USB Presenter Capture and Administration: Difference between pages

From Allegro Network Multimeter Manual
(Difference between pages)
Jump to navigation Jump to search
Access restrictions were established for this page. If you see this message, you have no access to this page.
(describe the time after configuration option.)
 
(fixed the version number for hsts (4.1.1 as minimal to 4.2))
 
Line 1: Line 1:
This page describes how the Allegro Network Multimeter allows a user to start a capture with a USB presenter. This capture can be actioned 'Back in Time' for a defined period.
The administration page allows the following actions:


In addition, the capture files can be uploaded to an SFTP server at a defined time.
{| class="wikitable sortable"
|-
| [[File:Administration.png|800px|none|right]]
|}


This feature has been designed to allow non-IT staff to record/initiate pcaps when an error occurs; it also allows for captures without opening a Web interface.
=== Power ===
<br><br>


== Use case example ==
Reboot or power off the Allegro Network Multimeter.
An IT or VoIP service provider needs to troubleshoot intermittent issues at a (residential) customer.


The service provider is limited by time, resources and packet capture/data collection constraints (AVG, GDPR).
After clicking on the buttons, a confirmation dialogue will appear. Most of the time, rebooting is not necessary since it takes a significant time. If packet processing needs to be restarted because some options cannot be changed during runtime, the next option is a better choice since it minimizes downtime.


With the Allegro Network Multimeter "USB Capture trigger" functionality, a "fool proof" remote control is handed to the customer, with the instruction to press any button when the issue arrises.
=== Processing ===


A simple button press on the remote, will initiate a pre-configured capture (filter + duration) around the time of the "incident", e.g. from 60s before until 60s after the "incident".
Restart the Allegro Network Multimeter processing software. This will reset all measured statistics.


As only packets around an issue are being recorded and saved as a pcap, the service provider needs not sift through huge amounts of data for root-cause analysis.
Choosing this option will stop packet processing but the machine and its web interface is still available as the device itself is not rebooted. The packet processing core is restarted with the current settings and will begin processing packets after a few seconds.


Also, there are little to no privacy implications, since the capture was end-customer initiated, pre-filtered and limited to short time-intervals only.
=== Configuration ===
<br><br>


== Requirements ==
By clicking on the '''Reset System Configuration''' button a dialog is displayed that allows to reset all settings, including the network configuration, to factory defaults and the system will be restarted. As of version 3.4 the dialog allows to keep certain settings (management interface settings, users and passwords, disk and packet ring buffer cluster settings including optional random device-specific encryption keys) while setting the rest of the system configuration to defaults.


This feature is supported by all Allegro Network Multimeters (also VM) from firmware release V3.0.
The '''Export System Configuration''' button allows you to export the entire configuration of the *Allegro Network Multimeter*. A zip compressed file can be downloaded and used for import.


As of now, the '''Logitech R400''' is supported. Allegro will add more presenters on request. An optional USB sound device will play a beep when a key has been pressed.
The '''Import System Configuration''' button allows you to select several configuration items:


It requires a free USB 2.0 (or higher) port on the Allegro Network Multimeter. An internal or external disk needs to be configured at '''Generic''' → '''Storage,''' and a [[Packet ring buffer|ring buffer]] must be configured.
* Core settings: All settings of global settings, module settings, incident settings, user defined names, virtual link groups, ingress (NIC) filter and IP groups, excluding management interface settings, multi-device settings, and user settings. Some core settings (network interfaces, virtual link group and time synchronization) can also be retained during import. Simply uncheck the global core setting checkbox und check the child checkboxes for settings to be imported and overwritten.
* Management interface settings: All settings of the management interface (e.g. Wi-Fi, LAN, hostname).
* Multi device settings: All settings on the configured remote devices.
* User and roles: All users and their passwords. The admin user cannot be changed and cannot be deleted by a configuration import.
* User settings: All user settings (such as search history or dashboard configuration)
It is possible to import the selected settings to all configured remote devices by selecting the last check box.


Please note that the capture initiated by this feature is extracted from the ring buffer, and ring buffer filter rules for packet slicing will affect exported pcaps.
The button '''Save current system configuration on Multimeter''' will store the current configuration as a file on the device itself (in contrast to the export feature, which will download the file the user's computer).
<br><br>


== USB Capture Trigger Setup ==
When there are saved configuration available, any of them can be selected and load onto the system again. It is also possible to delete the configuration.


Connect the Logitech R400 USB dongle to the Allegro Network Multimeter. If you have a Allegro Virtual Edition, please pass-through the USB device directly to the Allegro VM.
=== CORS Configuration ===
With version 4.1 the option to configure the "Cross-Origin Resource Sharing" (CORS) settings was introduced.


Once this is done, navigate to the '''Settings''' -> '''Expert settings''' page and open the '''USB capture trigger'''.
You can learn about CORS on the MDN Web docs[https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS].
<br><br>
[[File:Presenter dialog.png|600px]]


=== Access Control ===
Since version 4.1 there is the the option to limit the access to the multimeter to specific subnets.


Whenever a key on the presenter is pressed, a pcap will be generated.
If you enable the access control, you have the option to specify the subnets from which people are allowed to access the multimeter.


NOTE! - The pcap end-time, is when the button on the presenter is pressed and the start time is defined by the capture interval.
If you want to allow the access for the clients in the subnet in which the multimeter is deployed you are able to allow that with ticking "Allow local access".


This means, that a configured interval of 60 seconds, will generate a capture (pcap) of the full 60 seconds '''prior''' to when a presenter key was pressed.
=== TLS/SSL certificate ===


Captures are stored in the root directory of the storage partition or, if enabled, in the upload directory (cue) for periodic/automated SFTP uploads.
The appliance comes with a pre-installed generic TLS certificate but a custom certificate can be uploaded, generated (since 3.6) or downloaded from a Certificate Authority (since 3.6).
<br>


With version 4.2 it is possible to configure the time that will be recorded before and after the button is pressed instead of just the time before.<br>
Depending on your firmware-version there are two to four possibilities:


== SFTP Export Setup ==
==== Before 3.6: ====
There are two options:


The Allegro Network Multimeter can automatically upload pcap files to an SFTP server from the upload directory on the disk.
* You are able to use the certificates the appliance got delivered with. (You are able to reset to that with the Reset-Button)
* You are able to upload a X.509 certificate file and a key file. Upon successful upload, this certificate will be used to serve the user interface.


To configure it, please navigate to '''Settings''' → '''Remote Access and Export''' → '''Pcap export via SFTP'''.
==== Since 3.6: ====
There are four modes:
* Legacy: The default certificates the appliance got shipped with will be used if the appliance got shipped with an older firmware than 3.6. You won't be able to switch back to this option and it will be hidden if it is not selected.
* ACME: The Certificates will be downloaded from the specified Certificate Authority
* Upload: You are able to upload a X.509 certificate file and a key file. Upon successful upload, this certificate will be used to serve the user interface.
* Self-Signed: Self-Signed: Generate self-signed certificates with a custom host-name. They will be valid for 10 years and replace the legacy certificates for devices shipped with firmware version 3.6 or later.
The Default Mode is always the fall-back if the process does not work.
The '''Reset to default SSL certificate''' button will remove any user-provided SSL certificate and the user interface will be served using the default SSL certificate.


This allow to export all captured pcap files at a certain time of day. As example it can be used to transfer pcaps during the night from remote locations to a central SFTP server.
==== Since 4.2: ====
<br><br>
With the version 4.2 the option to enable HTTP Strict Transport Security (HSTS) for the multimeter was added. HSTS stops users from trying to access the multimeter via unencrypted HTTP or ignoring invalid certificates for the multimeter.
[[File:Sftp export.png|1000px]]
<br>


== Advanced Multi-pcap Setup ==
If the administrator locked themselves out by enabling HSTS there are multiple options:


There are situations where the Allegro Network Multimeter may be configured to record multiple separate pcaps, each with specific filters, with only one button-press on the usb-presenter.
* If HSTS was already activated and the certificates were changed on purpose after that, they have to remove information about the site from their browser.
* If HSTS was already activated and the certificates were changed accidental, they are able to connect to the multimeter via a private window or  via the ip address.


This can be done by enabling the '''USB capture filter''' in the '''USB capture trigger''' dialog. Filter syntaxes are described in the [[Capture module]].
=== Certificate Authority ===


A good example is the installation of an Allegro 500 with 2 links and 2 virtual link groups ( see [[Virtual Link Group Configuration Guide]]), one before and one behind the firewall.
Some features also connect to external SSL services, for instance when sending email notifications via SMTP or when searching for [[Firmware update|firmware updates]]. Usually these SSL connections are verified with the built-in CA certificate pool. It is also possible to upload one or many own CA certificates which are used additionally to the system ones.
<br><br>
[[File:Presenter filter group.png|600px]]


The button "Install SSL CA certificates" opens a dialoug where the file can be selected and uploaded. This file must contain certificates in the PEM format. It may contain multiple certificates.


As a second example, you can record pcaps of up to 4 different IP addresses at the same time with just one click.
Before version 3.6 uploading new certificates will replace the existing ones. The button "Remove SSL CA certificates" will delete the previously installed custom CA certificates so that only  the system CA pool is used again for certificate verification.
<br><br>
 
[[File:Presenter filter ip.png|600px]]
With version 3.6 uploading a new certificate adds to the old one. You can delete all by pressing the "Remove all CA certificates" and also remove separate certificates.

Revision as of 09:50, 16 October 2023

The administration page allows the following actions:

Administration.png

Power

Reboot or power off the Allegro Network Multimeter.

After clicking on the buttons, a confirmation dialogue will appear. Most of the time, rebooting is not necessary since it takes a significant time. If packet processing needs to be restarted because some options cannot be changed during runtime, the next option is a better choice since it minimizes downtime.

Processing

Restart the Allegro Network Multimeter processing software. This will reset all measured statistics.

Choosing this option will stop packet processing but the machine and its web interface is still available as the device itself is not rebooted. The packet processing core is restarted with the current settings and will begin processing packets after a few seconds.

Configuration

By clicking on the Reset System Configuration button a dialog is displayed that allows to reset all settings, including the network configuration, to factory defaults and the system will be restarted. As of version 3.4 the dialog allows to keep certain settings (management interface settings, users and passwords, disk and packet ring buffer cluster settings including optional random device-specific encryption keys) while setting the rest of the system configuration to defaults.

The Export System Configuration button allows you to export the entire configuration of the *Allegro Network Multimeter*. A zip compressed file can be downloaded and used for import.

The Import System Configuration button allows you to select several configuration items:

  • Core settings: All settings of global settings, module settings, incident settings, user defined names, virtual link groups, ingress (NIC) filter and IP groups, excluding management interface settings, multi-device settings, and user settings. Some core settings (network interfaces, virtual link group and time synchronization) can also be retained during import. Simply uncheck the global core setting checkbox und check the child checkboxes for settings to be imported and overwritten.
  • Management interface settings: All settings of the management interface (e.g. Wi-Fi, LAN, hostname).
  • Multi device settings: All settings on the configured remote devices.
  • User and roles: All users and their passwords. The admin user cannot be changed and cannot be deleted by a configuration import.
  • User settings: All user settings (such as search history or dashboard configuration)

It is possible to import the selected settings to all configured remote devices by selecting the last check box.

The button Save current system configuration on Multimeter will store the current configuration as a file on the device itself (in contrast to the export feature, which will download the file the user's computer).

When there are saved configuration available, any of them can be selected and load onto the system again. It is also possible to delete the configuration.

CORS Configuration

With version 4.1 the option to configure the "Cross-Origin Resource Sharing" (CORS) settings was introduced.

You can learn about CORS on the MDN Web docs[1].

Access Control

Since version 4.1 there is the the option to limit the access to the multimeter to specific subnets.

If you enable the access control, you have the option to specify the subnets from which people are allowed to access the multimeter.

If you want to allow the access for the clients in the subnet in which the multimeter is deployed you are able to allow that with ticking "Allow local access".

TLS/SSL certificate

The appliance comes with a pre-installed generic TLS certificate but a custom certificate can be uploaded, generated (since 3.6) or downloaded from a Certificate Authority (since 3.6).

Depending on your firmware-version there are two to four possibilities:

Before 3.6:

There are two options:

  • You are able to use the certificates the appliance got delivered with. (You are able to reset to that with the Reset-Button)
  • You are able to upload a X.509 certificate file and a key file. Upon successful upload, this certificate will be used to serve the user interface.

Since 3.6:

There are four modes:

  • Legacy: The default certificates the appliance got shipped with will be used if the appliance got shipped with an older firmware than 3.6. You won't be able to switch back to this option and it will be hidden if it is not selected.
  • ACME: The Certificates will be downloaded from the specified Certificate Authority
  • Upload: You are able to upload a X.509 certificate file and a key file. Upon successful upload, this certificate will be used to serve the user interface.
  • Self-Signed: Self-Signed: Generate self-signed certificates with a custom host-name. They will be valid for 10 years and replace the legacy certificates for devices shipped with firmware version 3.6 or later.

The Default Mode is always the fall-back if the process does not work. The Reset to default SSL certificate button will remove any user-provided SSL certificate and the user interface will be served using the default SSL certificate.

Since 4.2:

With the version 4.2 the option to enable HTTP Strict Transport Security (HSTS) for the multimeter was added. HSTS stops users from trying to access the multimeter via unencrypted HTTP or ignoring invalid certificates for the multimeter.

If the administrator locked themselves out by enabling HSTS there are multiple options:

  • If HSTS was already activated and the certificates were changed on purpose after that, they have to remove information about the site from their browser.
  • If HSTS was already activated and the certificates were changed accidental, they are able to connect to the multimeter via a private window or via the ip address.

Certificate Authority

Some features also connect to external SSL services, for instance when sending email notifications via SMTP or when searching for firmware updates. Usually these SSL connections are verified with the built-in CA certificate pool. It is also possible to upload one or many own CA certificates which are used additionally to the system ones.

The button "Install SSL CA certificates" opens a dialoug where the file can be selected and uploaded. This file must contain certificates in the PEM format. It may contain multiple certificates.

Before version 3.6 uploading new certificates will replace the existing ones. The button "Remove SSL CA certificates" will delete the previously installed custom CA certificates so that only the system CA pool is used again for certificate verification.

With version 3.6 uploading a new certificate adds to the old one. You can delete all by pressing the "Remove all CA certificates" and also remove separate certificates.

Retrieved from "https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&oldid=4482"