Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

KVM specific details and deployment

Review KVM requirements, networking guidance, VM operations, and vSensor deployment before pairing and updating.

KVM Specific Requirements

  • Vectra currently only supports KVM on Red Hat or Ubuntu Linux installations.

  • Ensure that libvirt (including libvirt-client) and virt-install are installed locally on the KVM host server.

  • You must either be a root user or ensure that the user that will later launch the deployment script is in the libvrt group on the KVM host server.

KVM Networking Guidance

  • Ensure that the desired KVM networks (that will be used for management and capture) are present, persistent, active, and autostarted using virsh net-list –all.

    • The default driver supported for the network interface is virtio-pci.

  • Vectra recommends that customers create a new virtual network on the KVM host server from which they want to capture packets and set the interface to promiscuous mode.

    • This is the only configuration that Vectra officially tests and supports.

    • The Vectra vSensor(s) should be the only virtual machine(s) on this network, unless there are other similar virtual machines that you want to provide the same set of traffic into.

  • KVM traffic mirroring may be implemented using either Open vSwitch or tc.

    • The steps to create a new mirror from an existing physical network interface to a new virtual one are as follows:

Open vSwitch

# Define the interfaces and the mirror
BRIDGE="br0"
SRC="eth0"
DST="vnet0"
MIRROR="span"
# Create a bridge and set all ports up
ovs-vsctl add-br ${BRIDGE}
ip link set dev ${BRIDGE} up
ip link set dev ${SRC} up
ip link set dev ${DST} up
# Enable promiscuous mode on the source interface
ip link set ${SRC} promisc on
# Add the ports to the bridge and enable a traffic mirror from SRC to DST
ovs-vsctl \
-- add-port ${BRIDGE} ${SRC} \
-- add-port ${BRIDGE} ${DST} \
-- --id=@${SRC} get port ${SRC} \
-- --id=@${DST} get port ${DST} \
-- --id=@${MIRROR} create mirror \
 name=${MIRROR} \
 select-src-port=@${SRC} \
 select-dst-port=@${SRC} \
 output-port=@${DST} \
-- set bridge ${BRIDGE} mirrors=@${MIRROR}

tc

Jumbo Frame Support

If your deployment requires jumbo frame support, please see the below additional guidance:

  • To process jumbo frames, the MTU needs to be set to 9000 on both the host bridge and the vnet interface used for capture.

  • virsh net-info <network can be used to show the bridge associated with the network you have defined as your capture network. In the below example, capture is the network name being used for capture. In this example the bridge is virbr1.

  • If the bridge is set to 9000 before deploying your Vectra KVM vSensor then the target device will be set to 9000 automatically during the vSensor deployment.

  • If you need to set MTU to 9000 after the vSensor has been deployed, virsh dumpxml <sensor name> will show the bridge and the associated target device that need to be set to 9000. Replace <sensor name> with the name of your Vectra KVM vSensor name.

    • Please note that the output of this command is long, and we only care about the interface sections.

  • In the above example (the output was truncated to only show the relevant section) , you can see the bridge and target device (virbr1 and vnet6) are annotated

  • The command to set the MTU to 9000 on a network (bridge or target device/interface) is ip link set dev <network> mtu 9000. The command has no output as seen in the example below:

  • You can validate the current MTU settings with the ip a command. Please see abridged example below:

Basic Interaction with KVM Virtual Machines

The easiest way to interact with KVM VMs via the command line is by using the “virsh” series of commands. Vectra’s deployment script will automatically start and configure the guest you, however these basic commands could prove helpful when diagnosing setup issues:

View the list of configured virtual machines:

virsh list --all

Start - In order to start a given virtual machine for which a configuration already exists:

virsh start <name of vm>

Stop and save state:

virsh shutdown <name of vm>

Stop quickly and don't save state (used only when you know you are going to purge the vm):

virsh destroy <name of vm>

Purge the vm after stopping (needs to be used in tandem with destroy):

virsh undefine <name of vm>

View the IP address(es) and MAC address(es) of a given virtual machine and its interfaces:

virsh qemu-agent-command <name of vm> '{"execute":"guest-network-get-interfaces"}' | jq .

Downloading the KVM vSensor Image

The KVM vSensor image is available under Configuration → COVERAGE → Data Sources > Network > Sensors in your Vectra UI. Navigate to this area, click Download Virtual Image at the top right, and select the KVM vSensor (QCOW2) option.

Deploying the KVM vSensor

Once downloaded, the machine image can be placed in the directory of your choice and uncompressed. It is a tar file. On an Ubunto machine the tar -xf command will uncompress the file fully. Using other tools may require 2 steps.

The script to start the deployment is vectra-vsensor.sh which has help that can be displayed as shown below:

Execute the script to begin the deployment:

  • As you can see in the above output, you will need to select some options:

    • VM configuration - See the KVM vSensor sizing in the earlier section of this guide for details on the expected performance and resource requirements for each configuration.

    • Management NIC – Which NIC to use for the management interface of the vSensor.

    • Capture NIC – Which NIC to use for the capture interface of the vSensor.

  • Your KVM vSensor will start automatically once the deployment script has finished.

PreviousIntroduction and general requirementsNextInitial vSensor configuration at CLI

Last updated

Was this helpful?