Quick Installation Guide

Transcription

1 Nortel IP Flow Manager Release: 2.0 Version: Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 1 of 9

2 Nortel IP Flow Manager Release: 2.0 Publication: NN Document status: Standard Document release date: 1 st October 2009 Copyright 2009 Nortel Networks All Rights Reserved. Printed in Santa Clara, U.S.A While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS" WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice. Nortel, the Nortel logo, and the Globe mark are trademarks of Nortel Networks. Windows and Internet Explorer are trademarks of Microsoft Corporation. Firefox is a trademark of Mozilla Foundation. All other trademarks are the property of their respective owners. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 2 of 9

3 Please note that this document captures only the changes made after IPFM release and thus contains only the very specific and/or updated content. The "IP Flow Manager" installation is wizard-based and is the same for both supported operating systems, Linux and Windows. Before you start install you must ensure that the system meets following UCM requirements. Apply UCM Patch If you already have an existing UCM deployment, then you must install the latest UCM patch ("UCM_IPV6_JMS_Maint_Patch_ ") in the machine where "primary" and "backup" security servers are installed and restart JBoss service on all security servers sequentially (i.e. first "primary", then "backup" and then "member"). Then install "IP Flow Manager 2.0" application. If you are about to install "IP Flow Manager 2.0" application as the very first UCM application, you need to install the UCM patch "UCM_IPV6_JMS_Maint_Patch_ ") on "primary" security server as soon as the IPFM installation completes. The UCM patch can be downloaded from Nortel website and/or can be found in IP Flow Manager DVD itself. Please note that there is no upgrade possible from IPFM 1.0 or release to IPFM 2.0 release. Thus in such scenario user must uninstall IPFM 1.0 or and then proceed to install IPFM 2.0 release. HOSTNAME The hostname of the m/c must not contain any underscore ('_') character in it (e.g. hyperv_2009, etc.). For Windows, you can define or change hostname using Control Panel System Computer Name Change. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 3 of 9

4 FQDN (Fully Qualified Domain Name) IPFM uses JBoss as Application Server and JBoss uses FQDN from the "hosts" file to identify the server where it is installed. Thus user must define the host information in the respective system file with proper format as specified below. For RHEL platform check host file entry in "/etc/hosts" file. For Windows platform check host file entry in "C:\Windows\System32\Drivers\etc\hosts" file. The Correct format of Fully-Qualified Domain Name (FQDN) will be: localhost rhino.acme.com rhino The loop back host address, i.e must be the very first entry in "hosts" file. This in turn demands that user must have a DNS server in network so that a FQDN can be configured for the machine where IPFM will be installed. If user does not configure the FQDN properly, the installer will encounter error and show an error message: 'Quantum auto configuration failed'. In such scenario user must cancel the current installation, run the IP Flow Manager uninstalls script, correct the FQDN, and then start installation again. IP Address UCM platform uses MacroVision license server. One of the drawbacks of MacroVision license server is that in Linux platform user can only use the MAC address which is associated with the eth0 interface of the server. MAC addresses associated with any other interface would deem the application unlicensed. Thus user must use the MAC address associated with the eth0 interface in Linux system. User should use an m/c with a valid IPv4 address. At this point IPFM (UCM) does not support pure IPv6 box. Though dual IP address stack is supported but on RHEL platform JBoss fails to bind an IPv6 IP address during its startup. This happens due to a known bug in JDK 1.5 release. As workaround, user needs to add the following option in JBoss startup script (run.sh): -Djava.net.preferIPv4Stack=true In case of a system with dual stack IP address (i.e. supporting both IPv4 & IPv6), following entry must be there in "/etc/hosts" file (after the entry for ). ::1 localhost.localdomain localhost if system is booted in IPv6 mode. This in turn means that user must have a DNS server in the network so that a FQDN can be configured for the machine where IPFM is installed. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 4 of 9

5 Temporary Directories On RHEL platform user must have "/var" and "/tmp" directories with "write" permission. On Windows platform generally the TEMP System environment variable is defined during OS installation, if not then user must define the TEMP System environment variable accordingly. Default System ports needed by IPFM & UCM IP Flow Manager and UCM require a number of ports for operations and communications. If another service, daemon or application already uses any of these required ports, the user will be alerted and installation will not proceed unless the port becomes free. User should cancel the installation, free the required port(s), and then restart the installation. Port Number Purpose 80 HTTP Port, by default any HTTP access will be redirected to HTTPS automatically. 389 Port required for LDAP server. 443 HTTPS port, Web clients will be asked to send client x.509 certificate if they have one to optionally enforce X.509 client mutual authentication on some internal Web service end points. 636 TLS port for LDAP - requires X.509 client certificate for mutual authentication. 2250, 9995 UDP ports used by IPFM to receive IPFIX packets (flow information) from devices RADIUS service UDP port for CLI mode common login TLS port JMS, requires X.509 client certificate for mutual authentication TCP port for clustered JNDI Stub downloads , TCP port for RMI queries on the clustered JNDI , 45567, TCP ports for selecting primary server in JBoss cluster using JGroup protocol JNDI port used by JBoss RMI naming port used by JBoss port used by MYSQL (database) A single port from this range used by licensing server Licensing Licensing is based on the number of devices from which IP flow data is received. License Type Details Trial Up to four (4) devices (200,000 flows per minute) for up to 60 days Base Up to four(4) devices (200,000 flows per minute) Incremental Enterprise One (1) device (50,000 flows per minute) Up to ten (10) devices (500,000 flows per minute) Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 5 of 9

6 System Requirements Following table describes the system requirement for IP Flow Manager application. For performance reason Nortel recommends to install IP Flow Manager in a separate server where no other UCM application and/or other resource consuming application is installed (or running). Item Operating system Hardware Expectation Red Hat Enterprise Linux 5.2 Microsoft Windows 2003 Enterprise R2 Server SP2 (all versions) Microsoft Windows 2008 Server Standard configuration: CPU: Quad Core CPU Speed: 3.0 GHz or higher Hard disk: 320 GB Memory: 6 GB or more Minimum configuration: CPU: Dual Core CPU Speed: 2.0 GHz Hard disk: 150 GB Memory: 4 GB Failure to conform to "minimum" configuration, the installation process can still be continued - but performance and scalability issues will eventually be observed in IP Flow manager application. Browser Microsoft Internet Explorer 7.x Mozilla Firefox 3.x Firefox is the recommended browser to use for performance reason. Co-residency Requirements For production deployment, IPFM is required to be installed in a dedicated server. However for demonstration & evaluation purpose "only", IPFM can co-reside with VPFM, NRM, EPM applications. If IP Flow Manager is installed in the same machine where another UCM application is already installed, user has to provide the "root" password for the UCM Database (MySQL) server. This is needed because IP Flow Manager has its own database and to create this database, it needs the "root" password. Generally the "root" password is the same one as the UCM "admin" password. But user "can" change UCM "admin" password any point of time and if user does so, the "root" password for Database (MySQL) server will still be the same (i.e. old one). Thus user must need to enter the "root" password - *NOT* the UCM "admin" password. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 6 of 9

7 Default File Locations The following table lists the default locations. If required, you can change these during installation. Component Unified Communications Management Common Services Environment Variable UCM_HOME Default Directory Linux: /opt/nortel/ucm Database (MySQL) UCM_DB_HOME Linux: /opt/mysql Windows: C:\Program Files\Nortel\UCM JBoss IP Flow Manager install folder License Windows: C:\Program Files\MySQL\SQL Server 5.1 UCM_JBOSS_HOME Linux: /opt/nortel/ jboss ga Windows: C:\Program Files\jboss\jboss GA Linux: /opt/nortel/ucm/ipfm Windows: C:\Program Files\Nortel\UCM\IPFM Linux: /opt/nortel/ucm/lsm/licenses Windows: C:\Program Files\Nortel\UCM\LSM\licenses Installation Mode IP Flow Manager 2.0 can be installed in one of three security modes: Primary, Member and Backup. During installation, the credentials and license administration modules will be installed if "Primary" server is selected. User is required to enter the FQDN of the "Primary" server if "Member" or "Backup" server is selected. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 7 of 9

8 If IP Flow Manager is installed as "primary" server and for some reason user restarts the JBoss server, he/she must restart IP Flow Manager Collector service. If IP Flow Manager is installed as a "member" server and for some reason user restarts the "primary" JBoss server, he/she must restart IP Flow Manager's own JBoss server (i.e. member JBoss server) and IP Flow Manager Collector service. If IP Flow Manager is installed as a "backup" server user must copy the following XML file: ipfm-jbossmq-destinations-service.xml in "{JBOSS_HOME}/server/default/deploy-hasingleton/jms/clusteredDestinations" directory after the installation is completed. Before copying the file user should stop "primary" JBoss server, "backup" JBoss server and "member" JBoss server(s) (if any). After copying the file user should restart all the JBoss servers sequentially in the same way (i.e. first "primary", then "backup" and then "member"). IP Flow Manager Collector service listens to JMS topic hosted by "primary" JBoss server, thus any restart of primary JBoss server needs a restart of IP Flow Manager Collector service. Supported Device Families IP Flow Manager can collect and analyze IP data from the network devices listed below. Product family Model Version Ethernet Routing Switch 8300 All models 4.2 and later All models 4.2 and later Ethernet Routing Switch R-module units 4.1 and later 8600 Ethernet Routing Switch All models 5.0 and later 5500 Ethernet Routing Switch All models 6.0 and later 5600 Generic IPFIX Devices Conforming to NetFlow v5 or v9 standard Device Count IP Flow Manager supports from 4 to 10 devices. One ERS 8600 chassis is considered as 1 device. In the same way one ERS 5500 stack is considered as 1 device. User must properly configure the devices to send IP flow data to the IP Flow Manager. User can use the command line interface or element manager to configure an ERS 8600, ERS 8300, ERS 5500 or ERS 5600 devices. For device configuration instructions, please see the documentation for individual Device family. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 8 of 9

9 After Installation Completes: After installation completes successfully, user must ensure that both JBoss service and IP Flow Manager Collector service are running properly. Sometimes on Linux platform the IP Flow Manager Collector service is not automatically started by the installer. In such scenario user needs to manually start IP Flow Manager Collector service. If you do not have any previous UCM deployment and IPFM is the very first UCM application in your network then you need to install the "UCM Patch" on "primary" security server as soon as IPFM installation completes successfully. This requirement is already explained in earlier section of this document. Following table describes how to start/stop IP Flow Manager JBoss and Collector services on Windows and Linux platforms. Service Name Instructions JBoss Service Windows Using Services Panel and start/stop "Nortel UCM JBoss" service entry. Linux Using a console window execute one of the following commands: /etc/init.d/jbossd { start stop status} or service jbossd {start stop status } IP Flow Manager Collector Service Windows Using Services Panel and start/stop "Nortel UCM IPFIX Collector" service entry. Linux Using a console window execute one of the following commands: /etc/init.d/ipfix_collector { start stop } service ipfix_collector {start stop} Please read the IP Flow Manager Release 1.0 Installation Guide documentation for the following topics. The information on these topics has not been changed. Obtaining an IPFM License PCAP Setup for ERS 8600 Uninstallation of IP Flow Manager For installing new license file and/or applying an "Incremental" or "Enterprise" license user should use the "License Admin GUI" from "UCM Home" page, though the previous way of manually copying of license file is still valid. Copyright 2009 Nortel Networks Nortel IP Flow Manager 2.0 Page 9 of 9