Product Release 6.4 VMware Installation

Transcription

1 Product Release 6.4 VMware Installation Document Revision Catbird Networks. All Rights Reserved. This document and product is protected by US and international copyright and intellectual property laws.

2 VMware Installation Guide 6.x Table of Contents Revision History... iv About This Document... 4 Related Documents... 4 Using the PDF Table of Contents... 5 Overview... 6 Architecture... 6 Concepts... 9 Getting Started Supported Platforms Process Overview Prepare Virtual Infrastructure...11 Obtain Installation Components Prerequisites Fully Qualif ied Domain Name and DNS...12 Certif icate Authority SSL Certif icate...12 Serv ice Accounts to VMware, Firewall, and Network Switch Components...12 Segregate the Catbird Control Center...12 Routing and Required Connectivity Control Center VM Deployment...14 Initial Configuration via Portal Manager Create an 'administrator' Catbird Control Center account and user Create and Install SSL Certificate Generate CSR...23 Obtain Certif icate...24 Install Certif icate to Catbird Control Center...27 Configure Network Time Protocol (NTP) Configure Signature Updates (Vulnerability, IDS/IPS, and Emerging Thre ats) Configure Virtual Switches Creating vma Port Groups VMware Standard Virtual Switch...32 VMware Distributed Virtual v Switch...37 Cisco Nexus 1000v Switch...40 Cisco Nexus 1000V Serv ice Creation...41 Verify Cisco Nexus 1000v Serv ice and Port Group Creation...42 Update Cisco Nexus 1000v Serv ice...44 Doc Rev Catbird Networks, Inc. All Rights Reserved - page ii

3 VMware Installation Guide 6.x vma Deployment...45 Deployment Steps vma Configuration Configure Catbird Services...53 Configure Cisco Virtual Security Gateway (VSG) for Nexus 1000v Series Create an ACL Policy Set at root named Catbird-Set Create a Catbird VSG service within the Catbird Control Center Create the VSG Syslog link back to Catbird VM Console Reference Catbird Control Center Console...62 vma Console...64 Doc Rev Catbird Networks, Inc. All Rights Reserved - page iii

4 Revision History VMware Installation Guide 6.x Rev Date By Change/Update 1.00 Jul 14, 2014 J. Rigler Created as separate document, using Catbird 6.0 User Guide as source. About This Document This document, Catbird VMware Installation, provides a set of instructions for installation, deployment, and initial configuration for the Catbird product into a VMware virtual infrastructure. Its intent to to make the installation as efficient as possible and intentionally contains very little in the way of conceptual information. These deployment guidelines are designed for technical staff tasked with designing and deploying Catbird solutions. Installers should have a working knowledge of VMWare and knowledge of the target virtual and physical infrastructure. The reader is assumed familiar with fundamentals of networking including switches, routers, and TCP/IP and configuration of virtualized datacenters with VMware, including vsphere and ESX/ESXi. Related Documents This document one of several end-user targeted guides describing the configuration and use of the Catbird 6.x product. Other documents available: Catbird User Guide is a guide to the Catbird product user interfaces, which consist of the Catbird Control Center and the Catbird Portal Manager, both of which are accessed via a web browser interface. The User Guide also includes conceptual, architectural, and high leve l descriptions of the product. Technical Support information is also included with the User Guide. Catbird Advanced Concepts Guide goes deeper into concepts and use of the Catbird product, providing guidance on best practices and design guidelines for different ways to use Catbird to meet the needs of different infrastructures or varying compliance requirements. Catbird Control Center API and Event Help. The Catbird Control Center contains an online help section for use of the API and additional information about the Syslog/CEF (Event) output stream message format and contents. These can be found in the Support Section of the Control Center. Release Notes with the latest information for each software release are available at Doc Rev Catbird Networks, Inc. All Rights Reserved - page iv

5 VMware Installation Guide 6.x Using the PDF Table of Contents This document is published in PDF format with hierarchical bookmarks. These can be viewed and used as hyperlinks with PDF viewers. In Adobe Reader (PC or Mac), click on the scroll icon, upper left. This will open to an expandable Bookmarks view. Clicking on a Topic will jump the main view to that topic area. In OS X Preview, click on the View Menu, and Select Table of Contents to open the Table of Contents. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 5

6 VMware Installation Guide 6.x Overview Architecture Catbird is "Software Defined Security" and is deployed in the virtual network itself. The Catbird Control Center operates as the 'command-and-control' node for all of Catbird operations and information aggregation activity. It manages and distributes security tasks through a mesh of multi - functional virtual appliances called vmas (Virtual Machine Appliances ). Through Catbird Control Center, its web-based user interface, it provides in a single console, a view of the state of security and compliance across the entire virtualized data center. Fig. 1- Catbird Distributed Architecture Catbird is based on two primary architectural elements: the Catbird Control Center and distributed Virtual Machine Appliances (vmas). The Control Center contains the management components and is the central processing hub for all security and compliance operations. The Catbird sensors (vmas) are hardened Centos OS base d VMs deployed with one vma for each switch or dvswitch configured on each ESX/ESXi host. Catbird leverages Hypervisor APIs in order to integrate with the virtual infrastructure. The interaction between the management and control components takes place through a combination of Catbird and Hypervisor API connections. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 6

7 VMware Installation Guide 6.x The Catbird Control Center is the centralized control hub for the Catbird system. It runs as a hardened Centos OS based VM within the virtual infrastructure. Optimally it should be deployed on an isolated management virtual network. Fig. 2 - Catbird Control Center Web Interface Catbird vmas (also referred to as Agents) contain monitoring and control components and are deployed on the virtual network itself one per virtual switch for each hypervisor host. By operating inside the virtual infrastructure, vmas leverage contextual information available through hypervisor APIs and secure the data center from within the network. Together, the Control Center and the vmas constitute a multi-functional Software Defined Security solution. Fig. 3 - Software Defined Security - Control and Event Flow Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 7

8 VMware Installation Guide 6.x Catbird vmas include the key components for Network Access Control (NAC), Net Flow control, Vulnerability and Configuration Scanning, and Intrusion Detection System / Intrusion Prevention System (IDS/IPS). vmas are also relay points for connecting to othe r infrastructure control APIs provided by other data center components including VMware vsphere, VMware vshield or Cisco Virtual Security Gateway (VSG). Each vma integrates with the virtual switch fabric through specially configured port groups, configured for promiscuous mode access. Through switch integration, Catbird does traffic inspection to support NAC, Net Flow, and Intrusion Detection and Prevention System. Stateful firewall service is accomplished through the use of the VMware vshield API connection. The Catbird vma supports deployment on the standard VMware vswitch, the VMware distributed vswitch, and the Cisco Nexus 1000v virtual switch. A prototypical Catbird deployment with VMware standard and distributed virtual switches is diagramed below. Production or work activity in represented by Hosts: Prod_1, Prod_2, and Prod_3. The Catbird Control Center is segregated from production and is on Host Mgmt. Each Catbird vma is installed on a port groups used exclusively by its vma to monitor network traffic and enforce compliance controls. Event stream and control information is exchanged between Catbird vmas and the Catbird Control Center on TCP ports 443 and Fig. 4 - Catbird Control Center Deployment with vma Port Groups Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 8

9 Concepts VMware Installation Guide 6.x Catbird abstracts and simplifies security and compliance activities. Catbird is built on the logical concepts of Assets, TrustZones, Technical Controls, and Policies. An Asset in Catbird is a virtual or physical machine, or a VM host. Assets are the targets of control and are the objects being secured. Catbird continuously identifies, monitors, and inventories all Assets in its security domain as well as continuously monitoring network traffic between Assets. A Catbird TrustZone is a logical group or container of Assets to which a set of Policies is applied, one for each type of Technical Control. A TrustZone can also be associated with a Compliance Class. Assets will be members of one or more TrustZones. TrustZones are not limited by network topologies and may have both virtual and physical assets as members in the same TrustZone. Technical Controls are network-based services that provide security relevant functions or posture to the Assets. Controls include Firewall, IPS/IDS, Vulnerability and Configuration Scanning, Layer 2 Network Access Control, Network Flow Monitoring (NetFlow), and Virtual Infrastructure Monitor ing. Policies define the function, configuration, and operation of the technical controls relative to the Assets. Polices are sets of rules for monitoring, compliance, and enforcement and are attached to TrustZones. Policies are enforced through the use of Technical Controls. Catbird vcompliance is a set of integrated technical compliance controls designed to monitor and enforce real-time compliance for standard and well-known compliance frameworks. This orchestrated set of controls work with specific compliance frameworks, known as Compliance Classes within Catbird, including HIPAA, FISMA, DIACAP, COBIT, and PCI. It automates the compliance process by mapping security policies to industry-standards and best practice. Both trend and real-time analysis reports are available for measuring infrastructure compliance levels using framework standards. vcompliance charts map the underlying security controls to the selected regulatory framework. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 9

10 Getting Started VMware Installation Guide 6.x After reviewing these instructions and downloading all Catbird software components, expect to spend about 1 day deploying to an infrastructure consisting of 3-4 non-complex ESX servers. Supported Platforms The following versions have been qualified on this or prior Catbird releases: Web browsers compatible with Catbird Control Center and Portal Manager: o Internet Explorer 10, 11 o Firefox 23, 26, 27,28, 29, 30 VMware platforms and components o ESXi 4.1, 5.0, 5.1, 5.5 o vcenter 5.0, 5.1, 5.5 o vshield 5.1.2c, 5.5.1, Cisco platforms and components o o o Process Overview Nexus 1000V - 4.2(1)SV2(1.1a) Virtual Security Gateway (VSG) - 4.2(1)VSG2(1.1) Virtual Network Management Center (VNMC) (1a) Catbird installation and deployment process steps: 1. Prepare the virtual infrastructure. 2. Obtain installation components. 3. Deploy Catbird Control Center to the operations/management virtual infrastructure. 4. Perform initial configuration via Portal Manager and Catbird Control Center. 5. Deploy Catbird vmas. a. Create and configure port groups on each vswitch/dvswitch as necessary; b. Install vmas, one per switch per ESXi host; c. Register vmas to the Catbird Control Center; 6. Perform secondary configuration via Catbird Control Center a. Create and configure TrustZones, Policies, Services (via Catbird Control Center) b. Populate Catbird with Assets (Virtual Machines and Physical Machines) Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 10

11 VMware Installation Guide 6.x Prepare Virtual Infrastructure Obtain Installation Components Installation requires a Catbird product license along with authentication to download Catbird software. (case sensitive URL) has the latest software, release notes, and updates for both the vsecurity 5 and the Catbird 6 products. A username and password, furnished at the time of contract, is required. In order to obtain the Catbird Control Center package, you will first need to agree to the license terms. The Control Center and vmas components are distributed as Open Virtualization Format (OVF) packages wrapped in.zip files. Download the Catbird vma package using the link Catbird vagent here. Download the Catbird Control Center package by accepting the license agreement. Download and review the most recent release notes. Extract the packaged OVF sets to a location that you can access as you deploy (or update) the Catbird Control Center and as you deploy each Catbird vma. Updates to the Catbird are also available from this web page. Updates are packaged as type.cbu (Catbird Update). These will be used to update the installed version if are directed to do so by Catbird Technical Support or on a later release. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 11

12 VMware Installation Guide 6.x Prerequisites Fully Qualified Domain Name and DNS The Control Center requires a fully qualified domain name (FQDN) (e.g. "CatbirdCC01.example.local") configured in your enterprise Domain Name System (DNS). The FQDN of the Control Center will need to be resolvable by all of the Catbird vmas. Certificate Authority SSL Certificate Catbird Control Center will be installed with a Secure Socket Layer (SSL) certificate consistent with its domain name. You may acquire your own certificate for the FQDN of the Control Center or use the Catbird Certificate Portal to create a Catbird signed SSL certificate. Service Accounts to VMware, Firewall, and Network Switch Components Catbird 6.0 Services require privileged interaction with VMware components: vcenter, and, if used, vshield/vcns and, if used, Cisco VSG and Nexus 1000K components. These exchanges are authenticated using a user account with sufficient rights. You may wish to create special service accounts for exclusive use by Catbird service components for access to VMware and Cisco components. Segregate the Catbird Control Center The Catbird Control Center is best installed into a section of the infrastructure segregated from the operations or data activity, used for administrative management. If you do not have a designated management vsphere, we recommend you first create one. Instructions for provisioning a management infrastructure are outside the scope of this user guide. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 12

13 VMware Installation Guide 6.x Routing and Required Connectivity The Control Center and vma components must be able to communicate with each other and other external components to function. Required connectivity is as follows: Table 1 - Catbird Control Center - vma - Required Connectivity Catbird Component Protocol/Port Direction Description Control Center TCP / 22 outbound Nexus 1000v VSM integration Control Center TCP / 25 outbound SMTP for alert notification Control Center UDP / 53 outbound DNS Control Center TCP / 80 inbound User CC Access (optional - redirects to 443) Control Center UDP / 123 inbound / outbound NTP service for vmas / NTP to configured NTP server Control Center TCP / 443 inbound User CC Access and vma connection / Updates from downloads.catbird.com Control Center TCP / 443 outbound Control Center TCP / 8443 Inbound vma Connection Control Center TCP / 514 outbound Syslog to configured server vma UDP / 53 outbound DNS vma UDP / 123 outbound NTP to CC vma TCP / 443 outbound vma to CC connection / VIM Connection to VMware vcenter / vshield connection to vshield Manager vma TCP / 8443 outbound CC connection vma UDP / 514 inbound vshield syslog collection on VIM vma Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 13

14 Control Center VM Deployment Provisioning the Catbird Control Center consists of deploying the Catbird Control Center OVF and initial configuration. If you have not already downloaded the installation components, do that now. (See section "Obtain Installation Components") Extract the Control Center zip file to a location accessible to VMware vsphere Client. The Catbird Control Center module is distributed as an OVF file and is named in the form "Control- Center.ovf". 1) Select 'File' then Deploy OVF Template". Browse to the extracted Control Center OVF file, and click Next >. Fig. 5 - VMware OVF Source Selection Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 14

15 2) Step through the Deploy OVF Template wizard. a. Review the OVF Template Details information. b. Review Catbird Control Center End User License Agreement, and click Accept and Next. Fig. 6 - Catbird Control Center End User License Agreement Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 15

16 a. Select Name and Location: Use the default name controlcenter or give the VM a unique name. Select an Inventory Location. Click Next. Fig. 7 - VMware OVF Name and Location b. Disk Format: Select "Thick Provision Eager Zeroed". Fig. 8 - VMware OVF Deployment - Disk Format Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 16

17 c. Network Mapping: Map the source CC DMZ to your management network. Fig. 9 - VMware OVF Network Mapping d. Ready to Complete: Make sure "Power On after deployment is NOT checked", click Finish, and do not power it on yet. Fig VMware Deploy OVF - Ready to Complete Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 17

18 4) Edit the virtual machine settings based on the guidelines of the table below. Control Center Infrastructure Guidelines Memory vcpu (Core X Sockets) HD 1 (prov isioned) HD 2 (prov isioned) < 50 Virtualization Hosts < 500 IP Connected Devices (default) 4 GB (default) 2 (default) 8 GB 150 GB 51 to 200 Virtualization Hosts 501 to 2000 IP Connected Devices 8 GB 4 8 GB 500 GB > 201 Virtualization Hosts or > 2000 IP Connected Devices 8 GB 8 8 GB 4 TB Storage should be fast storage RAID 1, RAID 5, or better Table 2 - Catbird Control Center VM Requirement (Refer to the table above for appropriate sizes for your infrastructure.) a. Add to the VM, a second virtual hard disk of the appropriate size. Use Thick Provision Eager Zeroed. This second disk will hold the database. Fig VMware - Add a Virtual Disk Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 18

19 b. Increase the VM memory size if appropriate for this infrastructure. c. Increase the VM vcpu assignment, if recommended for your infrastructure. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 19

20 5) Power on the Control Center virtual machine. It should take about 5 minutes. During initial boot, it will create and format the file system on the second virtual disk and then build the initial database. Wait for the VM to be running before moving on to the next ste p. a. Configure the Catbird Control Center network, DNS, and SMTP. From VMware vsphere Client, open a console to the Catbird Control Center. (Click the console tab or highlight the VM, right click, and select 'Open Console'). You should see the Catbird "Text User Interface". This interface supports keyboard entry only (use 'Enter' to enter a section tab to move between sections, a space to set/clear a * value (such as found in Use DHCP )). b. Enter "Configuration" and then "Interfaces" and configure the IP Address, subnet mask and default gateway and then press OK. (The Catbird Control Center is configured to use DHCP by default. A statically assigned IP address is strongly recommended, as both the FQDN and assigned IP address will be components in the Certificate. The Catbird Control Center FQDN must resolve to the assigned IP address.) c. Enter DNS and set your DNS server(s). Then press OK. d. Enter SMTP and set your SMTP relay server. Then press OK. Fig Catbird Control Center - Console Fig Catbird Control Center - Configuration The Catbird Control Center should now be up and running. Fig Catbird Control Center - Network Configuration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 20

21 Initial Configuration via Portal Manager Remaining configuration is via Catbird Portal Manager. The Portal Manager provides access to a 'superuser' level of access to the Catbird Control Center and is used to perform system wide confi guration. Portal Manager is more fully documented in the Portal Manager section of the Catbird User Guide. 1) Using a supported web browser open a n ' browser session to the Catbird Control Center FQDN or the IP address (The IP address can also be obtained from the summary tab of the Catbird Control Center VM in vsphere Client). Note: Catbird Control Center is installed with a temporary self-signed certificate in order to allow use of the https protocol (https). Until a SSL Certificate is created for the Catbird Control Center FQDN with the correct assigned IP, the browser will warn that it cannot confirm or verify the connection address. Username: portal_mgr password $CatbirdSecurity12 2) Change the 'portal_mgr' password. Click on the "Admin" tab, then then "Reset Password" tab. Enter a new password value and note it down. See Portal Manager:Admin:Reset Password for more details. Fig Catbird Control Center - Portal Manager Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 21

22 Create an 'administrator' Catbird Control Center account and user. Tab to "Manage Server->Account Management". Fig Portal Manager - Create Account This will create both an account (e.g. "Administrator") and a user within that account "Admin" with the "Admin@Example.com". Note 1: The " " value is used for the actual logon" name, rather than Name value, both when logging on to the Catbird Control Center and when registering each vma. Note 2: While account authentication can be integrated with Active Directory, for the initial set up, Catbird recommends that the first account be used as an administrator account and authenticated by Catbird only. See Catbird User Guide, secti on Portal Manager:Admin:Active Directory for more information. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 22

23 Create and Install SSL Certificate Generate CSR VMware Installation 6.x To generate a Certificate Signing Request (CSR), use tab "Manage Server" and sub tab "Generate CSR". The Control Center must have previously assigned a Fully Qualified Domain Name (FQDN) to create the CSR. Complete all fields and click "Create". Fig Portal Manager - Create Certificate Signing Request Portal Manager will respond with the created Certificate Signing Request. The next step is to copy the CSR, and submit it to a Certificate Authority for generation of a SSL/TSL Certifiate. You may use Catbird Certificate Portal as your CA certificate generator. Fig Portal Manager CSR Request - Response Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 23

24 Obtain Certificate VMware Installation 6.x To obtain a certificate from Catbird, use the Catbird Certificate Portal: Log in with the username and password provided by your Catbird Solution Architect or Catbird support. If your organization is using a different Certificate Authority than Catbird, skip this section. Click on Enter CSR. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 24

25 Complete the Title field ( CSR Request ). Then cut the CSR from the Catbird Portal Manager CSR request results box, and paste it into dialogue box titled Enter Certificate Signing Request. (The Summary box can be skipped.) Click Save. The Certificate Portal will accept and parse the request, and display the embedded values. Confirm these values and click Sign, or use the Edit button to go back and submit a different CSR. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 25

26 Once signed, the Certificate Portal will generate a Certificat e and display it a box below the request and authentication values. Copy the entire contents of the certificate box, starting with the dashes preceding BEGIN CERTIFICATE and ending with END CERTIFICATE Now return to Catbird Portal Manager. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 26

27 Install Certificate to Catbird Control Center Use the Manager Server -> Install Certificate tab and paste the certificate in the window and click "Next. Fig Portal Manager - Install SSL Certificate If the certificate has been entered correctly, there will be a verification page. Click Use Certificate. Fig Portal Manager - Verify Certificate It is followed by a confirmation message. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 27

28 Fig Portal Manager - Certificate Confirmation Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 28

29 Configure Network Time Protocol (NTP) Use 'Manage Server -> Configure NTP to add the name of the NTP server for your environment. The Control Center will use this NTP server directly and is an NTP proxy for the vmas. Fig Portal Manager - Network Time Protocol Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 29

30 Configure Signature Updates (Vulnerability, IDS/IPS, and Emerging Threats) Catbird Vulnerability Scans, and IDS/IPS controls with Emerging threats, are designed to use the latest set of definitions (Signature sets) for each area of control. Each of these areas can be configured to check for updates as frequently as hourly, or can be set to never update. At installation, the check is set to Never update so no new updates will be done. See Portal Manager: Signature Updates for more information on how to configure the Signature Updates. Fig Portal Manager - Signature Updates Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 30

31 Configure Virtual Switches Creating vma Port Groups VMware Installation 6.x Fig vma on vswitch with VLANs vmas are used to monitor and control network traffic in the infrastructure. Control software running on the vma will be using each vma virtual network interface (vnic) in promiscuous mode on a trunked Port Group (that is one spanning all VLANs). Setting the Port Group to trunk mode allows vmas to monitor VLAN traffic regardless of VLAN tagging. Catbird requires one vma Port Group per Standard vswitch for each ESX host and one vma Port Group for each dvswitch (Distributed Virtual Switch (VDS). Nexus 1000v switches will have 2 Port Groups for each vma. vmas also communicate directly with the Catbird Control Center via TCP/IP. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 31

32 VMware Standard Virtual Switch VMware Installation 6.x Add a Catbird dedicated Port group to each vmware Standard Virtual Switch. 1) Start by running vsphere Client, from "Home". Select "Inventory, then "Hosts and Clusters", and then select an ESX host and open the Configuration tab, then, under Hardware, open the Networking configuration view. Under the "Configuration" tab, select the sub-tab vsphere Standard Switch". Fig VMware - ESX Host Networking Configuration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 32

33 For each Standard vswitch on the host, select the Properties link. Fig VMware vswitch Properties 2) Click the Add button and select Virtual Machine as the Connection Type. Click Next. Fig VMware - Add Port Group - Virtual Machine Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 33

34 3) Give the Port Group a descriptive name such as Management Trunk or vswitch0-trunk (note that each Port Group name must be unique) and enter the special value of 4095 for the VLAN ID, which sets this to be a Trunk Port Group, as traffic with all VLAN tags will be visible on this Port Group. Click Next. Fig VMware - vswitch - Add Port Group 4) You will be presented with the Summary screen. Review the Port Group name and note the text VLAN All in the new Port Group. Click Finish. Fig VMware - vswitch - Review Configuration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 34

35 5) Select "Properties" again, for the same Standa rd vswitch. Edit the new Port Group by selecting it from the Ports tab and clicking Edit. Fig VMware - Standard Switch - Port Group - Properties 6) From the Security tab, select Promiscuous Mode and change it from Reject (default) to Accept. Note that you should also have MAC Address Changes and Forged Transmits both set to Accept (default). Click OK. Fig VMware Standard Switch - Port Group - Security Modes Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 35

36 7) With the vma Port Group fully configured, you should see something like the following in the Properties view. Fig VMware - Standard Switch Port Groups - Summary Repeat these steps to create a vma Port Group for each vswitch in your cluster and operations ESX infrastructure. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 36

37 VMware Distributed Virtual vswitch VMware Installation 6.x The vsphere Distributed Switch (VDS) simplifies virtual machine networking. A single Distributed Virtual Switch can span ESX hosts simplifying creation of spanning Port Groups. It also simplifies creation and management of promiscuous and trunking Port Groups for use with Catbird. However, because network traffic on a dvswitch trunk port is still contained within the host, each host must be configured with its own vma.). For each host on each Distributed Virtual Switch (dvswitch): 1) Run VMware vsphere Client. From "Home" select Inventory, then Networking. Select the target Distributed Virtual Switch (dvswitch). Open the "Summary" tab. Fig VMware - Distributed Switch Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 37

38 2) Select "New Port Group", and on the Create Distributed Port Group dialogue box give it a descriptive name. Set the 'VLAN type' value to "VLAN Trunking", and use the VLAN trunk range of "1-4094" to capture all VLANs. Click "Next". The result should look similar to this: Fig VMware - Distributed Port Group - VLAN Trunking Fig VMware - Distributed Port Group - Summary Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 38

39 3) Click Finish. Expand the targeted dvswitch, and then click on the new dvswitch trunk Port Group you just created. Select the Summary tab, then in the Port Group dialogue box, click on "Edit Settings". Fig VMware - Distributed Port Group - Edit Settings 4) Select the Security dialogue, and then security fields Promiscuous Mode and Forged Transmits to "Accept" as shown below. Click OK. This will save the settings. Fig VMware - Distributed Port Group - Security Settings Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 39

40 Cisco Nexus 1000v Switch [Cisco Nexus 1000V Sites Only] VMware Installation 6.x This section provides instruction in integrating Cisco Nexus 1000v switch into the Catbird software defined security infrastructure coverage. Deployment and configuration of the Cisco Nexus 1000v switch itself is outside the scope of this document. Please refer to appropriate Cisco documentation. Cisco Nexus 1000v integration with Catbird is most easily done after installing and deploying the Catbird Control Center, and before powering on the Catbird vma appliances. This is due to the additional step of creating and registering Catbird vma Nexus port groups, that is initiated from the Catbird Control Center. The Catbird Cisco Nexus 1000v service, accessible from Services node in the Navigator Tree of the Control Center, will configure the Nexus 1000v switch for use with Catbird vmas. The Nexus 1000v Service must also be updated after vmas are registered. The following items must be installed before proceeding: The Cisco Nexus 1000v switch A Catbird Control Center configured with an account Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 40

41 Cisco Nexus 1000V Service Creation The Cisco Nexus 1000v integration with Catbird is controlled through the Catbird Cisco Nexus 1000v Service, which is configured and initiated in the Catbird Control Center. 1. Open the Catbird Control Center browser interface. From a browser window, enter the URL of the Catbird Control Center. Log in using the administrator and password created in Portal Manager. 2. In the Navigator Tree, click on the Services node. In the Active Panel, click on the "Add New Service" action and select "Cisco Nexus 1000v". A "Service Details" dialog pane will open on the right. Fig Catbird Control Center - Create Cisco Nexus 1000v Service 3. Fill in 'Service Name' with a descriptive name. 4. Enter the Cisco Nexus Virtual Supervisor Module (VSM) IP address or host name. 5. In SSH User Name and SSH Password, enter the Cisco Nexus VSM Administrator Username and Password 6. Recommended: select "Automatically determine VLANs to monitor". 7. Check the Update switch configuration' checkbox 8. At the top of the dialog box, click 'Create Cisco Nexus 1000v. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 41

42 Verify Cisco Nexus 1000v Service and Port Group Creation To verify the Nexus Service has been successfully activated, navigate to Dashboards Event Viewer. Look for Nexus events indicating port profiles have been successfully configured as shown below. Fig Catbird Control Center - Event Viewer - Nexus Service Started The creation of the Nexus Port Groups can be verified from the Networking view in VMware vcenter. Open the Inventory > Networking view. It will show three Port Groups created by the Catbird Nexus Service. They will be named: vmservice-catbird-nx-trunk, vmservice-catbird-nx-span, and vmservicecatbird-nx-span2. Fig VMware - Nexus 1000v Port Groups Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 42

43 Fig Port Group Nx-Span Fig VMware - Port Group Nx-Span-2 These additional Catbird ports, along with Catbird monitor sessions can also be verified from the Nexus itself by using the show run command, while logged in to the Nexus VSM. Look for the Catbird port groups vmservice-catbird-nx-span, vmservice-catbird-nx-span - 2 and vmservice-catbird-nx-trunk and for the Catbird Span Monitor sessions 1 and 2: The next step will be to deploy each vma appliances. See step 4 in vma Virtual Application Installation. After all vmas are deployed, return back to this section and follow the steps in Update Cisco Nexus 1000v Service Configuration, below. NK1(conf ig)# show run!command: show running-conf ig :...< skipped lines>... monitor session 1 description Catbird Span Monitor source v lan 1, rx destination port-prof ile v mserv ice-catbird-nx-span no shut monitor session 2 description Catbird Span Monitor source v lan 1, rx destination port-prof ile v mserv ice-catbird-nx-span-2 no shut sv s-domain domain id 1 control v lan 1 packet v lan 1 sv s mode L3 interf ace control0 : :...< skipped lines>... : port-prof ile ty pe v ethernet v mserv ice-catbird-nx-trunk v mware port-group switchport mode trunk no shutdown max-ports 64 description Catbird Trunk Port state enabled port-prof ile ty pe v ethernet v mserv ice-catbird-nx-span v mware port-group switchport mode trunk no shutdown description Catbird Span Port state enabled port-prof ile ty pe v ethernet v mserv ice-catbird-nx-span-2 v mware port-group switchport mode trunk no shutdown description Catbird Span Port state enabled Fig Cisco Nexus VSM - show running-config Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 43

44 Update Cisco Nexus 1000v Service After deploying each vma, return to the Catbird Control Center Nexus 1000v Service interface. Log into the Catbird Control Center, navigate to the Configuration Services and click on the Cisco Nexus 1000v Service. Select all Agents (by Id) as assigned when deploying the vmas. Ensure that Update switch configuration is selected. Click on Update Cisco Nexus 1000v. This will let Catbird Control Center acknowledge the selected vmas ( agents ). Fig Catbird Control Center - Update Cisco Nexus 1000v Service vmas are now configured to monitor traffic going through the Cisco Nexus 1000v switch. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 44

45 vma Deployment VMware Installation 6.x vmas are distributed using Open Virtualization Format (OVF) format. vmas are configured to monitor layer 2 traffic of the virtual switches on each host in the virtual infrastructure. There must be one vma deployed for each switch/host pair. That is, there must be one vma per host for each standard vswitch or dvswitch (distributed virtual switch)) or Cisco Nexus 1000 Swi tch. If you have not already downloaded the installation components, do that now. (See section "Obtain Installation Components") Extract the vma zip file (name form: vsec<product>_vagent_<relea se >- <build>.zip) to a location accessible to VMware vsphere Client. Deployment Steps 1) Locate the vma OVF template. This consists of the V-Agent.ovf, V-Agent.mf, and V-Agent - disk1.vmdk files. 2) Using vsphere Client, install the vma using the vsphere function: File Deploy OVF Template. 3) Review the OVF template details and click Next >. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 45

46 4) Review the End User License Agreement, and click Accept and Next. 5) Assign the vma virtual machine a name. Because most infrastructures will have multiple vmas Catbird recommends that you use a naming strategy that identifies the host and associated switch such as vma-host1-sw1 and so on. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 46

47 6) Assign the VM to a specific host. If installing to a Cluster, note that each vma must be assigned to a specific host and not subject to vmotion. Set the VMware DRS virtual machine settings to Manual or Disabled to keep vmas on the vswitch that they are protecting. 7) Use Network Mapping to assign the vma Source Network CC DMZ to the trunk/promiscuous switch previously created for the vma. a. If this vma will be targeted to a VMware standard or distributed virtual vswitch or dvswitch is in use, set VM Deployment Network Mapping to the Promiscuous Trunk previously created for that Port Group for that vswitch. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 47

48 b. If this vma will be targeted to a Cisco Nexus 1000v Switch: i. Set the Network Mapping destination to the previously created trunk/promiscuous vmservice-catbird-nx-trunk. ii. Add a second Network Adapter to the vma VM and change the Network label to vmservice-catbird-nx-span or vmservice-catbird-nx-span-2. The vma should be set up with 2 vnics as follows, in the following required order: Network Adapter 1 - vmservice-catbird-nx-trunk Network Adapter 2 - vmservice-catbird-nx-span Or Network Adapter 1 - vmservice-catbird-nx-trunk Network Adapter 2 - vmservice-catbird-nx-span-2 Each Span port group can be attached to up to 32 VMs. Recommended practice is to distribute the vmas equally to each of the Span groups. Note: These virtual Network Adapters are only available AFTER first correctly creating vma Port Groups. See Creating vma Port Groups Utilizing Cisco Nexus 1000v. 8) Review the VM Deployment Settings and click Finish. 9) Power on the vma Virtual Machine. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 48

49 vma Configuration VMware Installation 6.x Configure the vma via the VM Console: From VMware vsphere Client, open a console to the vma virtual machine. (Either Click the console tab, or highlight the VM, right click, and select 'Open Console'). You should see the Catbird "Text User Interface". This interface supports keyboard entry only (hit 'Enter' to enter a section, tab to move between sections). Fig vma Console 1) Configure the IP address, VLAN ID, and DNS information. vmas should be assigned a static address, either through the DHCP service or directly in this interface. Each vma will use its assigned IP / VLAN ID to communicate with the Catbird Control Center. a. Interfaces contains the IP4 and VLAN Id configuration items. A static address is recommended in most cases. Fig vma Console Configuration Fig vma Console - Interfaces - Network Configuration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 49

50 b. DNS: If the Domain Name Servers are not assigned through DHCP, Select Override DHCP and enter a primary and secondary DNS IP values. c. PKI: If the SSL Certificate has been obtained Fig vma Console - DNS Configuration directly from Catbird, this step may be skipped. The PKI interface is used to add a Certificate Authority (CA) or chain of CAs when a customer supplied SSL Certificate is used. (See: Getting Started: vma Configuration:Portal Manager and Catbird Portal Manager: Manage Server: Install Certificate ). A Certificate Authority identity or CA Chain list, in PEM 1 file format, must be provided to the vma in order to allow the vma to accept the Certificate. The vma will browse to the URL add the certificate to the trusted certificate chain. If there are intermediate CAs, they must also be added. A PEM file may contain multiple certificates. i. To initiate this sequence, navigate to the PKI box and select Add CA. ii. Enter a source URL in the form: http(s)://server/pem-filename and click OK. Fig Getting Started - CA - PKI The vma will now authenticate certificates created by this authority. 1 Priv acy Enhanced Mail, RFCs Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 50

51 Optional Advanced - Create an OVF Template For sites with large numbers of vmas to deploy, it can be more efficient to create a site-specific vma OVF template. This is best done before registering the vma with the Control Center and just after SSL binding. To bind without registering, first Register the vma to the Catbird Control Center with an incorrect username and password. This will complete the SSL handshake but will not register the agent. If the return message is invalid username or password, it is now ready to be made into a Tem plate. After deploying each additional site-specific vma, return to the IP address section, assign static IPs, and then Register each vma with the correct User and Password values. 2) Register the vma 2 The vma is ready to register to the Control Center. From the vma console, enter "Register". Enter the Catbird Control Center administrator account username and password previously created through in Portal Manager Account Management. (Use the Login value for the User field and not the Account Name.) Enter the Catbird Control Center's Fully Qualified Domain Name (FQDN) of the Catbird Control Center. Tab to OK and hit Enter. Fig vma Console - Registration Note: Make sure that there is network connectivity (via TCP Ports 443 and 8443) between deployed vmas and the Catbird Control Center. If there is a firewall between the vmas and Catbird Control Center, this port must be unblocked bi-directionally. See Routing and Required Connectivity. 2 If the SSL certificate was not yet installed to the Catbird Control Center, return to the Portal Manager, and install it now. (See Getting Started: vma Configuration: Portal Manager and Catbird Portal Manager: Manage Server: Install Certificate ) Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 51

52 When the vma is registered, it will confirm and change its status to 'registered' as shown below. Fig vma Console - Registration Complete Repeat these steps for each vma agent being deployed. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 52

53 Configure Catbird Services Once the Catbird Control Center and the vmas are deployed. Catbird Services should be configured and started via the Catbird Control Center web GUI. Cisco Nexus 1000v Service. If a Cisco Nexus 1000v is in use for distributed virtual switching, it should be installed and configured prior to vma deployment. This is normally done interleaved with vma deployment. See Getting Started:Creating vma Port Groups:Cisco Nexus 1000v Switch. [Required for Cisco Nexus 1000V Sites Only] Virtual Infrastructure Manager (VIM) Service to communicate with the VMware s vsphere s API. [Required] Network Access Control (NAC) Service to monitor and discover Assets using Address Resolution Protocol. [Required] Intrusion Protection System / Intrusion Detection System (IPS) Service used to monitor and control network activity based on IPS policies. This service is optional, and recommended. [Recommended] vshield App Service Used if the infrastructure includes the VMware vshield or vcloud Networking and Security (vcns) or the Network and Security component of vcloud Suite. The vshield App communicates and translates TrustZone information to VMware security components. [Required for VMware vshield Sites Only] VSG Service Used to coordinate TrustZone and Zone Access Control List rules with the Cisco Virtual Security Gateway [Required for Cisco VSG Sites Only] CEF Service -- The Common Event Format Service is the means of configuring use of an external CEF logging service. [Optional] Documentation for each of these services, along with configuration specifics can be found in the User Guide under Catbird Control Center - Services. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 53

54 Configure Cisco Virtual Security Gateway (VSG) for Nexus 1000v Series [Cisco VSG Sites Only] A summary of Cisco Virtual Services Architecture can be found in the of the Catbird Advanced Concepts document, under Design Guidelines:Control and Policy Scope:Cisco Virtual Infrastructure Networking Review. Full configuration and use of Cisco Virtual Network components is outside the scope of this User Guide. The system operator is assumed to have background and training in use of Cisco VSA installation and deployment. This guide will provide information on its use with Catbird only. Cisco Virtual Security Gateway (VSG) is one component in the Cisco Virtual Services Architecture. It functions as a Gateway Firewall and, within VMware, as an alternative to the VMware vshield. Cisco VSGs are administered through a Cisco Virtual Network Management Console (VNMC) 3. Configuring the Cisco VSG for use with Catbird is a multi -step process which can be done after Catbird Control Center and Catbird vmas have already be deployed, as needed, one vma to each switch per host. There are three basic steps to integrating Catbird with Cisco VSG in a VMware infrastructure: Step One is to create a Catbird-Set Access Control List (ACL) Policy Set via the Cisco VNMC. Step Two will create a new Catbird VSG Service within the Catbird Control Center, and assign to it a vma agent for communicating with the Cisco VSG. Catbird will then use the Cisco VNMC API to create and maintain Cisco trust zones and ACLs as defined by Catbird TrustZone ACLs. (ZACLs). Step Three will be to assign, via VNMC, Syslog logging back to the assigned Catbird vma. This allows Catbird to monitor both its own changes and changes made to the Catbird Policies from any other source. 3 Cisco Virtual Network Management Console (VNMC) product component was renamed Prime Network Services Controller (Prime NSC) by Cisco mid The earlier name is still in common use and remains on the web GUI interface. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 54

55 Create an ACL Policy Set at root named Catbird-Set. The Add ACL Policy Set can be found in VNMC under tabs Policy Management:Service Policies. The navigation tree on the left, under root can be expanded to display Policies ACL ACL Policy Sets. Right click on ACL Policy Sets, and click on Add ACL Policy Set to open the Add ACL Policy Set dialog. Fig VNMC - Add ACL Policy Set The new Policy Set must be named Catbird-Set. The Assigned list (on right) may stay empty. Catbird will later connect to VNMC via its API and create an ACL Policy named Catbird. It will use the Catbird ACL Policy to ACL rules corresponding to Catbird ZACL rules. Fig VNMC - Add ACL Policy Set Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 55

56 Fig VNMC Catbird-Set Policy Set Note that other ACL Policies may be added to Catbird-Set. Since Catbird will always force its own rules to be primary (most enforced) within the Catbird Policy, adding and using a second policy is one way to create and maintain a second parallel set of rules. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 56

57 Fig VNMC Catbird-Set Policy Set with Assigned Policies Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 57

58 Create a Catbird VSG service within the Catbird Control Center Catbird communicates with each Cisco VSG using via an assigned vma (agent). Catbird will then use the Cisco VNMC API to create and maintain Cisco trust zones and ACLs as defined by Catbird TrustZone ACLs. (ZACLs). Start by logging onto Catbird Control Center via the web GUI. Click add: New Service->Cisco VSG. Fig Add New Service Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 58

59 Provide the VNMC Hostname, using the IP4 address or FQDN of the VNMC. Enter login credentials for an account on the VNMC with AAA or admin rights. Select a vma (agent). This agent translates the Catbird ZACL rules and TrustZones to Cisco Policy ACLs and vzones, then pushes them to the Cisco Virtual Network Management Center (VNMC) which in turn pushes them to the appropriate Virtual Security Gateway (VSG) and on to the Nexus 1000V Series Switch. This agent also then serves as the Cisco VSG Syslog target. Fig Create Cisco VSG Service Create the Service, by clicking on the Create Cisco VSG button. Note the IP4 address of the assigned vma Agent. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 59

60 Create the VSG Syslog link back to Catbird Step three, is to identify, by IP4 Address, a Catbird vma agent to be used as a Syslog target. Each VSG must provide status information via Syslog stream back to a Catbird vma which then aggregates the information and forwards it back to the Catbird Control Center. VNMC Syslog configuration can be done for each Cisco Virtual Service Node (VSN) device (ie each VSG, ASA or other device) or can be done for all devices at the root using the default Syslog Service configuration. Catbird only requires that this be done for the VSGs in use in the Catbird controlled infrastructure. The screenshots below demonstrate using the default Syslog Service, which then is used if no other Syslog is explicitly assigned to the VSN. Navigate to Policy Management:Device Configurations, open the Policies node, and click on the Syslog Policy. The default Syslog Service definition should be listed in the main panel. Right click on default to open the Edit option. Fig VNMC Policy Management Device Configuration - Syslog Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 60

61 In the Edit window, click on "Servers tab. If There is already a primary Syslog server, it can be edited by right-clicking on the primary. Otherwise add one. In the Hostname/ IP Address field Use the IP4 address of the vma agent selected above. Set the Severity to be Information(6), forwarding facility to be local0, port to be 514, and protocol to UDP. Admin State should be disabled. Fig VNMC Edit Syslog Client Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 61

62 VM Console Reference VMware Installation 6.x The Catbird Control Center and each vma virtual machines consoles can be viewed directly using a VMware open console function. The consoles provide a limited TUI (Textual User Interface). Navigate consoles using the left and right arrow keys, space key to select/deselect options, and the return/enter key to select a menu item. Catbird Control Center Console The Catbird Control Center console allows you to view and modify the network configuration of the Control Center, as well as perform a connectivity test to the Catbird update server. Main menu: Configuration: Test Connectivity: Status: Enter the Configuration menu. Perform a connectivity test to frontier.catbird.com. Display current network configuration. Fig vma Main Console Configuration menu: Interfaces: DNS: SMTP: Back: Enter the Network Configuration page. Enter the DNS Configuration page. Enter the SMTP Configuration page. Go back to the main menu. Fig vma Configuration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 62

63 Interfaces (Network Configuration) menu: Use DHCP: Use DCHP (if selected) Static IP Static IP4 address Netmask Netmask in 4 octet IP4 format Default Gateway IP default gateway (IP4) DNS Configuration: Option to override DHCP assigned DNS values and assign Primary and Secondary DNS servers. SMTP Configuration: Option to set SMTP relay. Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 63

64 vma Console The Catbird vma console is used to view and modify the network configuration of the vma, as well as perform a connectivity test to the Control Center once it has been registered. Main menu: Configuration: Status: select to set network configuration. displays the current network configuration. (before successful registration) Register: displays a dialog for register the vma to a Control Center. Once the vma agent has been successfully registered, that status is shown in the console, and the menu changes. The Register button is replaced with a Test Connectivity button. (after successful registration) Test Connectiv ity- perform a connectivity test to the Control Center. Fig vma Console - Pre Registration Fig vma Console - Post Registration Doc Rev Catbird Networks, Inc. All Rights Reserved - - page 64