Cisco Stealthwatch User manual

Cisco Stealthwatch
Data Store Hardware Deployment and Configuration Guide 7.3.2

Table of Contents
Data Store Installation and Configuration Introduction 5
Overview 5
Audience 5
How to Use This Guide 5
Data Store Concepts and Architecture 7
Data Store Deployment Prerequisites and Recommendations 13
Stealthwatch Version Support 13
Stealthwatch Licensing 13
Stealthwatch Hardware Compatibility and Networking Requirements 13
Stealthwatch Management Console VE 15
Data Store Deployment Required Credentials 15
Data Store Networking and Switching Considerations 15
Data Store Deployment Requirements and Considerations 20
Data Store Communications Ports 21
Stealthwatch with a Data Store Deployment Overview 25
Data Store Installation 26
Stealthwatch Hardware Deployment and Considerations 26
SMC Configuration for Use with a Data Store 26
Data Store Initial Deployment and Configuration 27
Flow Collector Configuration for Use with a Data Store 29
Data Store Initialization and Configuration 30
UDPDirector (Optional)Deployment 33
Flow Sensor (Optional)Deployment 33
Failover Stealthwatch Management Console (Optional)Deployment 33
Flow Interface Statistics Retention Configuration 34
Data Store Installation Next Steps 40
Data Store Maintenance 41
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 2 -

Restart a Data Node 41
Restart the Data Store 42
Creating a Data Store Backup 43
Restoring a Data Store Backup 48
Adding Three Data Nodes to the Data Store 50
Preparing the Data Store for Adding Data Nodes and Rebalancing 50
Adding Data Nodes to the Data Store 51
Removing a Data Node from the Data Store 52
Replace a Data Node with a Spare Data Node with a Different IPAddress 53
Preparing the Data Store for Replacing a Failed Data Node 53
Replace the Data Node 53
Adding SMCs and Flow Collectors after you Initialize the Data Store 55
Data Store Deployment Troubleshooting 57
Hardware Deployment Troubleshooting 57
Data Store Troubleshooting 57
Appendix A.Installation Preparation 60
Installation Warnings 60
Installation Guidelines 62
Safety Recommendations 64
Maintain Safety with Electricity 64
Prevent ESD Damage 65
Site Environment 65
Power Supply Considerations 65
Rack Configuration Considerations 66
Appendix B.Stealthwatch Hardware Installation 67
Mounting Your Appliance 67
Hardware Included with the Appliance 67
Additional Required Hardware 67
Connecting Your Appliance to the Network 68
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 3 -

Connecting to Your Appliance 70
Connecting with a Keyboard and a Monitor 70
Connecting with a Laptop 71
Configuring Network Settings Using First Time Setup 72
General Stealthwatch Appliance Configuration 72
Data Store-Compatible Appliances (SMC 2210, FC 4210) 74
Data Node Configuration 78
Changing the Sysadmin User Password 82
Changing the Root User Password 82
Appendix C. Configuring Your Appliances 84
Appliance Setup Tool Requirements 84
Managed 84
SMC Failover 84
Best Practices 84
Configuration Order 85
1. Log In 86
2. Configure the Appliance 86
3. Register the Stealthwatch Management Console 88
4. Add Appliances to Central Management 89
5. Confirm Appliance Status 90
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 4 -

Data Store Installation and Configuration
Introduction
Overview
This guide explains how to install the Stealthwatch Data Store as part of a Stealthwatch
System deployment. It describes the Stealthwatch System components and how they
are placed in the system, especially in relation to the Data Store.
This chapter includes the following topics:
lAudience
lHow to Use This Guide
Audience
This guide is designed for the person responsible for installing Stealthwatch system
hardware. We assume that you already have some general understanding of installing
hardware network equipment (Flow Collector and the Stealthwatch Management
Console).
For information on configuring Stealthwatch products, please refer to the Stealthwatch
System Configuration Guide.
How to Use This Guide
In addition to this introduction, we have divided this guide into the following chapters:
Chapter Description
Data Store Concepts and
Architecture
Describes basic concepts underpinning the Data
Store database, and basic architecture related to
Data Store deployment in relation to an SMCand
Flow Collectors.
Data Store Deployment
Prerequisites and
Recommendations
Describes Stealthwatch appliances compatible
with the Data Store, and provides requirements
and recommendations for deploying your Data
Store, including communication ports to open.
Stealthwatch with a Data Provides a high-level overview of deploying
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 5 -
Data Store Installation and Configuration Introduction

Chapter Description
Store Deployment Overview Stealthwatch appliances for use with a Data Store.
Data Store Installation
Provides an end-to-end overview of deploying
Stealthwatch appliances for use with a Data Store,
and configuration instructions to initialize the Data
Store database.
Flow Interface Statistics
Retention Configuration
Provides information on configuring Data Store
flow interface statistics data retention period.
Data Store Installation Next
Steps
Describes the next steps after you finish deploying
and configuring your Data Store.
Data Store Maintenance Describes Data Store maintenance tasks.
Data Store Deployment
Troubleshooting
Describes common issues seen during the Data
Store installation process, and suggested
solutions.
Appendix A.Installation
Preparation Provides warnings for installing hardware.
Appendix B.Stealthwatch
Hardware Installation
Provides an overview for installing Stealthwatch
appliances and performing initial configuration to
assign an IPaddress and other related
management information.
Appendix C. Configuring Your
Appliances
Provides an overview for using Appliance Setup
Tool to configure your Stealthwatch appliances.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 6 -
Data Store Installation and Configuration Introduction

Data Store Concepts and Architecture
The Stealthwatch Data Store provides a central repository to store your network's
telemetry, collected by your Stealthwatch Flow Collectors. The Data Store is comprised
of a cluster of Data Nodes, each containing a portion of your data, and a backup of a
separate Data Node's data. Because all of your data is in one centralized database, as
opposed to spread across multiple Flow Collectors, your Stealthwatch Management
Console can retrieve query results from the Data Store more quickly than if it queried all
of your Flow Collectors separately. The Data Store cluster provides improved fault
tolerance, improved query response, and quicker graph and chart population.
Data Store Storage and Fault Tolerance
The Data Store collects data from Flow Collectors and distributes it equally across Data
Nodes within the cluster. Each Data Node, in addition to storing a portion of your overall
telemetry, also stores a backup of another Data Node's telemetry. Storing data in this
fashion:
lhelps with load balancing
ldistributes processing across each node
lensures all data ingested into the Data Store has a backup for fault tolerance
lallows for increasing the number of Data Nodes to improve overall storage and
query performance
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 7 -
Data Store Concepts and Architecture

If a node goes down, as long as the node containing its backup is still available, and at
least half of your total number of Data Nodes are still up, the overall Data Store remains
up. This allows you time to repair the downed connection or faulty hardware; after you
replace the faulty Data Node, the Data Store restores that node's data from the existing
backup stored on the adjacent Data Node, and creates a backup of data on that Data
Node. See the following diagram for an example of how Data Nodes store telemetry:
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 8 -
Data Store Concepts and Architecture

Stealthwatch Data Store Deployment Architecture
In a Stealthwatch deployment without a Data Store, one or more Flow Collectors ingests
and deduplicates data, performs analysis, and reports data and results directly to the
SMC. To resolve user-submitted queries, including graphs and charts, the SMCqueries
all of the managed Flow Collectors. Each Flow Collector returns matching results to the
SMC. The SMC collates the information from the different result sets, then generates a
graph or chart displaying the results. In this deployment, each Flow Collector stores data
on a local database. See the following diagram for an example.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 9 -
Data Store Concepts and Architecture

In a Stealthwatch deployment with a Data Store, the Data Store cluster sits between
your SMC and Flow Collectors. One or more Flow Collectors ingests and deduplicates
flows, performs analysis, and reports data and results directly to the Data Store,
distributing it roughly equally to all of the Data Nodes. The Data Store facilitates data
storage, keeps all of your traffic in that centralized location as opposed to spread across
multiple Flow Collectors, and offers greater storage capacity than multiple Flow
Collectors. See the following diagram for an example.
To resolve user-submitted queries, including graphs and charts, the SMCqueries the
Data Store. The Data Store finds matching results in the columns relevant to the query,
then retrieves the matching rows and returns the query results to the SMC. The SMC
generates the graph or chart without needing to collate multiple result sets from multiple
Flow Collectors. This reduces the cost of querying, as compared to querying multiple
Flow Collectors, and improves query performance.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 10 -
Data Store Concepts and Architecture

Stealthwatch Enterprise Deployment Considerations
Note the following:
lIf you configure a Flow Collector for for use with a Data Store, the Appliance
Administration interface (Appliance Admin) hides certain functionality. Use Central
Management to perform Flow Collector configuration and other related tasks. If
you want to monitor storage statistics, download the Report Builder app to your
SMC.
lUse the Stealthwatch Web App to monitor and configure your Stealthwatch
installation if you deploy a Data Store. The Stealthwatch Desktop Client is
incompatible with a Data Store.
lIf you configure your SMCfor use with a Data Store, you cannot use the
ETACryptographic Audit or Host Classifier apps.
lBecause of the Data Store architecture, the SMCand all Flow Collectors must
communicate with the Data Store, and must be configured during deployment to
work with the Data Store. You cannot configure some Flow Collectors to work
without a Data Store, and other Flow Collectors to work with a Data Store.
lYou can deploy a hardware Data Store (DS 6200) with 3 hardware Data Nodes
alongside a hardware SMC and hardware Flow Collectors. You cannot deploy a
hardware Data Store with virtual appliances, nor can you deploy a virtual Data Store
with hardware appliances.
Stealthwatch Data Store Architecture
Each Data Store is comprised of 3 or more Data Nodes. Each hardware Data Node is its
own chassis. When you purchase a hardware Data Store, you receive multiple Data
Node hardware chassis, corresponding to the number of nodes indicated by that Data
Store model. For example, a DS 6200 Data Store provides 3 Data Node hardware
chassis.
You can purchase more than one Data Store for your deployment. The Data Nodes can
be clustered as part of your Data Store in mulitples of 3, from a minimum of 3 to a
maximum of 36.
Cisco recommends that you configure your Data Nodes so that adjacent-
numbered Data Nodes are powered with separate, redundant power supplies.
This configuration improves data redundancy and overall Data Store uptime.
See Data Store Deployment Requirements and Considerations for more
information.
To deploy a Data Store, you must assign the following for each Data Node:
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 11 -
Data Store Concepts and Architecture

la routable IPaddress for management, ingest, and query communications with
your Stealthwatch appliances
la non-routable IPaddress (169.254.42.0/24 CIDRblock) on either an isolated
LANor VLAN for communications between and among the Data Nodes as part of
the Data Store cluster
ltwo 10G network connections, one for the management, ingest, and query
communications, one for the inter-Data Node communications
loptionally on hardware Data Nodes only, for network redundancy and criticality of
the inter-Data Node communications, an additional 10G connection, and an
additional switch for establishing a port channel on the Data Node
See Data Store Deployment Requirements and Considerations for more detailed
information on deployment and deployment prerequisites.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 12 -
Data Store Concepts and Architecture

Data Store Deployment Prerequisites and
Recommendations
The following describes prerequisite information and recommendations for your Data
Store deployment.
Stealthwatch Version Support
When deploying Stealthwatch with a Data Store, all of your Stealthwatch appliances
must be on the same version (7.3.x). The latest available version of 7.3.x is 7.3.2.
Stealthwatch Licensing
Your Stealthwatch deployment requires a Flow Rate (FPS)Smart License; the Data Store
itself does not require an additional license.
If you deploy an SMC VE, when you register your account with software.cisco.com, you
receive a license for the SMC VE.
Stealthwatch Hardware Compatibility and Networking
Requirements
The following table provides an overview for the hardware required to deploy
Stealthwatch with a hardware Data Store.
Hardware Component Supported Capacity
Data Store
lMinimum of 3 Data Nodes (DS 6200)
lAdditional sets of 3 Data Nodes to expand the Data
Store, maximum of 36 Data Nodes
Stealthwatch
Management Console lMinimum of 1 Stealthwatch Management Console
Flow Collector lMinimum of 1 Flow Collector
Note that you must obtain a Flow Rate (FPS) Smart License for your overall Stealthwatch
deployment.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 13 -
Data Store Deployment Prerequisites and Recommendations

Do not update the appliance BIOS, as it may cause issues with appliance
functionality.
If you want to deploy a Data Store, you must have at least 3 Data Nodes. A Data Store
6200 with 3 Data Nodes can handle roughly 500,000 flows per second, and retain that
data for roughly 90 days. You can extend your Data Store with additional Data Nodes in
multiples of 3, up to a maximum of 36 Data Nodes.
These recommendations consider only telemetry. Your performance may vary
depending on additional factors, including host count, flow sensor use, traffic
profiles, and other network characteristics. Contact Cisco Support for
assistance with sizing.
Currently, the Data Store does not support deploying spare Data Nodes as
automatic replacements if a primary Data Node goes down. Contact Cisco
Support for guidance.
You must deploy an SMC with your Data Store, and configure it for use with a Data
Store. If you want high availability for your SMC, you can also deploy a failover SMC.
In addition, you must deploy at least 1 Flow Collector with your Data Store, and
configure the Flow Collectors for use with a Data Store.
For each SMCand Flow Collector that you deploy, you must assign a public routable
IPaddress to the eth0 management port. When deploying a Data Store, you can
configure the use of a BASE-T copper 1G/10Gport or SFP+ twinax cable 10Gport for
the SMC and Flow Collector eth0 management port. Cisco requires 10Gthroughput for
the BASE-Tcopper port for Data Store use. Users not deploying a Data Store can only
configure the 100Mbps/1Gbps/10 Gbps copper interface as eth0.
You can also deploy Flow Sensors and UDPDirectors for your Stealthwatch deployment.
Because these appliances do not communicate directly with the Data Store, you do not
need to configure them for use with a Data Store.
See the relevant Specification Sheets for more information on the supported platforms.
See the Stealthwatch Hardware and Software Version Compatibility Matrix for more
information on version compatibility.
The Data Store supports Flow Sensors and UDPDirectors in v7.3.1 or v7.3.2. You are
not required to deploy either with a Data Store. If you add an appliance to your cluster,
make sure your appliances all have the same version installed.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 14 -
Data Store Deployment Prerequisites and Recommendations

Stealthwatch Management Console VE
lwill store flows for 90 days, and
lyou have 3 Data Nodes
l7200 GB / 3 Data Nodes = 2400 GB (2.4 TB)per Data Node
Data Store Deployment Required Credentials
Prepare passwords for the following user accounts:
lroot and sysadmin for each SMC, Data Node, and Flow Collector. You assign
these during initial system configuration.
ladmin for each SMC, Data Node, and Flow Collector. You assign these using
Appliance Setup Tool.
ldbadmin and readonlyuser for the Data Store. You assign these when
initializing the Data Store.
Data Store Networking and Switching Considerations
The following table provides an overview for the networking and switching
considerations when deploying Stealthwatch with a Data Store.
Network
Consideration Description
Necessary
Credentials
For each Data Node, Stealthwatch Management Console, and
Flow Collector:
lConfigured during initial System Configuration: root,
sysadmin
lConfigured using Appliance Setup Tool: admin
Configured during Data Store initialization:dbadmin,
readonlyuser
Inter-Data Node
Communications
lEstablish a recommended round-trip time (RTT)latency of
under 200 microsecondsbetween and among Data Nodes
lKeep clock skew at 1 second or lower between and among
your Data Nodes.
lEstablish a recommended throughput of 6.4Gbps or greater
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 15 -
Data Store Deployment Prerequisites and Recommendations

(10 Gbps full duplex switched connection) between and
among your Data Nodes.
Data Node
Hardware Power
lIf a hardware Data Node loses power unexpectedly, the data
can be corrupted. Use both power supplies on separate
circuits from uninterruptible power supplies.
lWhen you initialize the Data Store cluster (see Data Store
Initialization and Configuration for more information),
alternate Data Node configuration based on the power
supplies that each Data Node uses. This can optimize fault
tolerance by minimizing the number of Data Nodes that go
down if power is lost.
Data Node
Switching
lData Nodes require their own Layer 2 VLAN to allow inter-
Data Node communication. Hardware Data Nodes can be
connected to a shared or dedicated 10G switch.
lCisco recommends that hardware Data Nodes be connected
to 2 switches to help ensure constant connectivity during
switch outages and upgrades. Due to the low latency
required for inter-Data Node communication, Cisco
recommends a redundant pair of switches, where the 2
switches are interconnected and carry the Layer 2 VLAN
across both switches.
Stealthwatch
Appliance
Communications
lSSHand SSHroot access required for SMC, Data Nodes,
and Flow Collectors, and configured from the SMC
lSMCand Flow Collectors must be able to reach all Data
Nodes
lData Nodes must be able to reach SMC, all Flow Collectors,
and each Data Node
Note that you must obtain a Flow Rate (FPS) Smart License for your overall Stealthwatch
deployment.
Currently, the Data Store does not support deploying spare Data Nodes as
automatic replacements if a primary Data Node goes down. Contact Cisco
Support for guidance.
You must assign the following IP addresses to each Data Node:
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 16 -
Data Store Deployment Prerequisites and Recommendations

la routable IPaddress for communication with your Stealthwatch appliances
(eth0). Connect the Data Node eth0 port to your network to allow
communication with your SMC and Flow Collectors. You can configure the use of a
BASE-T copper 1G/10Gport or SFP+ twinax cable 10Gport for theData Node
eth0 management port.
During Data Store deployment and configuration, you map the Data Node eth0
IPaddresses to the Data Store name to allow more even distribution of telemetry
storage and query request and response. See Data Store Database Initialization
and Configuration for more information.
la non-routable IPaddress within a private LANor VLAN, to be used for inter-Data
Node communication (eth2, or port channel containing eth2 and eth3 for
improved throughput and performance). Connect the Data Node eth2 port or port
channel containing eth2 and eth3 to the switches for inter-Data Node
communication. As part of the Data Store, your Data Nodes communicate between
and among each other.
You must assign the non-routable IPaddresses from the
169.254.42.0/24 CIDRblock.
For hardware Data Nodes, configuring an eth2 port for 10G throughput is
sufficient for normal inter-Data Node communication. Creating an eth2/eth3
port channel for up to 20G throughput enables faster communication between and
among Data Nodes, and quicker Data Node addition or replacement to the Data
Store, as each new Data Node receives traffic from adjacent Data Nodes to
populate its data.
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 17 -
Data Store Deployment Prerequisites and Recommendations

To enable inter-Data Node communications over eth2 or the eth2/eth3 port channel,
you must deploy 1 switch that supports 10G speeds. Configure a public LAN or VLANfor
Data Nodes eth0 communications with the SMCand Flow Collectors, and an isolated
LANor VLANfor inter-Data Node communications. You can share these switches with
other appliances, but create separate LANs or VLANs for the additional appliance traffic.
See the following diagram for an example:
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 18 -
Data Store Deployment Prerequisites and Recommendations

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 19 -
Data Store Deployment Prerequisites and Recommendations

The Data Store cluster requires a continuous heartbeat between nodes within the
isolated VLAN. Without this heartbeat, Data Nodes may potentially go offline, which
increases the risk of the Data Store going down. If you want additional network
redundancy, for planning around switch updates and planned outage, Cisco
recommends that you configure your Data Nodes with port channels for dedicated inter-
Data Node communication. Connect every Data Node to 2 switches, with each physical
port connected to a different switch. See the following diagram for an example:
Contact Cisco Professional Services for assistance with planning your
deployment.
Data Store Deployment Requirements and Considerations
Place each Data Node so that it can communicate with all of your Flow Collectors, your
SMC, and every other Data Node. For best performance, colocate your Data Nodes and
Flow Collectors to minimize communication latency, and Data Nodes and SMCfor
optimum query performance. Cisco highly recommends placing the Data Nodes within
your firewall, such as within a NOC.
If the Data Store goes down due to loss of power or hardware failure, you run an
increased risk of data corruption and data loss. Cisco recommends installing your Data
Nodes with constant uptime in mind.
If a Data Node loses power unexpectedly, and you reboot the appliance, the
database instance on that Data Node may not automatically restart. See Data
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 20 -
Data Store Deployment Prerequisites and Recommendations