Cloud as Possible!

vRealize Network Insight v4.x now supports external sources for NetFlow and sFlows. This means you can perform micro segmentation planning on physical servers (before you migrate them to virtual) and create deep insight into what network traffic is going through your entire network (and not just limited to what’s happening in your virtual network).

Currently, NetFlow versions 5, 7, 9 and IPFIX are supported. Getting started with NetFlow in vRNI is pretty easy, but it is slightly more complicated than regular data sources.

Getting Started

I say it’s slightly more complicated, because you have to have a dedicated Collector VM (previously known as Proxy VM) for NetFlow only. The deployment process of this Collector is a bit different, I’ll guide you through the steps below.

First, get the regular Collector VM OVA file, the same one you used to deploy the Collector that collects data from your vCenter, NSX, etc. Get ready to deploy it via vCenter, but first follow these steps to get a shared secret:

Login to vRNI

Go to the settings (either type “settings” in the search bar or use the menu on the top right)

Select Accounts and Data Sources

Click the Add Source button

Choose Netflow Collector as the data source type (on the bottom)

Click the Add Collector VM button. This will display the following popup:

Deploying the Collector VM

After you’ve generated the shared secret for the Collector VM, you can go ahead and deploy that OVA via vCenter. I’m not going to go through all steps, assuming you know how to deploy an OVA. Remember to select Thin Provisioning. You will get a couple of template customisation options, mostly around network settings, but the last option is the most important one; the shared secret. Here you want to input the shared secret you just generated in the vRNI UI.

If everything looks good, deploy the Collector and go get some coffee. It takes a couple of minutes to deploy the OVA and the boot sequence needs to be completed before you can continue. It takes 10 to 15 minutes total. Don’t be like Fred, don’t stare at the progress bars. Anyway, when it’s done with all that it needs to do, it will show up in the vRNI UI automagically. When it does, give it a nickname and optionally some notes about the Collector. Click the Submit button when you’re done.

You can check if you’re successful by looking at your data source overview and the NetFlow data source turns up and there’s a timestamp on the Last Collection value.

And that’s it, vRealize Network Insight is ready for NetFlow ingestion. Point your NetFlow streams to the IP address of the newly created Collector VM.

Verification

Alright, so now you have the NetFlow Collector running and it’s supposed to gather flow data to present back to you. If you’ve already configured your switch to send NetFlow to your NetFlow Collector VM though. If you haven’t, there are a couple examples at the bottom here.

There’s a search query to test if your vRNI is actually collecting physical NetFlow:

flow where Flow Type = 'Source is Physical' and Flow Type = 'Destination is Internet'

I don’t think I have to explain what you’re looking at.

Creating More Context

Currently, vRNI does not resolve physical IP addresses to names (Also, who has their complete network correctly configured for forward DNS, let alone reverse DNS?). The functionality will be more automated in the future (like reading from a CMDB & IPAM, is my best hope/guess), but for now you can manually create more context for the physical flows you’ll be seeing in the UI.

There are two options to do this in the Settings page, under IP Properties and Subnets.

Physical IP and DNS Mappings

You can upload your Bind zones to vRNI so that it can use DNS names instead of IP addresses. If you don’t have Bind as your DNS server (have to admit, it’s pretty old), you can also upload a simple CSV file with your DNS records in it. Examples of this CSV file and the Bind zones can be found in a downloadable zip file.

Remember to zip up whichever format you use, even if it’s just 1 file.

Physical Subnets and VLANs

The other option to provide more feedback can be a bit more confusing. You can also manually map subnets to IP Subnets. I can hear what you’re thinking: “Isn’t vRNI supposed to do this automatically via its data sources?!?!?” – well, yes. If the NetFlow is coming from a supported data source, it will indeed automatically translate the IP Subnets to a VLAN. But here’s the thing; NetFlow is pretty universal and there’s a somewhat limited (although pretty large) list of supported switches and routers as a data source within vRNI. If you decide to send NetFlow from a switch or router that is not on the supported data source list, vRNI doesn’t know what IP Subnet belongs to what VLAN. That’s why you can configure them manually.

The process is pretty simply; on the Physical Subnets and VLANs settings page, click the Add button. Then enter a Subnet and VLAN ID and press Submit.

NetFlow Configuration

Here are a couple of examples on what configuration is needed on certain switch types. Replace $Collector_VM_IP with the IP address of your vRNI NetFlow Collector.

Disclaimer: Verify commands before you enter them into your equipment. I haven’t been able to test all of these, some are from documentation and theoretical.

flow-export destination inside $Collector_VM_IP 2055 flow-export template timeout-rate 1 flow-export delay flow-create 60 access-list netflow-export extended permit ip any any class-map netflow-export-class match access-list netflow-export policy-map global_policy class netflow-export-class flow-export event-type all destination $Collector_VM_IP service-policy global_policy global

More details and configurations will come soon.

For a bit of a moment i am running some Raspberry Pi for multiple purpose. As i am going to redo my LAB completely, this usage will get another steps. As i can now integrate it to my whole vRealize Set of tools.

There is a complete world that is opened to Pi’s with vSphere ESXi. Let think of it!

VMware vSphere ESXi on Raspberry Pi ARM Processors

With the rise of the edge environment and use cases, VMware and other vendors are showing increased interest in this space and rightly so.  One of the projects that VMware has been working on is Project Dimension. VMware is now offering via Project Dimension, the ability to offer to customers a total Platform-as-a-Service offering for edge environments where VMware manages and maintains, services, upgrades, and troubleshoots the platform itself and you are only responsible for your applications and services you have running on top of the platform.  It is basically like VMware Cloud on AWS, except on-premises in your environment.

VMware was able to show off the ESXi hypervisor running on Raspberry Pi in the session entitled: CTO3509BE Edge: Automation, Analytics, and Real-Time Business. Speaking to a lot of what we have mentioned above, Chris Wolf and Daniel Beveridge were able to highlight some of these interesting use cases that are found in conjunction with the micro and nano data center use cases.

Identity Manager is giving RBAC access control over Networking and Security needs. But how can we get visibilities on the successful or unsuccessful Login’s! Here is a quick overview on how to do to get it done.

First, you’ll need to get the Linux Log Insight Agent from your vRealize Log Insight Web Interface or from My VMware Download site.

Downloading and installing linux agent

From the vRealize Log Insight Web interface, select the Administration page from the menu (top right-hand corner). Under the Management section, select Agents and scroll down to the bottom. In my case, the download link was hidden from view. Alternatively, if you have a customer account, you can download the same from my.vmware.com.

Next, upload the agent to your vIDM platform via SFTP on the /opt/loginsight folder. (** If you need hints on how to give root access for SSH and SFTP on vIDM appliances. Here is the kb that describe how to doing it. (link) )

After this, open SSH session as a root user (or sshuser with “su -” command) and do these steps:

cd /opt/loginsight rpm -i VMware-Log-Insight-Agent-<version-and-build-number>.rpm

Verify that the agent installed correctly by running this command: rpm -qa | grep Log-Insight-Agent

Configuring the agent

Next, you’ll need to edit a configuration file to have the agent report back to the vRealize Log Insight server. The configuration file is called liagent.ini and is located under /var/lib/loginsight-agent/.

The best way to edit the configuration file is via the default editor. To edit liagent.ini run the following: vi /var/lib/loginsight-agent/liagent.ini

For a basic configuration, edit the values under the respective section headers as follows.

[server]

1] hostname: This value should match the FQDN of the vRealize Log Insight server. It is set to the correct value automatically when the agent is downloaded from the Log Insight server, otherwise, just uncomment the line and type in the correct FQDN.

2] proto: By default, the cfapi protocol is used. Uncomment this line and leave the value as is.

3] port: The default port for cfapi is 9000. When SSL is enabled on the Log Insight server, the port is automatically set to 9543, which is what I’ve used.

4] ssl: Set to yes if SSL is enabled on the Log Insight server.

The next bit tells the agent which log files it should pick events from. The default configuration includes the messages and syslog log files, standard log files on most Linux deployments.

[filelog|syslog]

5] Directory refers to the location of the log files which are in turn referenced by include, a semicolon delimited string of log file filenames. Wildcards are also supported.

Once you’re done editing the config file, run service liagentd restart to have the agent pick up the changes.

To be sure that the agent is installing as expected : tail -f /var/log/loginsight-agent/liagent_2019-03-26_01.log

As you can see, vIDM was looking for the “loginsight” hostname for a moment. (** My DNS wasn't setup for this entry, so i fixed the issue quickly by adding a CNAME record. But you can doing it also with your /etc/hosts file.)

And as soon as the agent discovered the host, you are going to see the “Agent Up Time” and all information's related to it.

Now, the agent is installed and running. Go to vRealize Log Insigh. Login with admin rights. Go to Administration / Agents

And you should see your vIDM machine with the Linux Agent that you’ve just install listed there.

Content Pack

You’ve done the agent, now we need to add the analytics to vRLI. (Dashboards, Quries, Alerts, Extracted fields and more)

Login with admin rights. Go to Content Pack.

Find the “Vmware Identity Manager” icons on the right pane.

Click on it

Next, you will need to “Agree” the terms ans License. And click on INSTALL.

As install/Setup instructions said, we need to go to the Administration > Agents page. (Administration is on top right of your Browser window)

Select the “All Agents” drop-down, and look for “Identity Manager (On-Prem Installation)”

 Click on the Copy icon to get a duplicate of this template

 At this steps, i use to add the prefix to the description that would say something to the customer when he is going to drive the drop down or the agent group list. So i would put “CUSTOMER NAME HERE -” as a naming template. In my case, my customer name is “LABDOM - ” and the last part of the description. (See bellow)

Validation time!

Agent should all be setup and working by now, content pack is also another old story now. So it is time to see if all goes right!

Go first see if the Agent is collecting as expected! You’ve just select the Agent Group by it’s new name in your last operation.

Here is a screen capture of what’s this look like:

You should see the numbers from “Last Active / Event Sent & Event Sent/Sec” changing time by time.

If you click on the hostname, you should open an Interactive Analytics view.

Defaults event counts are on, so it up to you to filter them out as you need to arrange it. And start create alerts and Webhook from it.

Conclusion

vRealize identity manager is becoming the central SSO tools for many VMware tools and suite. It is also know as WorkSpace One. vIDM is part of vRealize Automation also and at some points, really a concern for identity management and logging accross big organisation. I hope this article had help you go forward in this way.

Another day, another story! This blog is going to become a source of informations on my customers experiences with diffrent technologies like IoT, 3D Printing, Virtualization and Cloud concerns for sure.