power On check box.
5. After reviewing the settings, click OK.
6. Repeat this procedure to add another Ethernet adapter as needed.
If you have added all Ethernet adapters, go to to 4. Configuring the

IP Addresses
3b. Installing a Virtual Appliance on an ESXi Stand-Alone Server (ISO)
3b. Installing a Virtual Appliance on an ESXi

Stand-Alone Server (ISO)
Overview
Use the following instructions to install your virtual appliances using a VMware
environment with an ESXi Stand-alone server.
l VMware vCenter: Use 3a. Installing a Virtual Appliance using VMware

vCenter (OVF) .
l KVM: Use 3c. Installing a Virtual Appliance on a KVM Host (ISO).
Before You Begin

Before you begin the installation, complete the following preparation procedures:

4. Files: Download the appliance ISO files. Refer to 2. Downloading VE Installation
Files for instructions.


Installing a Virtual Appliance on an ESXi Stand-Alone

Server (ISO)
Use the following instructions to install your virtual appliances using a VMware
environment with an ESXi Stand-alone server.
Process Overview
2. Booting from the ISO
Flow Sensors: If the appliance is a Flow Sensor, review Stealthwatch Flow

Sensor to understand the additional configuration steps required.
1. Log in to the VMware Web Client.

2. Click Create/Register a Virtual Machine.
3. Use the New Virtual Machine dialog box to configure the appliance as specified
in the following steps.
4. Select Creation Type: Select Create a New Virtual Machine.
5. Select a Name and Guest OS: Enter or select the following:
l Name: Enter a name for the appliance so you can identify it easily.
l Compatibility: Select the version you are using (v6.5 or v6.7).
l Guest OS family: Linux.
l Guest OS version: Select Debian GNU/Linux 10 64-bit.
6. Select Storage: Select an accessible datastore. Review Resource Requirements

to confirm you have enough space.


7. Customize Settings: Enter or select your appliance requirements (refer to

Resource Requirements for details).
Make sure you select the following:
l SCSI Controller: LSI Logic Parallel

l Network Adapter: Confirm the management address for the appliance.
If the appliance is a Flow Sensor, you can click Add Network Adapter to
add another management or sensing interface. Refer to Stealthwatch Flow
Sensor for details.
8. Click the arrow next to Network Adapter.

9. For the Adapter Type, select VMXnet3.
10. Review your configuration settings and confirm they are correct.
11. Click Finish. A virtual machine container is created.
2. Booting from the ISO

1. Open the VMware console.
2. Connect the ISO to the new virtual machine. Refer to the VMware guide for details.
3. Boot the virtual machine from the ISO. It runs the installer and reboots
automatically.
4. Once the installation and reboot are completed, you will see the login prompt.
5. Disconnect the ISO from the virtual machine.

6. Repeat all of the procedures in 3b. Installing a Virtual Appliance on an ESXi
Stand-Alone Server (ISO) for the next virtual appliance.
7. Flow Sensors: If the appliance is a Flow Sensor, review Stealthwatch Flow
Sensor and finish the setup using the previous sections of this manual:
l 2. Configuring the Flow Sensor to Monitor Traffic (use Monitoring a

vSwitch with a Single Host)
l If the Flow Sensor will be monitoring more than one virtual switch in the
VMware environment, or more than one VDS in a cluster, go to 4. Defining
Additional Monitoring Ports (Flow Sensors only).
8. If you have installed all virtual appliances, go to 4. Configuring the

IP Addresses.
3c. Installing a Virtual Appliance on a KVM Host (ISO)
3c. Installing a Virtual Appliance on a KVM

Host (ISO)
Overview
Use the following instructions to install your virtual appliances using KVM and Virtual
Machine Manager.
l VMware vCenter: Use 3a. Installing a Virtual Appliance using VMware

vCenter (OVF) .
l VMware ESXi Stand-Alone Server: Use 3b. Installing a Virtual Appliance on
an ESXi Stand-Alone Server (ISO).
Before You Begin

Before you begin the installation, make sure you've completed the following
procedures:

4. Files: Download the appliance ISO files and copy them to a folder on the
KVM host.We use the following folder in the example provided in this section:
var/lib/libvirt/image. Refer to 2. Downloading VE Installation Files for
instructions.

Installing a Virtual Appliance on a KVM Host (ISO)

If you have a KVM host, use the following instructions to install a virtual appliance using
the ISO.
Process Overview
1. Installing a Virtual Appliance on a KVM Host
2. Adding NIC and Promiscuous Port Monitoring on an Open vSwitch
(Flow Sensors Only)
1. Installing a Virtual Appliance on a KVM Host

There are several methods to install a virtual machine on a KVM host using a ISO file.
The following steps give one example for installing a virtual Stealthwatch Management
Console (SMC) through a GUI tool called Virtual Machine Manager running on a Ubuntu
box. You can use any compatible Linux distribution. For compatibility details, refer to
Compatibility.
Monitoring Traffic
The Flow Sensor VE has the ability to provide visibility into KVM environments,
generating flow data for areas that are not flow-enabled. As a virtual appliance installed
inside each KVM host, the Flow Sensor VE passively captures Ethernet frames from
traffic it observes and creates flow records containing valuable session statistics that
pertain to conversational pairs, bit rates, and packet rates. For details, refer to
Stealthwatch Flow Sensor: Integrating the Flow Sensor VE into your network.
l Promiscuous Mode: Enabled.

l Promiscuous Port: Configured to an open vSwitch.
Installing a Virtual Appliance on a KVM Host

To install a virtual appliance, and enable the Flow Sensor VE to monitor traffic, complete
the following steps:
1. Use Virtual Machine Manager to connect to the KVM Host and configure the
appliance as specified in the following steps.
2. Click File > New Virtual Machine.
3. Select Local install media (ISO image or CDROM). Click Forward.
4. Click Use ISO image.

5. Click Browse. Select the appliance image.
6. Select the ISO file. Click Choose Volume.
Confirm the ISO file is accessible by the KVM Host.
7. Under Choose an operating system type and version, select Linux from the
OS type drop-down list.
8. From the Version drop-down list, select Debian Jessie. Click Forward.
9. Increase the Memory (RAM) and CPUs to the amount shown in the Virtual Edition
(VE) Resource Requirements section.


10. Select Create a disk image for the virtual machine.

11. Enter the data storage amount shown for the appliance in Virtual Edition (VE)
Resource Requirements section. Click Forward.


12. Assign a Name for the virtual machine. This will be the display name, so use a
name that will help you find it later.
13. Check the Customize configuration before install check box.

14. In the Network selection drop-down box, select the applicable network and port
group for installation.
15. Click Finish. The configuration menu opens.
16. In the navigation pane, select NIC.

17. Under Virtual Network Interface, select e1000 in the Device model drop-down
box. Click Apply.
18. Click VirtIO Disk 1.

19. In the Advanced Options drop-down list, select SCSI in the Disk bus drop-down
box. Click Apply.
20. Do you need to add additional NICS for monitoring ports on the Flow Sensor VE?
l If yes, go to 2. Adding NIC and Promiscuous Port Monitoring on an

Open vSwitch (Flow Sensors Only).
l If no, go to the next step.
21. Click Begin Installation.

22. Go to 4. Configuring the IP Addresses.
2. Adding NIC and Promiscuous Port Monitoring on an

Open vSwitch (Flow Sensors Only)
To add additional NICs for the Flow Sensor VE monitoring ports and to complete the
installation, complete the following steps:
1. In the Configuration Menu, click Add Hardware. The Add New Virtual Hardware
dialog box displays.
2. In the left navigation pane, click Network.
3. Click the Portgroup drop-down list to select an unassigned promiscuous port
group you want to monitor. Click the Device Model drop-down list to select
e1000.
4. Click Finish.

5. If you need to add another monitoring port, repeat these instructions.
6. After you have added all monitoring ports, click Begin Installation.
4. Configuring the IP Addresses

After you install the Stealthwatch VE appliances using VMware or KVM, you are ready to
configure the basic virtual environment for them.
Configure the IP Addresses

1. Connect to your Hypervisor host (virtual machine host).
2. In the Hypervisor host, locate your virtual machine.
3. Confirm the virtual machine is powered on.
If the virtual machine does not power on, and you receive an error message about
insufficient available memory, do one of the following:
l Resources: Increase the available resources on the system where the

appliance is installed. Refer to the Virtual Edition (VE) Resource
Requirements section for details.
l VMware Environment: Increase the memory reservation limit for the
appliance and its resource pool.


4. Access the virtual machine console.

5. Allow the virtual appliance to finish booting up. The virtual appliance
Administrative IP Address page opens.
If the Administrative IP address page doesn't open automatically, log in through

the console.
l Login: sysadmin
l Default Password: lan1cope
l You will change the default password when you configure the system.
You may need to enable the Full Screen Mode to view the entire screen.
6. Click on the page. Enter the IP address for the virtual appliance.
7. Select OK. Press Enter.
8. Review the IP network mask address.
l Accept the default or enter a new address.

l Select OK. Press Enter to continue.
9. Review the broadcast IP address.

10. Review the gateway server IP address.

11. Enter the host name.
Make sure the host name is unique and meets the Internet standard requirements
for Internet hosts.
l Select OK.
l Press Enter to continue.
12. Enter the network domain name.
Use a fully qualified domain name.
l Select OK.
l Press Enter to continue.
13. Review your configuration settings. If everything is correct, press Enter.
14. Follow the on-screen prompts to finish the virtual environment and restart the
appliance.
15. After the restart, the login prompt displays.
If you cannot access the appliance, please refer to Troubleshooting for

instructions.
16. Select No. Press Enter.
17. Press Ctrl + Alt to exit the console.
18. Repeat all the steps in 4. Configuring the IP Addresses for the next virtual
appliance in your system.
If you've configured the IP address on all your virtual appliances, go to 5.

Configuring Your Stealthwatch System
Troubleshooting
Certificate Error
If your VM environment usage is high, there may be a timing error and some events
occur out of order. If you receive the following error that permission is denied due to a
certificate error (.crt), do the following:
1. Log in to the appliance console as sysadmin. The default password is lan1cope.
You will change the default password in a later procedure. For more information,
refer to Change Default Password.
2. Run the following command:
/lancope/admin/plugins/update/.98-FIX-SECRET-PERMS.sh
3. Run SystemConfig.

4. Return to Configure the IP Addresses (starting at step 5) and complete all steps
in the section. If you cannot access the appliance, please contact Cisco
Stealthwatch Support.
Accessing the Appliance

If you cannot access the appliance after it restarts, do the following:
1. Log in as root.

2. Run the following commands and confirm the docker containers and services are
up and running:
l docker ps
l systemctl list-units --failed
l systemd-analyze critical chain
3. Once all docker containers and services are up and running, try the login again. If
you cannot access the appliance, please contact Cisco Stealthwatch Support.
5. Configuring Your Stealthwatch System

When you log in to the appliance for the first time, you will use the Appliance Setup Tool
to configure your appliance so it is managed by your Stealthwatch Management Console
(SMC).
Preparation
Before you start the configuration, review the instructions so you understand the
appliance configuration order, best practices, and additional requirements.
Appliance Setup Tool Requirements

l Confirm your firewalls and ACLs (Access Control List) will allow access.
l Gather the host name for the appliance and IP addresses for the following:
l appliance
l subnet mask
l default and broadcast gateways
l NTP and DNS servers
l SMC IP address for Central Management
Managed
As part of the Appliance Setup Tool, you will configure your appliance to be managed by
your primary Stealthwatch Management Console (SMC).
When your appliances are managed by your Stealthwatch Management Console (SMC),
you can use Central Management to edit appliance configurations, update software,
reboot, shut down, and more.
SMC Failover
If you have more than one Stealthwatch Management Console (SMC), you can set up an
SMC failover pair so that one of them serves as backup console to the other.
l Use the Appliance Setup Tool to configure each individual SMC.

l Plan which SMC will be primary and secondary.
l After you set up each individual SMC, you will use the Central Management Trust
Store and the Stealthwatch Desktop Client to configure the SMC failover
relationship. Refer to Defining an SMC Failover Relationship for details.
Best Practices
To configure your system successfully, make sure you follow the instructions in this
guide.
We recommend the following:
l One at a Time: Configure one appliance at a time. Confirm the appliance is Up

before you start configuring the next appliance in your cluster.
l Order: Follow the configuration order.
l Multiple Central Managers: You can configure more than one Central Manager in
your system. However, each appliance can be managed by only one primary
SMC/Central Manager.
l Access: You need administrator privileges to access Central Management.
Configuration Order
Configure your appliances in the following order, and note the details for each
appliance:
Order Appliance Details
Your primary SMC is your Central

Manager.
1. Primary SMC Make sure the SMC is shown as Up
before you start configuring the next
appliance in the system.
UDP Directors
2. (also known as
FlowReplicators)
Make sure the Flow Collector 5000

Flow Collector 5000
3. series database is shown as Up before
Series Database
you start the engine configuration.
Make sure the Flow Collector 5000

Flow Collector 5000
4. series database is shown as Up before
Series Engine
you start the engine configuration.
All Other Flow Collectors

5.
(NetFlow and sFlow)
Make sure your Flow Collector is shown

6. Flow Sensors as Up before you start the Flow Sensor
configuration.
7. Endpoint Concentrator
Make sure the primary SMC is shown as

Up before you start the secondary SMC
Secondary SMC configuration.
8.
(if used) The secondary SMC selects itself as
Central Manager. Configure Failover
after all appliances are configured. Refer
to Defining an SMC Failover
Relationship for details.
Your system might not have all the appliances shown here.
1. Log In
Use the following instructions to configure each appliance using the Appliance Setup
Tool.
1. In the address field of your browser, type https:// followed by the IP address of
the appliance.
l Primary SMC: Configure the primary SMC first.

l Up: Confirm each appliance is Up before you start configuring the next
appliance in your cluster.
l Order: Make sure you configure your appliances in order so they
communicate correctly.
If you cannot access the appliance, please refer to the Troubleshooting

instructions in the 4. Configuring the IP Addresses section.
2. Enter the following credentials to log in:
l User Name: admin

l Password: lan411cope
2. Configure the Appliance

When you log in to the appliance for the first time, the Appliance Setup Tool guides you
through each configuration step.
If this is not a first-time installation, go to Troubleshooting to change

appliance network settings such as host name, network domain name, or IP
address.
1. Change Default Password: Enter new passwords for admin, root, and sysadmin.
Click Next to scroll to each user.
Use the following criteria:
l Length: 8 to 256 characters

l Change: Make sure the new password is different from the default password
by at least 4 characters.
User Default Password
admin lan411cope
root lan1cope
sysadmin lan1cope
The sysadmin and root menus are unavailable if you've already changed the
default passwords during the hardware installation. Refer to the Stealthwatch
x210 Series Hardware Installation Guide for details.
2. Management Network Interface: Review the IP address and network interface
fields. Confirm the default settings are correct. Click Next.
l Changes: To change this information, confer with your network

administrator and refer to Troubleshooting.
l IPv6 (optional): To enable IPv6, click IPv6. Check the Enable IPv6 check
box and complete the fields.
3. Host Name and Domains: Enter the host name and network domain name. Click
Next.
l Host Name: A unique host name is required for each appliance. If you
assign the same host names to your appliances, they will not install
successfully.
Also, make sure each appliance host name meets the Internet standard
requirements for Internet hosts.
l Network Domain: A fully qualified domain name is required for each

appliance.
l Stealthwatch Domain (SMC only): Enter a Stealthwatch domain for your
Stealthwatch appliances.
l IP Address Ranges (SMC only): Select the IP address range for your
Stealthwatch network.
4. DNS Settings: Confirm the default is correct, or enter your domain server IP
address. Click Next.
Add or Delete DNS Servers (optional):
l Add: Click the + icon.

l Delete: Click the check box to select the DNS server. Click the - icon.
5. NTP Settings: Confirm the default is correct, or click the Menu icon to select
your network time protocol (NTP) server. Click Next.
l Multiple NTP Servers: We recommend setting up multiple NTP servers for

redundancy and accuracy.
l Public Source: pool.ntp.org is a good, public source for NTP.
Add or Delete NTP Servers (optional):
l Add: Click the + icon.

l Delete: Click the check box to select the NTP server. Click the - icon.
6. If the appliance is an SMC, go to 3. Register the Stealthwatch Management

Console.
If the appliance is not an SMC, go to 4. Add Appliances to Central

Management.
3. Register the Stealthwatch Management Console

1. Review Your Settings: Confirm the appliance information is accurate.
2. Click Apply or Restart and Proceed.
Follow the on-screen prompts while the appliance restarts.
Wait a few minutes for your new system settings to take effect. You may need to
refresh the page.
3. Log in to the Stealthwatch Management Console.

4. The Appliance Setup Tool opens again. Click Continue.
5. On the Register Your Appliance tab, review the IP address and click Save.
l This installs Central Management on the Stealthwatch Management Console.
l The SMC IP address is detected automatically and cannot be changed.
6. When the appliance setup is completed, click Go to Dashboard.

7. Click the Global Settings icon. Select Central Management.
8. Review the inventory. Confirm the SMC appliance status is shown as Up.
Make sure the primary SMC and each appliance is shown as Up before you start
configuring the next appliance in your cluster using the configuration order
and details.
9. To configure the next appliance in your system, go to 1. Log In, and complete the
procedures through 5. Confirm Appliance Status .
If you don't have another appliance to set up, go to 6. Finishing Appliance

Configurations.
4. Add Appliances to Central Management

The Appliance Setup Tool continues to guide you through the appliance configuration
with Central Management. Some of the steps may vary depending on the appliance.
Follow the on-screen prompts.
1. On the Central Management tab, enter the IP address of your primary SMC.
Your primary SMC is your Central Manager.
2. Click Save.

3. Follow the on-screen prompts to trust the primary SMC appliance identity
certificate. Click Yes to trust the certificate and allow the appliance to
communicate with the SMC.
4. Enter the login credentials for your primary SMC.
5. Select your Stealthwatch Domain.
l Flow Collectors: Enter the Flow Collection port number.
Netflow Default: 2055

sFlow Default: 6343
l Flow Sensors: Select a Flow Collector.
6. Click Go to Central Management. Go to 5. Confirm Appliance Status .
5. Confirm Appliance Status

After you configure an appliance in the Appliance Setup Tool, confirm the appliance
status in Central Management.
1. The Appliance Setup Tool opens to the Central

Management inventory, or you can open it as follows:
l Log in to your primary Stealthwatch

Management Console.
l Click the Global Settings icon.
l Select Central Management.

2. Review the appliances on the Appliance Manager inventory.
l Confirm the appliance is shown in the inventory.

l Confirm the status for the appliance is shown as Up.
Make sure the primary SMC and each appliance is shown as Up before you start
configuring the next appliance in your cluster using the configuration order
and details.
3. To configure the next appliance in your system, go to 1. Log In, and complete the
procedures through 5. Confirm Appliance Status .
If you don't have another appliance to set up, go to 6. Finishing Appliance

Configurations.
6. Finishing Appliance Configurations

Use the following instructions to finish configuring each appliance.
Depending on the speed of your VM host, it may take approximately 30 minutes

for all services to boot up.
1. Click the link for the appliance you are configuring:
Required Optional
Appliance
Configurations Configurations
Flow Collector n/a n/a
High Availability
UDP Director (available on hardware
only)
Application ID and
Flow Sensor Identifying Applications
Payload
Connecting to a NetFlow
Collector
2. When you are finished configuring and restarting each appliance in the table, go to
7. Installing the Stealthwatch Desktop Client.
UDP Director
Use the following instructions to finish configuring the UDP Director.
High Availability is only available on UDP Director hardware appliances. High

Availability is not available on virtual appliances.
l Forwarding Rules: Configure at least one forwarding rule if you're planning to set
up High Availability. Refer to Configuring Forwarding Rules
l High Availability: If you have more than one UDP Director, you can set up a High
Availability pair. Configure at least one forwarding rule if you're planning to set up
High Availability (go to Configuring High Availability).
Configuring Forwarding Rules

SSL is used to send messages from the UDP Director to the Stealthwatch Management
Console (SMC).
1. Log in to the SMC.

2. Click the Global Settings icon. Select UDP Director Configuration.
3. Click the Actions menu for the appliance. Select Configure Forwarding Rules.
4. Click Add New Rule.
5. Description: Enter a brief description that identifies the rule.

6. Source IP Address:Port: Type the IP address of the device that sends data to
the UDP Director and the input port number (where the data will be sent).
l Format: Use the syntax [IP address]:[Port Number].
l Range: You can use Classless Inter-Domain Routing (CIDR) notation to

enter a range of IP addresses.
l All: You can type "All" to accept data from any source IP address on this port.
l Combinations: You can add Source IP Address:Port combinations within a

rule by adding them to a new line.
Examples:
l 10.11.16.38:5322
l 192.168.0.0/16:9000
l All:2055
7. Destination IP Address: Enter the IP address of the device receiving data from
the UDP Director.
8. Destination Port Number: Enter the port number for the receiving device.
9. Click Save.
10. Optional: To sync your changes, click Sync.
11. Repeat the procedure to add forwarding rules as needed.

12. To set up a High Availability pair, go to Configuring High Availability.

If you do not need to set up a High Availability pair, return to 6. Finishing

Appliance Configurations.
Configuring High Availability

If you have more than one UDP Director, use the Appliance Admin interface to configure
high availability.

The UDP Director High Availability allows a user to configure settings for redundant UDP
Directors. Both nodes are fully redundant, however only one node is online at a time.
Primary Node and Secondary Node

The online node is known as the Primary in the pair, while the offline node is the
Secondary. If the Primary node in the pair should fail, the Secondary node takes over
and becomes the Primary.
Requirements
l Forwarding Rules: Configure at least one forwarding rule for the UDP Director in
the HA system.
l Save the Rules Configuration File: If the UDP Director has already been
configured with rules, export (save the rules configuration file) the UDP Director
rules. Then, import the file to the second UDP Director to ensure that the rules for
each match.
l Order: Configure the Primary UDP Director and then repeat the configuration on
the Secondary one.
l New or Established: If the both UDP Directors are new, make sure you follow the
procedures for each in this guide. However, if the secondary is already configured
as an appliance on the Stealthwatch system, log in to the secondary UDP Director
and configure its HA components as described here.
1. Configure the Primary UDP Director HA

1. Log in to the primary UDP Director Appliance Admin interface.
2. Click Configuration > High Availability.
3. Check the Enable High Availability Service check box for the High Availability
Settings.
4. In the Virtual IP Address field, enter an unused IP adddress that is on the same
subnet as the eth0 interface. Set the subnet mask value to the value of the subnet
mask used on the eth0 interface.
Make sure the Virtual IP Address is the same on both nodes.
5. In the Shared Secret field, type a string for both UDP Directors. (This will be
encrypted for secure transfer.)
6. In the fields for Sync Ring 1 (Eth2) Unicast IP Address, enter the IP address and
the subnet mask. (A Unicast IP Address identifies a single network destination.)
7. In the fields for Sync Ring 2 (Eth3) Unicast IP Address, enter the IP address and
the subnet mask.
Each of the IP addresses--eth0, eth02, eth03--must be on its own separate

unicast subnet.
8. After reviewing the setting, click Apply to set the configuration.
9. Continue to the next section to configure the second UDP Director of the cluster.
2. Configure the Secondary UDP Director HA

To configure the secondary UDP Director complete the following steps:
1. Log in to the secondary UDP Director Appliance Admin interface.

2. Click Configuration > High Availability.
3. Configure all of the parameters on this screen (including any Advanced Parameters
that you may have changed on the first appliance) exactly as you did on the first
appliance with exactly same values for every field except for the following:
l Sync Ring 1 (Eth2) Unicast IP Address: Enter a different IP address from what
you configured in this field on the primary, but it must be in the same subnet
as the Sync Ring 1 Unicast address given on the primary.
l Sync Ring 2 (Eth3) Unicast IP Address: Enter a different IP address from what
you configured in this field on the primary, but it must be in the same subnet
as the Sync Ring 2 Unicast address given on the primary.
4. Click Apply to save your changes and to start the clustering services on this
appliance.
5. Click Promote to designate the primary appliance.
6. Restart: Select Operations > Restart Appliance.
7. Return to 6. Finishing Appliance Configurations.
Flow Sensor
1. Configure the Application ID and Payload
The configuration of a Flow Sensor requires an additional step of configuring the
application ID and payload.
1. Log in to the Flow Sensor Appliance Admin interface.

2. Click Configuration > Advanced Settings.
The Export settings page opens.
3. Select the proper settings for your network:
Item Description
Export Packet Allows you to specify whether the Flow Sensor includes the first 26
Payload bytes of binary payload data in the data that it sends to the collector.
Allows you to specify whether the Flow Sensor attempts to identify

applications before sending data to the collector. In addition, this
setting must be enabled for the following settings to take affect:
Include IPv6 – Allows you to specify whether or not the Flow Sensor
analyzes both IPv4 and IPv6 packets. When this setting is disabled,
the Flow Sensor analyzes only IPv4 packets.

Export HTTPS Header Data – Allows you to specify whether the Flow
Export Sensor includes header data from HTTPS flows in the data that it
Applications sends to the collector. The data includes the SSL common name and
Identification SSL organization name. This setting requires that the Flow Type is set
to IPFIX. The maximum is 256 bytes.

Export HTTP Header Data – Allows you to specify whether or not the
Flow Sensor includes header data from HTTP flows in the data that it
sends to the collector. When this setting is selected, a secondary
field allows you to specify the maximum length of the HTTP path (in
bytes) that the Flow Sensor includes as part of the flow data. This
setting requires that the Flow Type is set to IPFIX.
Allows you to specify whether the Flow Sensor uses Virtual

Extensible Local Area Network (VXLAN) decapsulation capabilities.
Without VXLAN decapsulation, the Flow Sensor simply detects
VXLAN encapsulated traffic as flows between two Virtual Tunnel
Enable
Endpoints (VTEPs). Decapsulation allows for much richer content by
VXLAN
being able to analyze the tunneled traffic and thus gain greater insight
Decapsulation
into the traffic patterns in the network.
The Flow Sensor will only decapsulate VXLAN traffic which

was originally sent to the standard VXLAN port (4789).
Enable X- Allows you to specify whether the Flow Sensor uses X-Forwarded-
Item Description
For (XFF) processing to identify the originating IP address of a client

Forwarded- connecting to a web server through an HTTP proxy or a load balancer.
For
Processing ETA and X-Forwarded-For Processing cannot be configured
together.
Allows you to specify whether the Flow Sensor uses ETA processing
to generate and transmit IDP and SPLT fields to your SMC.
Enabling ETA increases NetFlow bandwidth usage, especially

when using v9. We recommend using IPFIX for the Flow
Export Format.
Enable ETA
Processing
ETA and X-Forwarded-For Processing cannot be configured
together.
ETA cannot be enabled on Dell or PowerEdge Flow Sensor

models.
Flow Export Allows you to specify whether the Flow Sensor uses IPFIX or NetFlow
Format v9 to send flow data to the collector.
Allows you to select one of the following settings:

Use single, shared, cache for all monitoring ports –
l Use when asymmetric routing is present.

l Single state table for application and latency calculations.
Cache Mode l Uses less memory.
l Lower overall pps processing rates.
l Results in one NetFlow event created across multiple interfaces.
l Use only when the Flow Sensor has only two ports and is
connected by a TAP
Item Description
Use independent caches for each monitoring port –
l Allows deduplication of packets across each Flow Sensor

interface.
l Uses more memory.
l Higher overall pps processing rates.
l Each interface maintains its own latency and application
database.
l Results in a unique NetFlow record for each interface that sees a
given packet.
4. Click Apply to save your settings.
2. Configure the Flow Sensor to Identify Applications (optional)

If you want the Flow Sensor to identify applications, configure the following settings:
1. Log in to the Flow Sensor Appliance Admin interface.

2. Click Configuration > Advanced Settings
3. Check the Export Application Identification check box. By default, this option is
not selected.
4. If you have more than 1 monitoring NIC, select one of the following options in the
Cache Mode section:
l Use single, shared, cache for all monitoring ports: typically used for
systems that monitor flows using the TAP method.
l Use independent caches for each monitoring port: typically used to

experience better performance and for systems that monitor flows using the
SPAN method.
3. Restart the Appliance

1. Select Operations > Restart Appliance.
2. Return to 6. Finishing Appliance Configurations.
The Endpoint Concentrator has the following configuration requirements:
l Configure the connection to a NetFlow Flow Collector from the Endpoint

appliance.
l You can set only one Flow Collector.
1. Log in to the Endpoint Concentrator.

2. Click Configuration > Collection.
3. In the Assign NetFlow Collector fields, type the IP Address and the port number of
the Flow Collector or UDP Director that you want the Endpoint Concentrator to
send the data to.
Port Default: 2055.
4. Click Add. This will validate the IP address and port and move the entry to the
table.
5. If the information is correct, click Apply. This will restart the services with the new
information.
This field will only accept one value. If you need to add recipients, consider using
a Cisco UDP Director.
The NetFlow Collector settings appear in the table at the top of the page.
If you need to change the setting for the Collector, first delete the current
Collector by clicking the Delete check box, and then clicking Apply. Then you can
configure a new Collector.
6. In the main menu, click Home. Check the Docker Services table:
7. If all docker services are shown as "Running," restart the Appliance. Select
Operations > Restart Appliance. Then, return to 6. Finishing Appliance
Configurations.
If any docker services are not shown as Running, go to Troubleshooting the

Endpoint Concentrator.
Troubleshooting the Endpoint Concentrator

After the AnyConnect Agents and the Endpoint Concentrator have been configured,
there are a few items that can be checked to determine if the system is operational.
These steps may be used if it is determined that the system is not processing data as
expected.
1. Validate that the Endpoint Concentrator is receiving flows from the AnyConnect
Agents to the Collector.
l Enable SSH access to the Endpoint Concentrator via the web admin page.
l Configuration > Services – Check Enable SSH
2. Log in to the Endpoint Concentrator console. Run “docker ps”:
l Validate that there are four entries that contain kafka, netflow-parser,
zookeeper, and netflow-generator. Note that the Container IDs and Image
versions will differ.
l If not they are not running, restart the Services from the appliance.
3. Change Directories to “/lancope/var/logs/containers” and run “tail –f svc-

endpoint-engine:vx.x.x.log” where x.x.x is the version indicated in the file name.
Verify in the Stats print out that the counts are not zero. If the stats read as below,
the Endpoint Concentrator is not producing Netflow.
4. Validate AnyConnect Agents can send data to the Endpoint Concentrator.
l On one of the machines running the AnyConnect Agent, open a terminal or

command prompt and run “ping <IPofEndpointConcentrator>”.
l If there are response bytes, the Agent most likely can export to the Endpoint
Concentrator.
7. Installing the Stealthwatch Desktop Client
7. Installing the Stealthwatch Desktop

Client
Use the following instructions to install the Stealthwatch Desktop Client using Windows
or macOS. Note the following:
l You can locally install different versions of Stealthwatch Desktop Client.

l If you want to access multiple versions of Stealthwatch Desktop Client, you will
need a different executable file for each SMC.
l If you are using both a primary and a secondary SMC, you will need to log off one
SMC before you can log in to the other SMC.
l You can have different versions of Stealthwatch Desktop Client open
simultaneously.
l When you update to a later version of Stealthwatch, you will need to install the
new version of Stealthwatch Desktop Client.
l If you have Stealthwatch Desktop Client and update to 7.0.x or later, you can no
longer use Oracle Java with Stealthwatch Desktop Client.
Install the Desktop Client Using Windows

l You must have sufficient rights to install Stealthwatch Desktop Client.
l Stealthwatch Desktop Client requires a 64-bit operating system. It
cannot run on a 32-bit operating system or Linux.
1. Click the Download icon in the upper right corner of any page in the
Stealthwatch Web App.
2. Click the .exe file to begin the installation process.
3. Follow the steps in the wizard to install the Stealthwatch Desktop Client.
4. On your desktop, click the Stealthwatch Desktop Client icon .

5. Enter the SMC user name and password.
6. Enter the SMC server name or IP address (IPv4 or IPv6).
7. Follow the on-screen prompts to open the Desktop Client and trust the appliance
Change the Memory Size

You can change how much Random Access Memory (RAM) to allocate on your client
computer to run the Stealthwatch Desktop Client interface. Consider a larger memory
allocation if you work with many open documents or large data sets (such as flow
queries with over 100k records).
1. In Windows Explorer, go to your home directory.

2. Open these folders: AppData > Roaming > Stealthwatch.
You may need to search "Stealthwatch" if the folder is hidden.
3. In the Stealthwatch directory, open the folder that contains the desired
Stealthwatch version.
4. Open the application.vmoptions file using an appropriate editing application to
begin editing. (This file is created after you open the Stealthwatch Desktop Client
for the first time.)
Minimum Memory Size (Xms): We recommend that you allocate no less than
512 MB. This number is listed in the third line of the file.
For editors that display the content in one continuous line, refer to the number
highlighted in the image below to see which number represents the minimum
memory size.
Maximum Memory (Xmx): You can allocate up to half the size of your computer's
RAM for the maximum memory size. This number is listed in the fourth line of the
file.
highlighted in the image below to see which number represents the maximum
memory size.
Use whole numbers. For example, enter Xmx512m, not Xmx0.5m.
l If you notice that the Stealthwatch Desktop Client appears to "hang"

frequently, try increasing the memory size.
l If you receive an error message involving Java, try selecting a lower
memory allocation.
Install the Desktop Client Using macOS

l You must have sufficient rights to install Stealthwatch Desktop Client.
l Stealthwatch Desktop Client requires a 64-bit operating system. It
cannot run on a 32-bit operating system or Linux.
1. Click the Download icon in the upper right corner of any page in the
Stealthwatch Web App.
2. Click the .dmg file to begin the installation process.
An icon and folder are displayed on your monitor, as shown below.
3. Drag the Stealthwatch Desktop Client icon ( ) into the Application folder.
The icon is added to the Launchpad.
4. On your desktop, click the Stealthwatch Desktop Client icon .

5. Enter the SMC user name and password.
6. Enter the SMC server name or IP address (IPv4 or IPv6).
7. Follow the on-screen prompts to open the Desktop Client and trust the appliance
Change the Memory Size

You can change how much Random Access Memory (RAM) to allocate on your client
computer to run the Stealthwatch Desktop Client interface. Consider a larger memory
allocation if you work with many open documents or large data sets (such as flow
queries with over 100k records).
1. In Finder, go to your home directory.

2. Open the Stealthwatch folder.
3. In the Stealthwatch directory, open the folder that contains the
desired Stealthwatch version.
4. Open the application.vmoptions file using an appropriate editing application to

begin editing. (This file is created after you open the Stealthwatch Desktop Client
for the first time.)
Minimum Memory Size (Xms): We recommend that you allocate no less than
512 MB. This number is listed in the third line of the file.
highlighted in the image below to see which number represents the minimum
memory size.
Maximum Memory Size (Xmx): You can allocate up to half the size of your
computer's RAM for the maximum memory size. This number is listed in the fourth
line of the file.
highlighted in the image below to see which number represents the maximum
memory size.
Use whole numbers. For example, enter Xmx512m, not Xmx0.5m.
l If you notice that the Stealthwatch Desktop Client appears to "hang"

frequently, try increasing the memory size.
l If you receive an error message involving Java, try selecting a lower
memory allocation.
8. Verifying Communications
Use the following instructions to confirm the Stealthwatch Management Console is
receiving NetFlow data.
Verify NetFlow Data Collection

1. In the Stealthwatch Desktop Client Enterprise tree, right-click the Flow Collector.
Select Status > NetFlow Collection Status.
2. On the NetFlow Collection Status page, look at the Current NetFlow Traffic field
located at the top of the document. This statistic shows the amount of NetFlow
traffic being observed.
l If traffic is shown, go to the next step.

l If traffic is not shown, check your exporter/router configurations. For details,
refer to the SMC Client Online Help. Then, go to the next step.
3. Look at the Longest Duration Export column.
Add Column: To add this column to your dashboard, right-click a column heading
and select Longest Duration Export from the menu.
4. Is the value for each exporter below 100?
l If yes, the cache export timer is fine.

l If no, higher values indicate an incorrect cache export timer, which may
result in unrealistic alarms. Check your exporter/router configurations. For
details, refer to the SMC Client Online Help.
5. Congratulations! You are finished with your Stealthwatch system configuration.
6. Next Steps: Review 9. Licensing, and register your product instance in your
Cisco Smart Account before the evaluation period expires.
7. To add more services and features to Stealthwatch, refer to the following
resources:
l Defining an SMC Failover Relationship

l Enabling the Threat Intelligence Feed
l Configuring SAML SSO
Refer to Cisco.com to review our Stealthwatch guides and configure additional

features such as Cisco Threat Response, Cisco Identity Services (ISE),
TACACS+, and more.
To start using Stealthwatch, refer to the following sections of this guide:
l Getting Started: Review the Getting Started with Stealthwatch section

for more information about managing your environment, investigating
behavior, responding to threats, and more.
l Central Management: Refer to the Central Management section in this

guide for more information about managing your appliances and changing
configuration settings.
l Troubleshooting: Refer to the Troubleshooting section of this guide.
9. Licensing
9. Licensing
Use Cisco Smart Software Licensing to license your Stealthwatch appliances and
features. For more information, refer to Smart Licensing on cisco.com.
l Online: To use Smart Licensing and Stealthwatch online, please refer to the
Stealthwatch Smart Software Licensing Guide. You need Internet access for this
configuration.
l Offline: To discuss your licensing options for closed/airgap networks, contact
Cisco Stealthwatch Support.
l Cisco Smart Account: To set up a Cisco Smart Account, register at
https://software.cisco.com or contact your administrator.
Evaluation Mode
When you use Stealthwatch in Evaluation mode, you can use selected features for 90
days. To use Stealthwatch with maximum default functionality, and to add licenses and
features to your account, register your product instance for Smart Software Licensing.
l Admin User: To review Smart Licensing status and usage details in your
Stealthwatch Management Console, log in as the admin user.
l Days Remaining: To review the days remaining in Evaluation Mode, log in to the
Stealthwatch Management Console as the admin user. Go to Central
Management > Smart Licensing. Review the License Authorization Status.
l Product Instance: The Product Instance Name is the identifier we use for your
Stealthwatch product instance, which includes your Stealthwatch Management
Console and managed appliances.
Defining an SMC Failover Relationship
Defining an SMC Failover Relationship

You can establish a failover relationship between two Stealthwatch Management
Consoles (SMCs) so that one of them serves as backup console to the other. When you
define the failover relationship, you will designate one SMC as primary and one SMC as
secondary. If the primary is offline, you can manually set the secondary SMC to become
the primary SMC to continue monitoring the system.
To define an SMC failover relationship, follow the instructions in Stealthwatch Online
Help.
l Configure the secondary SMC first, so the primary SMC can recognize it and
communicate with it.
l Licensing: Refer to the Stealthwatch Smart Software Licensing Guide for
information.
l Trust Store Certificates: As part of this procedure, you will add appliance
identity certificates to the required Trust Stores. Make sure you follow the
instructions.
l Adding/Removing Appliances: Do not add or remove appliances from Central
Management until you've finished the failover configuration and confirmed the
secondary SMC Appliance Status is shown as Up in Central Management.
1. Plan which SMC will be primary and which SMC will be secondary.
2. Log in to the
3. Before you configure the failover roles in the system, review and follow the
instructions in Stealthwatch Online Help.
l In the Enterprise tree, right-click the SMC.

l Select Configuration > SMC Failover.
l Click Help.
Enabling the Threat Intelligence Feed

The Threat Intelligence Feed provides data from the global threat intelligence feed about
threats to your network. The feed updates frequently and includes IP addresses, port
number, protocols, host names, and URLs known to be used for malicious activity. The
following host groups are included in the feed: command-and-control servers, bogons,
and Tors.
License
Add the Threat Intelligence Feed License to your Cisco Smart Account. For instructions,
refer to the Stealthwatch Smart Software Licensing Guide.
Enable
To enable the feed in Central Management, follow the instructions in the online help.
Please note that you will configure the DNS server and firewall as part of the
instructions.
1. Log in to your primary Stealthwatch Management Console.

2. Click the Global Settings icon.
3. Select Central Management.
4. Click the User icon. Select Stealthwatch Online Help.

5. Select Appliance Configuration > Threat Intelligence Feed.
Review Alarms and Security Events

When the Threat Intelligence Feed is enabled, the Stealthwatch Labs Intelligence
Center icon is shown in the Stealthwatch Desktop Client Enterprise tree with an alarms
status, and threats are displayed in their respective host group branches. For more
information, refer to the Stealthwatch Desktop Client User Guide or the online help.
Online Help: To access the Online Help, right-click the Stealthwatch Labs
Intelligence Center branch and select Configuration > SLIC Threat Feed
Configuration. Click Help.

Configuring SAML SSO

Use the following instructions to configure Security Assertion Markup Language Single
Sign-On (SAML SSO). SSO is an authentication process that allows a user to access
multiple applications with one set of credentials.
Not Supported: SSO is not supported in the Stealthwatch Desktop Client. SSO is not
supported with Integrated Windows Authentication (IWA).
1. Prepare for Configuration

You need the following information to configure SSO:
Requirement Details
The URL must use the fully qualified

Identity Provider URL
domain name or IPv4 address.
If the IDP URL starts with HTTPS, download

Identity Provider Certificate
the CA certificate.
2. Upload Certificates to the Trust Store

If the Identity Service Provider (IDP) URL starts with HTTPS, add the root CA certificate
to the SMC Trust Store.
If the IDP URL does not start with HTTPS, you can skip this step and go to the
next section, 3. Configure the Service Provider.
Use the following instructions to add the root CA certificate to the SMC Trust Store.
1. On the Central Management Appliance Manager page, click the Actions menu for
the SMC.
2. Select Edit Appliance Configuration.
3. On the Appliance Manager > General tab, locate the Trust Store section.
4. Click Add New.
5. In the Friendly Name field, enter a name for the certificate.
6. Click Choose File. Select the new certificate.
7. Click Add Certificate. Confirm the new certificate is shown in the Trust Store list.
8. Click Apply Settings. Follow the on-screen prompts.
9. Up: On the Appliance Manager page, make sure the SMC finishes the
configuration changes and the Appliance Status returns to Up.
Do not force the appliance to reboot while configuration changes are pending.
10. If you have a secondary SMC, repeat this procedure to add the root CA certificate
to the secondary SMC Trust Store.
11. If you have added the root CA certificate to the SMC Trust Stores, go to the next
section.
3. Configure the Service Provider

1. Log in to the SMC console as root.
2. Type SystemConfig. Press Enter.
3. Select Advanced
4. Select SSO .
5. Confirm ssoEnable/Disable is shown as Disabled.
6. Select IdentityProvider (IDP). Click Continue.

7. Enter the URL where the Identity Provider's configuration file can be downloaded.
Requirements: Enter the fully qualified domain name or IPv4 address.
8. Select DownloadIDP. Follow the on-screen prompts to enable it.

9. Select SaveChanges. Click Continue.
Follow the on-screen prompts to download the IDP configuration file.
10. Select SSO .

11. Review ServiceProvider(SP). Copy the URL. You will use it to configure the
identity provider.
12. Review Status. Confirm it is shown as Ready.
4. Enable SSO
1. Select ssoEnable/Disable.
2. Follow the on-screen prompts to enable SSO.
3. Select CredentialDescription. Click Continue.
4. Enter a description of the SSO service credentials users need to log in.
5. Click OK.
6. Select DownloadIDP. Disable DownloadIDP until you need to save a new SSO
configuration.
l Click Continue.
l Follow the on-screen prompts to disable DownloadIDP.
7. Select SaveChanges. Click Continue.

8. Exit System Configuration.
5. Configure the Identity Provider

1. In the address field of your browser, type the Service Provider URL.
2. Download the Service Provider metadata file sp.xml.
3. Configure the Identity Provider with sp.xml.
4. Make sure the outgoing claim type includes the user email address.
l For example: If the Attribute store is the Active Directory, set the outgoing
claim type to the email address for the LDAP Attribute type user ID.
l Microsoft Active Directory File Server (ADFS): If the IDP type is ADFS,
confirm the following custom rule is shown:
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
Issuer = c.Issuer, Value = c.Value, ValueType = c.ValueType, Properties
["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties
["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] =
"http://<IDP FQDN>/adfs/com/adfs/service/trust", Properties
["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] =
"https://<SMC FQDN>/fedlet");
6. Add an SSO User

Use the following instructions to add an SSO user. Users are authenticated through/by
the Identity Provider.
1. Log in to the SMC (Stealthwatch Web App).

3. Select User Management.
4. Select Create > User.
For instructions, click the User icon. Select Stealthwatch Online Help. For
details about adding users, refer to "Configuring Users."
5. Complete the fields to create a new user. Configure the user as follows:
l Authentication Service: Select SSO.
l User Name: Enter the first part of the email address for the IDP account.
Make sure the ID is identical to the one that will be used for SSO at login. For
example, for [email protected], enter "name" in this field.
6. Click Save.

7. Confirm the SSO User is shown in User Management.
7. Test SAML Login

1. Log in to the SMC (Stealthwatch Web App).
2. On the login page, click the drop-down.
3. Select SAML.
4. Click the credentials button.
5. Enter the login credentials. The SMC opens to the Security Insight Dashboard.
Troubleshooting
Scenario Notes
Disable SSO Only from System Configuration

Account Lockout
through emergency account access.
Make sure the IDP certificate is uploaded to the

Cannot download IDP XML
SMC Trust Store.
Review the IDP configuration and make sure the

Cannot save IDP configuration data you entered is accurate and doesn't include
any extra spaces. Also, review the IDP event logs.
Download a SAML tracer for your browser. Repeat

Additional Issues the SSO login to review the exchanges between
the IDP and SP.
Getting Started with Stealthwatch

After you have finished configuring your appliances, Stealthwatch Online Help provides
instructions for managing your environment, investigating behavior, responding to
threats, and more.
Overview
For an overview of Stealthwatch, review the information in Stealthwatch Online Help.
1. Click the User icon.

2. Select Stealthwatch Online Help.
3. At the top of the page, select the Stealthwatch Help menu.
4. Select Stealthwatch Components > Stealthwatch Management Console
(SMC) Overview > About Stealthwatch Web App.
Managing Your Environment

As part of managing your network security, you need to perform several preliminary
tasks. The menus to access each page are shown with each topic below. For
instructions, select the User icon > Stealthwatch Online Help from any page.
l Configuring host groups (Configure > Host Group Management)

l Creating and managing policies (Configure > Policy Management)
l Building flow searches (Analyze > Flow Search)
l Managing user permissions for using Stealthwatch (Global Settings icon > User
Management)
Investigating Behavior
For information about investigating alarms, events, hosts, and more, review the
information in Stealthwatch Online Help.

4. Select Investigating Behavior.
Responding To Threats
For policy information, review the information in Stealthwatch Online Help.

4. Select Responding to Threats.
Central Management
Central Management
Use Central Management to manage your appliances from your primary SMC. We've
included an overview of Central Management here, and details for each section are
available in Stealthwatch Online Help.
l About Central Management: When your appliances are managed by Central

Management, you can review their status and manage the following: edit appliance
configuration, update software, reboot, shut down, and more.
l Stealthwatch Online Help: To open Stealthwatch Online Help, click the User
icon. Select Stealthwatch Online Help.
Central Management and

Appliance Administration Interface
When an appliance is managed by Central Management, you will access functions for
your appliance in Central Management and the Appliance Administration interface
(Appliance Admin) as follows:
Central Management Appliance Admin Interface
Edit appliance configuration View system statistics
Review license status (overview)
Back up configuration files Back up database files
View audit logs Create diagnostics packs
Reboot Network Host and IP Lookup
Shut down Packet Capture
Update software Clearing the DNS Cache
Appliance-specific configurations
Central Management
Opening Central Management

1. Log in to your primary SMC.
3. Select Central Management.
Opening Appliance Admin

You can access the Appliance Admin interface through
Central Management or by logging in to the appliance
directly.
Opening Appliance Admin through Central

Management
the appliance.
2. Select View Appliance Statistics.
3. Log in to the Appliance Administration interface.
Opening Appliance Admin through Direct Login

1. In your browser address bar, type the appliance IP address as follows:
https://<IPAddress>
l SMC: add /smc/index.html after the IP address.

l For example: https://1.1.1.1/smc/index.html
2. Press Enter.
Editing Appliance Configuration

the appliance.
Central Management
3. Click the Configuration menu. Select an item from the list.
or
Click each tab to review each configuration category.
4. Make changes to each configuration section as needed. You can edit more than
one configuration category on each configuration tab.
For instructions, click the User icon.
Central Management
5. Click Apply Settings. Follow the on-screen prompts to save your configuration
changes.
Some changes require a system reboot. If you prefer to wait, you can revert your
changes and edit your configuration settings and reboot later.
The appliance reboots automatically. Do not force the appliance to reboot while
configuration changes are pending. To confirm the appliance status is Up,
review Central Management > Appliance Manager inventory.
6. Up: On the Appliance Manager page, make sure the appliance finishes the
configuration changes and the Appliance Status returns to Up.
Viewing Appliance Statistics

Hover: For more information about each appliance status, hover your pointer over the
status.
To see system statistics, services, disk usage, and docker services, log in to the
Appliance Admin interface:
the appliance.
2. Select View Appliance Statistics.
3. Log in to the Appliance Administration interface.
Removing an Appliance from Central Management

Use the following instructions to remove an appliance from your Central Manager.
the appliance.
2. Select Remove This Appliance.
Config Channel Down: If you're removing the appliance because the

configuration channel is down, go to the Config Channel Down procedure in
Troubleshooting for additional instructions.
Troubleshooting: If you log in to the Appliance Admin interface and the
appliance is not removed from Central Management, go to the Config Channel
Down procedure in Troubleshooting to remove it using System Configuration.
Central Management
Central Management: To add the appliance to a different Central Manager, use

the Appliance Setup Tool.
If your appliance has custom certificates, make sure you save the identity
certificate and certificate chain (root and intermediate) to the SMC Trust Store
before you add the appliance to Central Management. Refer to the Trust Store
procedure in Stealthwatch Online Help.
Adding an Appliance to Central Management

Use the Appliance Setup Tool to add an appliance to Central Management. It is
important to review the following:
l Custom Certificates: If your appliance has custom certificates, make sure you
save the identity certificate and certificate chain (root and intermediate) to its own
Trust Store and the SMC Trust Store before you add the appliance to Central
Management. Refer to the Trust Store procedure in Stealthwatch Online Help.
l SMC Administration Credentials: You need the SMC, user ID and password to
add an appliance to Central Management.
l RFD: If you reset the factory defaults on an appliance, you will enter the host
name, domain name, and additional configuration information as part of the
Appliance Setup Tool.
l New Installations: If this is a new installation and the appliance hasn't been
configured, go to Quick Reference Workflows.
If your appliance has custom certificates, make sure you save the identity
certificate and certificate chain (root and intermediate) to the SMC Trust Store
before you add the appliance to Central Management. Refer to the Trust Store
procedure in Stealthwatch Online Help.
1. Log in to the Appliance Admin interface.
2. In the appliance browser address bar, after the IP address, replace the end of the
URL with /lc-ast:
https://<IPAddress>/lc-ast
3. Press Enter.
Central Management
4. Click Next to scroll to the Central Management tab.

5. IP Address: Enter the SMC/Central Manager IP address.
6. Click Save.
7. Follow the on-screen prompts to enter the SMC administration credentials and
finish the configuration. Depending on the type of appliance, you may need to
enter additional information.
8. For more information about the Appliance Setup Tool, refer to 5. Configuring
Your Stealthwatch System.
Enable/Disable SSH
Use this section to control the ability to access the appliance using SSH (secure shell).
Default: disabled
When SSH is enabled, the system’s risk of compromise increases. It is

important to enable SSH only when you need it. When you are finished using
SSH, disable it.
Open SSH
Use the following instructions to open SSH for a selected appliance.
1. Open Central Management.

2. Click the Actions menu for the appliance.
4. Select the Appliance tab.
Enable SSH
1. Locate the SSH section.
2. To allow SSH access on the appliance, check the Enable SSH check box.
3. To allow root access on the appliance, check the Enable Root SSH Access
check box.
4. Click Apply Settings.
5. Follow the on-screen prompts.
Central Management
Disable SSH
1. To remove SSH access on the appliance, click the Enable SSH check box to clear
it.
2. To remove root access on the appliance, click the Enable Root SSH Access
check box to clear it.
3. Click Apply Settings.
4. Follow the on-screen prompts.
Installing Patches and Updating Software
Installing Patches and Updating Software

Make sure you keep Stealthwatch up-to-date by installing the latest patches for your
software version. For details and instructions, visit Cisco Software Central.
Software updates are also posted to your Cisco Smart Account at Cisco Software
Central. For a successful update, make sure you follow the instructions in the
Stealthwatch Update Guide.
Troubleshooting
Troubleshooting
Config Channel Down
If your Appliance Manager shows Config Channel Down for the appliance status,
check the following:
l Communication Settings: Confirm your network communication settings.

l Trust Stores: Make sure your appliance identity certificates are saved to the
correct Trust Stores. Review the procedure in Stealthwatch Online Help.
l Certificates: If you've changed the appliance identity certificate, check the
procedure and confirm your certificates are saved to the correct Trust Stores. Refer
to Replacing the Appliance Identity for details.
l License Expiration: Review the Stealthwatch Smart Software Licensing Guide
for details.
l Removing an Appliance: If you remove an appliance from Central Management
while the configuration channel is down, make sure you also remove the appliance
from System Configuration:
l Log in to the appliance console as sysadmin.
l Type SystemConfig. Press Enter.
l Select Recovery > RemoveAppliance.
Opening Appliance Administration Interface

You can access the Appliance Admin interface through Central Management or by
logging in to the appliance directly.
You may need to log in to Appliance Admin if you've removed your SMC from Central
Manager for troubleshooting.
1. In your browser address bar, type the appliance IP address as follows:
https://<IPAddress>
l SMC: add /smc/index.html after the IP address.

l Example: https://1.1.1.1/smc/index.html
2. Press Enter.
Troubleshooting
Replacing the Appliance Identity

Each Stealthwatch version 7.x appliance is installed with a unique, self-signed
appliance identity certificate. You can update the appliance identity certificate using the
Update the Appliance Identity procedure shown in Stealthwatch Online Help.
1. Open Central Management > Appliance Manager.

5. Locate the SSL/TLS Appliance Identity section.
6. Click Update Identity.

7. In the warning, click the Stealthwatch Online Help link.
8. Follow the instructions to change the certificate and update the Trust Stores.
Your certificates are critical for your system’s security. Improperly modifying
your certificates can stop Stealthwatch appliance communications and cause
data loss.
Changing Appliances After Configuration

To change the appliance host name, network domain name, or IP address, follow the
instructions in Stealthwatch Online Help.
As part of the procedure, you will remove the appliance from Central Management
temporarily, and the appliance identity certificate is replaced automatically. Also, you
may need to check your appliance Trust Stores.
The appliance identity certificate is replaced automatically as part of this

procedure.
If your appliance uses a custom certificate, please contact Cisco

Stealthwatch Support to change these settings. Do not use the instructions
shown here. Make sure you have a copy of the custom certificate and private
key.
Changing the Host Name

Make sure the host name is unique and meets the Internet standard requirements for
Internet hosts.
Troubleshooting

5. In the Host Naming section, click the Info icon.
6. Click the Stealthwatch Online Help link.
7. Follow the instructions to change the host name.
Changing the Network Domain Name

Make sure you use a fully qualified domain name.

5. In the Host Naming section, click the Info icon.
7. Follow the instructions to change the network domain name.
Changing IP Address
5. In the Network Interfaces section, click the Info icon.
7. Follow the instructions to change the network domain name.
Troubleshooting
Opening the Appliance Setup Tool

Use the following instructions to open the Appliance Setup Tool after you've configured
an appliance.
If you change the host name, network domain name, or IP address using the
Appliance Setup Tool, the appliance identity certificate is replaced
automatically.
If your appliance uses a custom certificate, please contact Cisco

Stealthwatch Support to change these settings. Do not use the instructions
shown here. Make sure you have a copy of the custom certificate and private
key.
1. In the appliance browser address bar, after the IP address, replace the end of the
URL with /lc-ast:
https://<IPAddress>/lc-ast
2. Press Enter.

3. For more information, refer to 5. Configuring Your Stealthwatch System.
System Configuration Overview

We've updated System Configuration with a new menu structure. System Configuration
often involves troubleshooting. For assistance, please contact Cisco Stealthwatch
Support.
l Users: The available menus are determined by whether you log in as root,
sysadmin, or admin.
l SSH: You may need to enable SSH to access a menu.
1. Log in to the appliance console.

3. From the main menu, select a menu:
l Network: To change appliance management port network, trusted hosts, and

network interfaces, select Network.
l Security: To change or reset passwords and manage Syslog Compliance, select
Security.
Troubleshooting
l Recovery: To remove an appliance from Central Management, reset factory

defaults, or refresh the image, select Recovery.
l Advanced: To refresh the appliance model, open the root shell, manage the
admin user account, or configure Single Sign-On, select Advanced.
Changing the Trusted Hosts

You can use System Configuration to change the trusted hosts list from the appliance
defaults. However, please contact Cisco Stealthwatch Support before you change your
trusted hosts.
Please contact Cisco Stealthwatch Support before you change your trusted
hosts.
If you change the trusted hosts list from the defaults, make sure each Stealthwatch
appliance is included in the trusted host list for every other Stealthwatch appliance in
your deployment. Otherwise, the appliances will not be able to communicate with each
other.
1. Log in to the appliance console as sysadmin.

2. Select Network > Trusted Hosts.
3. Follow the on-screen prompts to change the Trusted Hosts.
Resetting Factory Defaults

Use the following instructions to reset an appliance to its factory defaults (RFD). To
completely erase data, make sure you reset factory defaults twice.
l RFD twice: To completely erase data, make sure you reset factory defaults twice.
l Back up Configuration: If you plan to restore the appliance configuration, make
sure you save the backup configuration and database backup files. Refer to
Backup Configuration Files (in Central Management) and Backup/Restore
Database (Appliance Admin interface) topics in the Stealthwatch Online help
for details. To restore the backup after RFD, contact Cisco Stealthwatch Support.
If you reset factory defaults (RFD) on an appliance, all existing data and
configuration information will be deleted and can only be restored if you've
made a backup.
Troubleshooting
If you reset an appliance to factory defaults, you cannot restore the

configuration using Central Management. For assistance, please contact Cisco
Stealthwatch Support.

2. Select Recovery > Factory Defaults.
3. Follow the on-screen prompts to reset factory defaults and restart the appliance.
Make sure you RFD each appliance twice to completely erase data.
Enabling/Disabling Admin Users

Use the following instructions to enable or disable the default admin account.

2. Select Advanced.
3. Select Admin User.
4. Follow the on-screen prompts to enable or disable the Admin User account.
5. Repeat these instructions to enable or disable the Admin User account on all
appliances in your Stealthwatch cluster.
Enabling or Disabling Password Reset

Use the following instructions to enable or disable the password reset function. If you
select Enable, passwords can be reset to the default settings using the GRUB command
line interface.
If you disable the password reset, and you lose your passwords, you will lose
access to the data saved to your appliance. To access the appliance again,
reset factory defaults and reconfigure it.
1. Log in to the appliance console as root.

3. Select Security.
4. Select Password Reset.
5. Follow the on-screen prompts to enable or disable password reset.
Troubleshooting
Resetting Passwords to Default Settings

There are a few ways to reset your passwords to their default settings.
l Admin Password: Use Resetting the Admin Password on the SMC.

l Admin, Root, Sysadmin Passwords: Use Resetting Admin, Root, Sysadmin
Passwords to Default.
After you reset your appliance passwords to the default, make sure you change
them. This step is critical for security. Refer to Changing Passwords for
instructions.
Resetting the Admin Password on the SMC

Use the following instructions to reset your admin password to the default setting on
the SMC. Then, change the appliance password for maximum security.
l Requirements: You need the appliance root password to complete these

instructions.
l Other Users: These instructions reset the admin user to the default password.
The individual user passwords will not be changed.
l Other Appliances: These instructions do not reset the admin password on other
Stealthwatch appliances (Flow Collector, Flow Sensor, UDP Director, or Endpoint
Concentrator).

2. Type rm /lancope/var/smc/config/users/admin/user.xml. Press
Enter.
3. Type docker restart smc. Press Enter.
4. Type docker restart nginx. Press Enter.
This will reset admin password to the default value.
5. Exit the appliance console.

6. Go to Changing Passwords to change the admin password from the default. This
step is critical for security.
Resetting Admin, Root, Sysadmin Passwords to Default

Use console access to reset your appliance admin, root, and sysadmin passwords to
the default settings. Then, change the appliance passwords for maximum security.
Troubleshooting
1. Log in to the appliance console (CIMC or hypervisor).

2. Reboot the appliance.
3. When the console screen reaches the GRUB menu, type "e" to enter edit mode.
4. Advance the cursor to the second line.
The command line might look slightly different depending on your appliance
version.
5. Type resetpassword after c=off to make the command line look like the
following example:
Troubleshooting
linux /boot/vmlinuz-$kern_ver $kern_args $console_args

pci=reallo\
c=off resetpassword
6. Type CTRL-X to resume booting.
This will reset your admin, root, and sysadmin passwords to their default values.
7. Go to Changing Passwords to change the passwords from the default. This step
is critical for security.
Changing Passwords
Use the following instructions to change your passwords from the default password or
a previous password. Make sure you use the following criteria:

l Change: Make sure the new password is different from the previous
password by at least 4 characters.
User Default Password
admin lan411cope
root lan1cope
sysadmin lan1cope
Troubleshooting
Changing the Sysadmin Password

2. Select Security.
3. Select Password.
4. Follow the on-screen prompts to change the sysadmin password.
Changing the Root Password

3. Select Security.
4. Select Password.
5. Follow the on-screen prompts to change the root password.
Changing the Admin Password on the SMC

1. Log in to the SMC as admin.
l URL: https://<IPAddress>
l Login: admin
2. Click the Global Settings icon. Select User Management.

3. Locate the admin user in the list.
4. Click the Actions menu. Select Change Password.
5. Follow the on-screen prompts to change the admin password. Use the following
criteria:

l Change: Make sure the new password is different from the default password
by at least 4 characters.
Troubleshooting
Changing the Admin Password on All Other Appliances

Use the following instructions to change the admin user password on a Flow Collector,
Flow Sensor, UDP Director, or Endpoint Concentrator.
1. Log in to the Appliance Administration interface as admin.
l URL: https://<IPAddress>
l Login: admin
2. Select Manage Users > Change Password.

3. Enter the current password and new password.
4. Click Apply. Follow the on-screen prompts to change the password.
5. To change the admin password on another appliance, repeat steps 1 through 4.
Contacting Support
Contacting Support
If you need technical support, please do one of the following:
l Contact your local Cisco Partner

l Contact Cisco Stealthwatch Support
l To open a case by web: http://www.cisco.com/c/en/us/support/index.html
l To open a case by email: [email protected]
l For phone support: 1-800-553-2447 (U.S.)
l For worldwide support numbers:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-
contacts.html
Copyright Information
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its
affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are
the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1721R)
© 2020 Cisco Systems, Inc. and/or its affiliates.

All rights reserved.

SW 7 2 Installation and Configuration Guide DV 3 0

Uploaded by

Copyright:

Available Formats

SW 7 2 Installation and Configuration Guide DV 3 0

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SW 7 2 Installation and Configuration Guide DV 3 0

Uploaded by

Copyright:

Available Formats

Cisco Stealthwatch

Installation and Configuration Guide 7.2

l Stealthwatch Management Console (SMC)

Virtual Edition (VE)

For details, refer to the Release Notes.

DNS Domain Name System (Service or Server)

dvPort Distributed Virtual Port

ESX Enterprise Server X

IDS Intrusion Detection System

IPS Intrusion Prevention System

ISO International Standards Organization

KVM Kernel-based Virtual Machine

MTU Maximum Transmission Unit

NTP Network Time Protocol

OVF Open Virtualization Format

SMC Stealthwatch Management Console

UUID Universally Unique Identifier

VDS vNetwork Distributed Switch

VLAN Virtual Local Area Network

Before You Begin

Installing your virtual

VMware ESXi 3b. VMware ESXi Installing your virtual

KVM and Virtual 3c. KVM and Installing your virtual

Do not install VMware Tools on a Stealthwatch virtual appliance because it will

The system performance is determined by the host environment. Your

Third Party Applications

Hardware Resource Requirements

Flow Flow UDP

IP Address 192.168.1.11* 192.168.1.4* 192.168.1.7* 192.168.1.2*

*These are default IP addresses. The Flow Collector sFlow default is

In addition, you could also use the following settings:

Virtual Edition (VE) Resource Requirements

l Stealthwatch Management Console (SMC)

If you choose to deploy Cisco Stealthwatch appliances without the required

Stealthwatch Management Console VE

Stealthwatch Management Console VE 2000

Stealthwatch Management Console VE Models and

SMC VE Required Required

SMC VE 2000 ≥ 64 GB 8 or more

Required Required Flow

1 2 4 GB 850 Mbps 32,766

2 4 8 GB Interfaces configured as PCI 65,537

4 8 16 GB Interfaces configured as PCI 131,073

Optional: One or more 10G NICs may be used on the physical VM host.

l Processors: 2 Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40 GHz, 2 sockets, 12 cores

Flow Sensor VE Network Environments

l A network with virtual local area network (VLAN) trunking

Integration: For integration information, review Stealthwatch Flow Sensor.

Flow Sensor VE Traffic

0x8000 Normal IPv4

0x86dd Normal IPv6

0x8847 MLPS unicast

0x8848 MLPS multicast

The capacity of your Flow Collector should be taken into consideration in

If you choose to deploy Cisco Stealthwatch appliances without the required

l Expansion Calculation: The virtual appliance uses approximately 75% of the

Stealthwatch Management Console VE 150 GB 5.6 TB

Stealthwatch Management Console VE

Flow Collector NetFlow VE 200 GB 1 TB