VMWare ESXI Installation Guide
This guide describes how the Allegro Network Multimeter Virtual Edition can be set up with VMWare ESXI. The Allegro Virtual Edition is designed for 2 use cases. It can analyze Pcap captures or Packet Ring Buffers of unlimited size for forensic investigation or it can analyse live traffic from virtual machines by a virtual Mirror Port or ERSPAN.
General
DISCLAIMER
Be aware that an activated ring buffer can degrade the IO performance for all VMs. It is recommended to use one or many dedicated HDD or SSD for the Ring buffer to prevent side effects to other VMs.
System Requirements
This guide requires a licensed VMWare ESXi 6.7.0 or newer.
The System requirement of the virtual machine is
- x86 64-Bit Intel/AMD CPU with SSE4.2 support ( since 2011 )
- 4 CPU-Cores
- at least 2GB RAM for the In-Memory-DB, the more the better
- 20GB free Disk space
Virtual Machine Image
Please contact Allegro or your reseller to retrieve the current Allegro Virtual Edition installation zip archive.
Installation
Zip file extraction
Please extract the the zip archive. It should contain the 3 files “allegro-multimeter.ovf”, “allegro-multimeter.vmdk” and “allegro-multimeter-virtualbox.ovf”.
OVF deployment to VMWare ESXi
Please log in to VMWare ESXi.
Once you have logged in, navigate to “Virtual Machines”
Create a new VM with “Create / Register VM” and select the option “Deploy a virtual machine from an OVF or OVA file”.
Press “Next”, use a preferred name for the Allegro and drag/drop the 2 files into the Window and press “Next”.
Select your data storage for the Allegro. This storage will be used as the boot partition and to store the configuration of the Allegro Virtual Edition and does not require being a high-speed disk. It will not store the packet ring buffer.
The Deployment options allow you to select the Network mapping for the MGT port and the disk provisioning.
Please double-check all options in the next dialog and press finish if everything is fine.
The upload and the import of the Allegro Virtual Edition will start. Please be patient until it is finished.
Initial Startup
Please power on the virtual machine when the import has been successful. The Allegro Virtual Edition will boot, prepare the installation and reboot once. The VM will try to get an IP Address via DHCP on the MGT port. Please check the screen output for an assigned IP address.
You can connect now to the IP address with you browser, in our case https://10.54.0.220/ . The browser will show a certificate warning. Please accept it to get to the login screen.
Please use as credentials as user “admin” and as password “allegro”. It will show a warning that the Allegro Virtual Edition does not have a license yet.
Please navigate to “Settings” -> “License upload” and send the System Serial to testlicense@allegro-packets.com. Allegro Packets will issue a test license for you that can be installed by the “Upload new License button”. Once the Test license is applied, it will show you the License details similar to this output:
The Allegro Virtual Edition is now running and analyses all packets on the capture port.
Mirroring virtual interface
The Allegro Virtual Edition has by default 2 network interfaces. The first port is used for Management, the second port is used as capture port. The Allegro Virtual Edition will analyse all traffic received by this network port.
Please enable the promiscuous mode for the vwsitch to allow the Allegro Virtual Edition to monitor all packets from on a VMWare vswitch.
Storages for Ring Buffer and Pcaps
You can add one or multiple virtual disks to the Allegro Virtual Edition. If done, you can enable the Packet Ring Buffer as described in Ring Buffer Configuration Guide. Please note that a real time capture of packets require high write rates to your storage. Please use dedicated disks for the ring buffer to avoid performance issues on other virtual machines.
Encapsulated Remote Mirroring (L3) Source
The Allegro Virtual Edition supports the VMware Encapsulated Remote Mirroring (L3) Source with the ERSPAN Mode. You can set up an IP address on the capture port and send encapsulated packets to the Allegro. Please see the Vsphere documentation center for Encapsulated Remote Mirroring (L3) Source.