Hyper-V Installation Guide

From Allegro Network Multimeter Manual
Revision as of 11:16, 8 April 2022 by Martin.Weiser (talk | contribs)
Jump to navigation Jump to search

This guide describes how the Allegro Network Multimeter Virtual Edition can be set up with Hyper-V under Windows 11.

The Allegro Virtual Edition is designed for 2 use cases.

  1. It can analyze pcap captures or packet ring buffers of unlimited size for forensic investigation and/or
  2. it can analyze live traffic from virtual machines by a virtual Mirror Port or ERSPAN.

General

DISCLAIMER

Packet analysis is resource intensive. Running the Allegro Packets VM on your own hardware and its performance outcome is warranted “as is”. Our support will be limited.

Be aware that an activated ring buffer can (heavily) degrade the I/O performance for all VMs. It is strongly recommended to use one or more dedicated HDDs or SSDs for the ring buffer, to prevent side effects on other VMs.

System requirements

This guide has been tested with Windows 11 Enterprise.

The system requirement of the virtual machine is:

  • x86 64-Bit Intel/AMD CPU with SSE4.2 support (since 2011)
  • 4 CPU-Cores
  • at least 2GB RAM for the In-Memory-DB, the larger the better
  • 20GB free disk space

Virtual Machine image

Please contact Allegro or your reseller to download the current Allegro Virtual Edition installation zip archive.

Installation

Zip file extraction

Please extract the zip archive. It should contain a single file “allegro-image-X.X.X.vhdx” where X.X.X is the version number of the release. 

Creating a Hyper-V virtual machine in the Hyper-V Manager.

Open the Hyper-V Manager

Hyper-V Manager start.png

Create a new virtual machine under "Actions" → “New” → "Virtual Machine ...".

Follow the wizard by first giving a name to the virtual machine.

When asked to "Specify Generation" choose "Generation 2".

Hyperv-generation.png

On the "Assign Memory" page set the startup memory to at least 2048 MB.

On the "Configure Network" page select the network connection that you want the Allegro Virtual Edition management interface to be connected to.

Hyperv-managemnent-nic.png

On the "Connect Virtual Hard Disk" select the option "Use an existing virtual hard disk" and select the “allegro-image-X.X.X.vhdx” that was extracted from the ZIP archive.

Hyperv-hard-disk.png

Finish the wizard to create the virtual machine.

Add an additional network interface to the virtual machine, disable "Secure boot" and set the processor count

Edit the settings for the virtual machine under "Actions" → “Settings...”

With the "Add hardware" item selected "Network Adapter" and click "Add".

// TODO settings network adapter image

Choose the virtual switch that you want the Allegro Virtual Edition monitoring interface to be connected to and click "Apply".

Now select the "Security" item and unselect the "Enable Secure Boot" checkbox as this is not supported by the Allegro Virtual Edition. Click on "Apply" to save the setting.

// TODO secure boot image

Now select the "Processor" item and change the "Number of virtual processors" to at least 4. Click on "Apply" to save the settings.

// TODO processor count image

Packet ring buffer and pcap storage

For the ring buffer to work, you need to add an additional virtual disk (or more) to the Allegro Virtual Edition.

With the "Add hardware" item selected again this time choose "SCSI Controller" and click "Add".

// TODO settings scsi controller image

Leave the default type "Hard drive" and click "Add".

The controller location 0 will be in use so choose 1.

// TODO scsi controller location image

In the "media" section with "Virtual hard disk" selected click on "New".

This will open a wizard and on the "Choose disk type" page select "Fixed size" for best performance.

// TODO disk type fixed size image

Follow the wizard to create a "blank virtual hard disk" with the desired size for the packet ring buffer and after the wizard is finished click on "Apply" to save the settings.


When done, power on the Allegro VM and go to menu GenericStorage, to check if the Allegro Network Multimeter has detected a storage device.

Here an example of 1 attached/configured disk:

// TODO storage image

Here, on the GenericStorage page, you can prepare the disks to be used by the Allegro by clicking the "Format" button.

This will erase all content on the disk and create the filesystem for the Allegro. You can also activate and deactivate the storage device for pcap files here.

For more information on the ring buffer, please review the corresponding page here → Ring Buffer Configuration Guide.

Disclaimer: Be aware that an activated ring buffer can (heavily) degrade the I/O performance for all VMs.

It is strongly recommended to use one or more dedicated HDDs or SSDs for the ring buffer, to prevent side effects on other VMs.

Install USB License dongle

If the Allegro Virtual Edition is shipped with an USB License dongle, plug the dongle into an unused USB port of the VM host. The dongle must be connected to the virtual machine. When powered off, press “Edit” in the Vmware ESXi host and click on “Add other device”. Choose “USB device”. A new entry on the bottom of the hardware list appears. Please select a “Feitian HID Dongle” or similar.

License dongle.png

Initial startup

Powering on

Power on the virtual machine. The Allegro Virtual Edition will boot, prepare the installation and reboot once. The VM will seek for an IP address via DHCP on the MGT port. Check the screen output for an assigned IP address.

Esxi allegro screen.png

You can now connect to the IP address with your browser, in our case https://10.54.0.220/ . The browser will show a certificate warning. Accept it to access the login screen.

Esxi allegro login.png

Please use the following login credentials; user “admin” and password “allegro”.

License

If the Allegro Virtual Edition was shipped with a USB License dongle and it has been correctly installed, the License is validated and the Allegro should activate.

The serial number of the Allegro Virtual Edition would be e.g. “dongle: 1234567890” and is displayed in the serial number box under “Settings” -> “License upload”. If it is not displayed even though the dongle has been correctly installed, please contact Allegro support.

If the Allegro Virtual Edition was shipped without an USB License dongle, please follow the following steps. In the web interface a warning is shown that the Allegro Virtual Edition does not yet have a License.

Esxi allegro license.png

Navigate to “Settings” -> “License upload” and send the system serial number to testlicense@allegro-packets.com.

Allegro Packets will issue a test License for you that can be installed by the “Upload new License button”.

Once the test License is applied, it will show you the License details similar to this output:

Esxi allegro license details.png

The Allegro Virtual Edition is now running and analyzes all packets on the capture port.

Encapsulated remote mirroring (L3) source

The Allegro Virtual Edition supports the VMware Encapsulated remote mirroring (L3) source with the ERSPAN Mode. You can set up an IP address on the capture port and send encapsulated packets to the Allegro. Please see the Vsphere documentation center for Encapsulated remote mirroring (L3) source.