Lancope StealthWatch System Manual

StealthWatch® System Hardware
Installation Guide
(for StealthWatch System v6.7.0)

Back
Installation Guide: StealthWatch System v6.7.0 Hardware
© 2015 Lancope, Inc. All rights reserved.
Document Date: March 19, 2015
Trademarks
Lancope, StealthWatch, and other trademarks are registered or unregistered trademarks of Lancope, Inc. All
other trademarks are properties of their respective owners.

Contents iii
CONTENTS
1-INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
How to Use This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Documentation Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Common Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Other Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
NetFlow Ninjas Blog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
StealthWatch Video Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Contacting Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Document Feedback. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2-PRE-CONFIGURATION CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . 9
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
StealthWatch Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
StealthWatch Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
FlowCollector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
FlowSensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
UDP Director (also known as FlowReplicator) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Identity Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Placement Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Placing the SMC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Placing the StealthWatch FlowCollector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Placing the StealthWatch FlowSensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Placing Other StealthWatch Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Configuring Your Firewall for Communications . . . . . . . . . . . . . . . . . . . . 14
Communication Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Integrating the FlowSensor into Your Network . . . . . . . . . . . . . . . . . . . . 17
TAPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Using Electrical TAPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Using Optical TAPs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Using TAPs Outside Your Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Placing the FlowSensor Inside Your Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
SPAN Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3-INSTALLATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

iv Contents
Mounting the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Hardware Included with the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Additional Required Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
FlowCollector 5000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Changing the Default User Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Connecting to the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Connecting with a Keyboard and a Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Connecting with a Laptop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Changing the Default IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Change the sysadmin User Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Change the root User Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Connecting the Appliance to the Network . . . . . . . . . . . . . . . . . . . . . . . . 38
Types of Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
SMCs 1000 & 2000 and FlowCollectors 1000 & 2000 . . . . . . . . . . . . . . . . . . . . . 38
UDP Director 2000, FlowSensors 2000 and 3000 . . . . . . . . . . . . . . . . . . . . . . . . 39
FlowSensor 4000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
FlowCollector 4000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
FlowCollector 5000 Engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
FlowCollector 5000 Database. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
FlowSensor 250 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
FlowSensor 1000 and UDP Director (also known as FlowReplicator) 1000. . . . . 41
SMC 1010, FlowCollectors 1010 & 4010, FlowSensors 2010, 3010, 4010 and 
UDP Director 2010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
FlowSensor 1010 and UDP Director 1010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
SMC 2010 and FlowCollector 2010 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Connecting to the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Introduction 5
INTRODUCTION
OVERVIEW
This guide explains how to install StealthWatch System products. It describes the
StealthWatch System components and how they are placed in the system, including
the integration of the FlowSensors. Also, this guide describes the mounting and
installation of the StealthWatch System hardware.
This chapter includes the following topics:
Audience
How to Use This Guide
Documentation Icons
Common Abbreviations
Other Resources
Audience
This guide is designed for the person responsible for installing StealthWatch system
hardware. We assume that you already have some general understanding of installing
network equipment (FlowSensor, FlowCollector, UDP Director (also known as
FlowReplicator), and the StealthWatch Management Console).
For information on configuring StealthWatch System products, please refer to the
StealthWatch System Hardware Configuration Guide.

6Introduction
How to Use This Guide
In addition to this introduction, we have divided this guide into the following chapters,
as well as an index:
Documentation Icons
This guide uses the following documentation icons:
Chapter Description
2 - Pre-Configuration
Considerations
Describes the StealthWatch system components and
their placement and the configuration of the firewall
for communications
3 - Installation Describes the mounting and installation of
StealthWatch hardware
Icon Meaning Description
Note Additional information you may find useful
Tip Helpful information, such as shortcuts or easier ways of
performing certain tasks
Important Information you must observe to prevent significant
consequences, such as the malfunction of software
Caution Information you must observe to prevent loss of data or
damage to hardware
Warning Information you must observe to prevent risk of personal
injury

Introduction 7
Common Abbreviations
The following abbreviations appear in this guide:
Abbreviation Description
AC Alternation Current
DMZ Demilitarized Zone (a perimeter network)
DNS Domain Name Server/Service
FC FlowCollector
FS FlowSensor
FTP File Transfer Protocol
HTTPS Hypertext Transfer Protocol (Secure)
Hz Hertz
IP Internet Protocol
ISE Identity Services Engine
Mbps Megabits per second
ms Milliseconds
NAT Network Address Translation
NIC Network Interface Card
NTP Network Time Protocol
PCIe Peripheral Component Interconnect Express
SCP Secure Copy
SMC StealthWatch Management Console
SNMP Simple Network Management Protocol
SPAN Switch Port Analyzer
SSH Secure Shell
TAP Test Access Port
UPS Uninterruptible Power Supply
URL Universal Resource Locator
USB Universal Serial Bus
VLAN Virtual Local Area Network

8Introduction
Other Resources
In addition to this guide, you may find these documents and online resources useful.
Related Documents
Please refer to your StealthWatch System Documentation CD for information about
StealthWatch appliances and their installation and configuration. Except for the online
Help,
Additional information is available in the StealthWatch User Community section of
the Lancope Web site (https://community.lancope.com/). If you do not have login
access to the User Community, send an Email requesting access to
[email protected]m.
NetFlow Ninjas Blog
Lancope’s NetFlow Ninjas blog (http://www.lancope.com/blog) provides a wealth of
information about NetFlow, the NetFlow industry, and new StealthWatch features, as
well as tips and tricks on using StealthWatch.
StealthWatch Video Library
The StealthWatch online video library (http://www.lancope.com/resource-center/
videos) showcases the benefits of StealthWatch for network performance and security
management.
Contacting Support
If you need technical support, please do one of the following:
Contact your local Lancope partner.
Call [phone].
Send an Email to [email protected].
Submit a case using the Support form on the Lancope Customer Community
web site (https://community.lancope.com).
Document Feedback
If you have comments about this document, please contact Lancope at
[email protected]m. We appreciate your feedback.

Pre-Configuration Considerations 9
PRE-CONFIGURATION
CONSIDERATIONS
OVERVIEW
This chapter examines the considerations you should make before installing and
configuring your StealthWatch appliances. It explains where to place StealthWatch
system products and how to integrate them into your network.
This chapter includes the following topics.
StealthWatch Components
Placement Considerations
Configuring Your Firewall for Communications
Integrating the FlowSensor into Your Network
2

10 Pre-Configuration Considerations
STEALTHWATCH COMPONENTS
The StealthWatch system is made up of several hardware components that gather,
analyze, and present information about your network to improve network performance
and security. This section describes the major StealthWatch components.
StealthWatch Management Console
The StealthWatch Management Console (SMC) is the control center for
StealthWatch. It manages, coordinates, configures, and organizes all of the different
components of the system. The SMC client software allows you to access the SMC’s
user-friendly graphical user interface (GUI) from any local computer with access to a
Web browser. Through the client GUI, you can easily access real-time security and
network information about critical segments throughout your enterprise.
Featuring Java-based platform independence, the SMC enables:
Centralized management, configuration, and reporting for up to 25
StealthWatch FlowCollectors
Graphical charts for visualizing traffic
Drill-down analysis for troubleshooting
Consolidated and customizable reports
Trend analysis
Performance monitoring
Immediate notification of security breaches
FlowCollector
The StealthWatch FlowCollector for NetFlow gathers NetFlow, cFlow, J-Flow,
Packeteer 2, NetStream, and IPFIX data to provide cost-effective, behavior-based
network protection.
The FlowCollector aggregates high-speed network behavior data from multiple
networks or network segments to deliver end-to-end protection and improve
performance across geographically dispersed networks.
As the FlowCollector receives data, it identifies known or unknown attacks, internal
misuse, or misconfigured network devices, regardless of packet encryption or
fragmentation. Once StealthWatch identifies the behavior, the system can take any
action you have configured it to take, if any, for that kind of behavior.

Pre-Configuration Considerations 11
FlowSensors
The StealthWatch FlowSensor is a network appliance that operates similarly to a
traditional packet capture appliance or IDS in that it plugs into a switch port analyzer
(SPAN), mirror port, or Ethernet test access port (TAP). The FlowSensor augments
visibility into the following network areas:
Where NetFlow is not available.
Where NetFlow is available, but you want deeper visibility into
performance metrics and packet data.
By directing the FlowSensor toward any NetFlow v9-capable flow collector you can
derive valuable detailed traffic statistics from NetFlow. When combined with the
StealthWatch FlowCollector for NetFlow, the FlowSensor also provides deep insight
into performance metrics and behavioral indicators. These flow performance
indicators provide insight into any round-trip latency introduced by the network or by
the server-side application.
Because the FlowSensor has packet-level visibility, it can calculate round-trip time
(RTT), server response time (SRT), and packet loss for TCP sessions. It includes all of
these additional fields in the NetFlow records that it sends to the StealthWatch
FlowCollector for NetFlow.
UDP Director (also known as FlowReplicator)
The StealthWatch UDP Director (also known as FlowReplicator) is a high-speed,
high-performance UDP packet replicator. The UDP Director s very helpful in
redistributing NetFlow, sFlow, syslog, or Simple Network Management Protocol
(SNMP) traps to various collectors. It can receive data from any connectionless UDP
application and then retransmit it to multiple destinations, duplicating the data if
required.
Identity Devices
The StealthWatch system includes identity devices such as the StealthWatch IDentity
appliance and the Cisco ISE (Identity Services Engine). These devices map IP
addresses to user names by passively pulling user authentication information from
user identity databases. The SMC seamlessly manages multiple identity appliances.
For information on the installation of StealthWatch IDentity, see its accompanying
CD.
Note:
When you use the UDP Director High Availability (HA) configuration (failover),
you must connect two UDP Directors with crossover cables. For specific
instructions, see “Connecting to the Network” on page 43.

12 Pre-Configuration Considerations
PLACEMENT CONSIDERATIONS
As shown in the figure below, StealthWatch system products can be strategically
deployed to provide optimal coverage of key network segments throughout the
network, whether in the internal network, at the perimeter, or in the DMZ.
Placing the SMC
As the management device, the StealthWatch Management Console (SMC) should be
installed at a location on your network that is accessible to all the devices sending data
to it.
If you have a failover pair of SMCs, it is recommended that you install the primary
SMC and the secondary SMC in separate physical locations. This strategy will enhance
a disaster recovery effort should it become necessary.

Pre-Configuration Considerations 13
Placing the StealthWatch FlowCollector
As collection and monitoring devices, the StealthWatch FlowCollector for NetFlow
appliance and the StealthWatch FlowCollector for sFlow appliance should be installed
at a location on your network that is accessible to the NetFlow or sFlow devices
sending the data to a FlowCollector, as well as any devices you plan to use to access
the management interface.
Placing the StealthWatch FlowSensor
As a passive monitoring device, the StealthWatch FlowSensor can sit at multiple
points on your network to observe and record IP activity, thereby protecting network
integrity and detecting security breaches. The FlowSensor features integrated Web-
based management systems that facilitate either centralized or remote management and
administration.
The FlowSensor appliance is most effective when placed at critical segments of your
corporate network as follows:
Inside your firewall to monitor traffic and determine if a firewall breach has
occurred
Outside your firewall, monitoring traffic flow to analyze who is threatening
your firewall
At sensitive segments of your network, offering protection from disgruntled
employees or hackers with root access
At remote office locations that constitute vulnerable network extensions
On your business network for protocol use management (for example, on
your transaction services subnet to determine if a hacker is running Telnet or
FTP and compromising your customers' financial data)
Placing Other StealthWatch Products
The only requirement for the placement of other StealthWatch products, such as the
StealthWatch UDP Director (also known as FlowReplicator), the StealthWatch IDen-
tity appliance, or a VM server containing a StealthWatch FlowSensor Virtual Edition
(VE), is that they have an unobstructed communication path to the rest of your Stealth-
Watch products as applicable.
Note:
When you place a FlowCollector outside a firewall, Lancope recommends that
you turn off the setting “Accept traffic from any exporter.”

14 Pre-Configuration Considerations
CONFIGURING YOUR FIREWALL 
FOR COMMUNICATIONS
In order for the appliances to communicate properly, you should configure the network
so that firewalls or access control lists do not block the required connections. Use the
diagram and tables shown in this section to configure your network so that the appli-
ances can communicate through the network.
Consult with your network administrator to ensure that the following ports are open
and have unrestricted access:
TCP 22
TCP 25
TCP 389
TCP 443
TCP 2393
UDP 53
UDP 123
UDP 161
UDP 162
UDP389
UDP 514
UDP 2055
UDP 3514
UDP 6343
Communication Ports
The following table shows how the ports are used in the StealthWatch system:
From (Client) To (Server) Port Protocol
Admin User PC All appliances TCP/443 HTTPS
All appliances Network time
source
UDP/123 NTP
Active Directory SMC TCP/389,
UDP/389
LDAP
Cisco ISE SMC TCP/443 HTTPS
- continued -

Pre-Configuration Considerations 15
*This is the default port, but any UDP port could be configured on the exporter.
The following table is for optional configurations determined by your network needs:
Cisco ISE SMC UDP/3514 SYSLOG
External log
sources
SMC UDP/514 SYSLOG
FlowCollector SMC TCP/443 HTTPS
UDP Director (also
known as
FlowReplicator)
FlowCollector -
sFlow
UDP/6343 sFlow
UDP Director (also
known as
FlowReplicator)
FlowCollector -
NetFlow
UDP/2055* NetFlow
UDP Director (also
known as
FlowReplicator)
3rd Party event
management
systems
UDP/514 SYSLOG
FlowSensor SMC TCP/443 HTTPS
FlowSensor FlowCollector -
NetFlow
UDP/2055 NetFlow
IDentity SMC TCP/2393 SSL
NetFlow Exporters FlowCollector -
NetFlow
UDP/2055* NetFlow
sFlow Exporters FlowCollector -
sFlow
UDP/6343* sFlow
SMC Cisco ISE TCP/443 HTTPS
SMC DNS UDP/53 DNS
SMC FlowCollector TCP/443 HTTPS
SMC FlowSensor TCP/443 HTTPS
SMC IDentity TCP/2393 SSL
SMC Flow Exporters UDP/161 SNMP
User PC SMC TCP/443 HTTPS
From (Client) To (Server) Port Protocol
From (Client) To (Server) Port Protocol
All appliances User PC TCP/22 SSH
SMC 3rd Party event
management systems
UDP/162 SNMP-trap
SMC 3rd Party event
management systems
UDP/514 SYSLOG

16 Pre-Configuration Considerations
The following diagram shows the various connections used by the 
StealthWatch system. The ports marked as optional are ones that may be used
according to your own network needs.
- continued -
SMC Email gateway TCP/25 SMTP
SMC SLIC TCP/443 SSL
User PC All appliances TCP/22 SSH
From (Client) To (Server) Port Protocol

Pre-Configuration Considerations 17
INTEGRATING THE FLOWSENSOR INTO YOUR
NETWORK
The StealthWatch FlowSensor is versatile enough to integrate with a wide variety of
network topologies, technologies, and components. While not all network configura-
tions can be discussed here, the examples may help you determine the best setup for
your monitoring needs.
Before you install a FlowSensor, you must make several decisions about your network
and how you want to monitor it. Be sure to analyze both your network's topology and
your specific monitoring needs. It is recommended that you connect a FlowSensor so
that it receives network transmissions to and from the monitored network, and, if
desired, receives interior network transmissions as well.
The following sections explain how to integrate a StealthWatch FlowSensor appliance
into your network using the following Ethernet network devices:
TAPs
SPAN Ports
TAPs
When a Test Access Port (TAP) is placed in line with a network connection, it repeats
the connection on a separate port or ports. For example, an Ethernet TAP placed in line
with an Ethernet cable will repeat each direction of transmission on separate ports.
Therefore, use of a TAP is the most reliable way to use the FlowSensor. The type of
TAP you use depends on your network.

18 Pre-Configuration Considerations
This section explains the following ways to use TAPs:
Using Electrical TAPs
Using Optical TAPs
Using TAPs Outside Your Firewall
Placing the FlowSensor Inside Your Firewall
Using Electrical TAPs
The following illustration shows the StealthWatch FlowSensor connected to an
Ethernet electrical TAP. To achieve this configuration, connect the two TAP ports to
the FlowSensor Monitor Ports 1 and 2, as shown.
Using Optical TAPs
Two splitters are required for fiber-optic–based systems. You can place a fiber-optic
cable splitter in line with each direction of transmission and use it to repeat the optical
signal for one direction of transmission.
Note:
In a network using TAPs, the FlowSensor can capture performance monitoring
data only if it is connected to an aggregating TAP that is capturing both inbound
and outbound traffic. If the FlowSensor is connected to a unidirectional TAP that
is capturing only one direction of traffic on each port, then the FlowSensor will not
capture performance monitoring data.

Pre-Configuration Considerations 19
The following illustration shows the FlowSensor connected to a fiber-optic–based
network. To achieve this configuration, connect the outputs of the optical splitters to
the FlowSensor Monitor Ports 1 and 2, as shown.
Using TAPs Outside Your Firewall
To have the FlowSensor monitor traffic between your firewall and other networks,
connect the StealthWatch management port to a switch or port outside of the firewall.
Note:
If the connection between the monitored networks is an optical connection, then
the StealthWatch FlowSensor appliance is connected to two optical splitters. The
management port is connected to either the switch of the monitored network or to
another switch or hub.
WARNING:
Lancope strongly recommends that you use a TAP for this connection so that
failure of the device does not bring down your entire network.

20 Pre-Configuration Considerations
The following illustration shows an example of this configuration using an Ethernet
electrical TAP. The management port must be connected to the switch or hub of the
monitored network. This setup is similar to the setup that monitors traffic to and from
your network.
Placing the FlowSensor Inside Your Firewall
To monitor traffic between internal networks and a firewall, the FlowSensor must be
able to access all traffic between the firewall and the internal networks. You can
accomplish this by configuring a mirror port that mirrors the connection to the firewall
on the main switch. Make sure that the FlowSensor Monitor Port 1 is connected to the
mirror port, as shown in the following illustration:
Note:
If your firewall is performing network address translation (NAT), you can observe
only the addresses that are on the firewall.