M47
The M47 quick start guide provides guidance for initial deployment, verifying connectivity, and next steps to take after the appliance is connected to your network.
Introduction
An M-Series appliance is used in place of a virtual appliance for Vectra Stream deployment. This document is intended to help customers or partners with the initial configuration.
One of the below guides should be the starting point for your overall Vectra deployment:
Full details on firewall requirements for your entire Vectra deployment are available in those guides or in firewall requirements.
After you have completed the initial deployment of your M-Series (Stream) appliance following this guide, you can move on to paring Stream with your Brain appliance. From a pairing perspective, Stream functions similarly to other Vectra physical Sensors. The Stream Deployment Guide covers full deployment details for Vectra Stream. Pairing for all Vectra appliances is also covered in pairing appliances.
Guide for other appliances are located in NDR physical appliances and NDR virtual / cloud appliances.
M47 Package Contents
1 M47 system
1 Rail kit
2 Power supply cords (matching requested type)
1 Vectra bezel
SFPs (matching details of your order)
See supported SFPs, and QSFPs for details on options.
Physical Connections
M47 hardware is identical to X47 hardware but with a different software load. Because of this, the X47 has more ports that are unused than an X47.
Physical Connections Added Guidance
There is an additional USB and VGA port on the front right-hand side that can be used for console access.
You can use these or the rear USB ports for console access.
The iDRAC Direct micro port under this front USB port is not supported. Please use the ethernet iDRAC port on the rear of the chassis for iDRAC/IPMI use.
The M47 has two 800 GB and four 1.92 TB SSD drives.
Should any ever need replacing, contact Vectra support and refer to the disk numbers on the chassis.
If you have questions on rail installation, watch this video: https://www.youtube.com/watch?v=JfOTnRMeE5w
See SFP28 Management Option for details on using the eth2 SFP28 port for management instead of capture.
Minimum Connections
Power
The X47 has dual auto sensing power supplies supporting 100-240 VAC supply at 50 or 60 Hz.
It is recommended to connect both power supplies for redundancy.
MGT1 - 1 GbE copper RJ45 (default) or SFP28 10/25 GbE
Either of these ports will need to be configured with an IP address in your network.
The X47 can be configured by the customer to allow the port labeled as eth2 (10/25 GbE SFP28) on the back of the appliance to function as the MGT1 port.
See SFP28 Management Option if fiber is required)
SFP28 Management Option
The M47 can be configured by the customer to allow the port labeled as eth2 (10/25 GbE SFP28) on the back of the appliance to function as the MGT1 port. This will not give any performance benefit and is intended for use by customers who do not have any 1 GbE copper interfaces available for use as the MGT1 interface in the location in which they will deploy the M47 appliance.
Please expand for details if you wish to enable this option:
Please note the following:
It is recommended to use KVM, serial console, MGT2, or iDRAC/IPMI to connect to the appliance command line to make the change because unlike a SSH session, these will be unaffected by the change. See Accessing the CLI for details.
For example, if you were connected to MGT1 in a staging area to make the change before moving into your data center where the 10 Gbps SFP+ was required, when the change is made your session would break and you would need to login again to configure a static address for the new MGT1 port.
After making the change, physical port labels on the back of the appliance would no longer match how Vectra software displays the ports.
The port labeled as MGT1 changes to being unused by the Vectra software.
The port labeled as eth2 becomes MGT1.
The port labeled as eth3 becomes eth2 and remains unused in M47 configurations.
The
show interfacecommand at the CLI can be used to show the actual negotiated speed and state of MGT interfaces.
CLI commands to show configured MGT1 interface speed setting and change speed setting:
Performance
An M47 system supports Stream performance of up to 75 Gbps. Actual bandwidth used to the downstream data lake will be a fraction of this number. This number represents how much traffic can be processed by Sensors attached to the Brain that the Stream appliance is paired to. Stream sends the enhanced and distilled metadata to the data lake.
Please Note:
While considering performance for the appliance it is important to understand that the traffic mix at customer sites varies widely. Some customers have traffic mixes that skew towards larger flows (think file transfers), and some will skew towards smaller flows (think DNS).
Performance may be higher when the traffic mix skews towards larger flows.
Performance will be lower when the traffic mix skews towards smaller flows as this produces more metadata for analysis.
The stated performance is for average traffic mixes and should not be considered absolute.
Accessing the CLI
The Command Line Interface (CLI) of a physical Vectra appliance is accessible in multiple ways. All appliances will not always have all methods available. See physical connections to see the options available for your specific model.
KVM or “crash cart”
Direct connection to "Support" (MGT2) port
iDRAC/IPMI - not all appliance types will have iDRAC/IPMI
MGT1 port once configured
Serial console - only supported officially on S1, S2 (EOL), X29/M29, and the X80 (EOL) appliances.
Once you have connected to the CLI login prompt on the appliance, use the default credentials to login.
Username:
vectraand password:changethispasswordPlease change the password immediately after logging in using the
set passwordcommand.
KVM or “crash cart”
If your appliance has USB and VGA ports, a KVM (Keyboard, Video, Mouse) switch or “crash cart” can be used to connect to the appliance console.
Direct Connection to "Support" (MGT2) Port
A direct connection to the MGT2 port on your appliance.
If you can physically connect to your MGT2 port, then you can direct connect to the MGT2 port via SSH to do the initial configuration.
The appliance MGT2 port is factory configured with a 169.254.0.10/16 (255.255.0.0) address.
Configure your host’s IP to 169.254.0.11 with subnet mask of 255.255.0.0.
Use SSH to connect to the appliance from your host using the default credentials from above.
iDRAC/IPMI
If your appliance has a built in Dell iDRAC / IPMI interface you can access the CLI through it.
Vectra strongly recommends that customers configure iDRAC / IPMI access permanently for all platforms supporting this interface.
Benefits:
Easier access in case of network connectivity issues or DHCP mishaps.
Simpler remote IP address changes.
Reduced resolution time during Vectra support engagements requiring console access.
Please expand for iDRAC/IPMI configuration details:
The default username / password for iDRAC/IPMI is vectra / changethispassword.
To access the interface, point your web browser to http://your_iDRAC_IP
Initially, your iDRAC interface will default to DHCP.
At the login screen enter your credentials:
Click on the Virtual Console:
And you will be presented with a login prompt for the CLI:
To set a static IP for iDRAC you must 1st be logged in to the CLI of the Sensor as the vectra user:
Serial Console
Serial console is only supported on S1, S2 (EOL), X29/M29, and X80 (EOL) appliances.
If supported on your appliance model, the serial settings should be 115,200, 8, N, 1
115,200 baud data rate
8 data bits
No parity bit
1 stop bit
Do not enable flow control
Initial Network Configuration
DHCP
The appliance can obtain its network configuration from a DHCP server in your network. The MGT1 port functions as a DHCP client by default.
Connect the management port (MGT1) of the appliance to the network switch.
Find the IP address that was assigned to MGT1 from your DHCP server logs.
You can also find the IP address at the CLI of your appliance if you can access it another way .
Use the
show interfacecommand to display the address that was assigned to MGT1 via DHCP once you are logged onto the appliance.See Accessing the Command Line Interface (CLI) of the Appliance above for instructions on how to log on).
Static Addressing
Configuration Checklist for Static Addressing
Below is a list of information needed for the initial configuration:
IP address to be used for the MGT1 interface
Default gateway IP address
DNS nameserver IP addresses
DNS servers for the Sensor must be configured at the CLI if you are not using DHCP. This cannot be done in your Brain.
Setting a Static MGT1 IP Address
Once logged in to the appliance you can view the syntax for the "set interface" command:
Setting the IP address example:
IPv6 Support:
IPv6 is supported for the MGT1 and MGT2 interfaces. For full details, including information regarding dual stack support, please IPv6 Management Support for Vectra Appliances on the Vectra support portal. Below we will show how to enable IPv6 support (its off by default) and the syntax to use when setting an IPv6 address.
To enable/disable IPv6 support:
Setting IPv4 and IPv6 syntax examples:
Execute the following command to set the MGT1 or MGT2 (a gateway address cannot be configured for MGT2, the gateway on MGT1 will be used) interface to the desired static IP address:
Configuring DNS for the appliance:
Command syntax to set DNS (up to 3 nameservers are supported):
Configuring DNS Example:
Verifying DNS Configuration:
Verifying your Connectivity:
Once you have configured an IP statically or via DHCP you can verify connectivity by pinging known IPs in your environment from the CLI with the debug ping command.
If your Stream appliance is already configured with an IP, it is recommended to ping the Brain IP to verify reachability before attempting pairing. Stream must have port 22 and 443 open from the applaince to your Brain for successful pairing and ongoing communication. Connectivity can be tested with the debug connectivity command.
For more detail, please see Checking brain or sensor network connectivity.
Example:
Next Steps
Brain and Stream Communications Requirements
A Stream appliance can pair with any Vectra Brain type. For example, the Brain can be a physical appliance, a Brain deployed in a IaaS cloud, or a Brain deployed in a traditional hypervisor environment on customer premises.
Stream must be able to reach the Brain over the below ports. It is recommended to enable these ports bidirectionally to aid in troubleshooting.
TCP/443 (HTTPS) - Used for Stream discovery and initial pairing connection.
TCP/22 (SSH) - Used for Paired Stream connections.
Additionally, for online pairing (physical Stream only), both Stream and the Brain must be able to communicate with:
update2.vectranetworks.com or 54.200.156.238 over TCP/443 (HTTPS)
Please work with your security and networking contacts to ensure that Stream will be able to initiate a connection to the Brain. Stream only communicates with the Vectra Brain (and configured downstream data lake or SIEM) and does not need to communicate to Vectra directly. Software updates for Stream will come from the Brain.
For full details on all potential firewall requirements in Vectra deployments, please see firewall requirements.
Pairing Stream to the Brain
After base configuration, it is suggested to pair Stream with your Brain appliance.
Pairing appliances covers pairing of all physical Vectra appliances.
Worldwide Support Contact Information
Support portal: https://support.vectra.ai
Email: [email protected] (preferred contact method)
Additional information: https://www.vectra.ai/support
Last updated
Was this helpful?