Cisco StealthwatchEndpoint License and NVM Configuration Guide 7.3.2

Table of ContentsIntroduction 3

Overview 3

Requirements 3

Stealthwatch without a Data Store 3

Stealthwatch with a Data Store 3

Enhancements in Stealthwatch v7.3.2 4

Endpoint Concentrator Removal 4

Endpoint License Capabilities 4

Upgrading from 7.3.1 to 7.3.2 5

Configuration 6

Configure NVM profile on AnyConnect Secure Mobility Client 6

Configure the Flow Collector 9

Configure the Flow Collector for Off-Network Cached Flows (optional) 10

Install the Report Builder App (Data Store Only) 11

Downloading Report Builder 11

Installing Report Builder 11

Verification 12

Flow Search 12

Opening Report Builder (Data Store Only) 12

Contacting Support 13

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 2 -

IntroductionOverviewUse this guide to configure Stealthwatch and AnyConnect Secure Mobility Client NetworkVisibility Module (NVM) to allow:

l Storage of AnyConnect NVM fields

l Viewing the NVM fields

l Existing policy violation rules to trigger from NVM flows

Datagram Transport Layer Security (DTLS) is not supported.

RequirementsStealthwatch without a Data Store

l Stealthwatch v7.3.2 with Endpoint Licenseo For more information about Endpoint License, refer to the Stealthwatch SmartSoftware Licensing Guide 7.3

l Cisco AnyConnect Secure Mobility Client v4.7 and later

Stealthwatch with a Data Storel Stealthwatch v7.3.2 with Endpoint License

o For more information about Endpoint License, refer to the Stealthwatch SmartSoftware Licensing Guide 7.3

l Cisco AnyConnect Secure Mobility Client v4.7 and laterl Stealthwatch Report Builder app v1.4

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 3 -

Introduction

Enhancements in Stealthwatch v7.3.2Endpoint Concentrator RemovalStarting in v7.3.2, the Endpoint Concentrator is not needed for the Endpoint Licensedeployment, and the Flow Collector has been enhanced to process Network Visibility Module(NVM) data on all Stealthwatch deployments, including Data Store.

Due to this enhancement, the Endpoint Concentrator is not supported in v7.3.2.

Endpoint License CapabilitiesEndpoint License, which is now supported for Data Store, provides:

l Full visibility to the endpoint, including on-network and off-network data

l Visibility to any NVM fields from the Endpoint Traffic (NVM) report in the Report Builderapp

l A minimum of 30 days of storage of NVM data

l Improved processing and query performance

The following table provides performance estimates for a standard enterprise traffic profile(most customers):

Flows per second (FPS) Number ofFC 4210s

Number ofDS 6200s/ 31 Days

StorageNetFlow NVM

300,000 150,000 1 3

There are several factors that may affect your specific performance, such as numberof hosts, average size of flows, and more. While we do our best to represent the dataas fairly and accurately as possible, your environment may experience differentlimits.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 4 -

Introduction

Upgrading from 7.3.1 to 7.3.2If you are an existing Stealthwatch customer upgrading from 7.3.1 to 7.3.2, you will need toremove the Endpoint Concentrator and reconfigure your NVM deployment.

Remove your Endpoint Concentrator(s) and configure your Flow Collector using the followinginstructions:

1. Remove your Endpoint Concentrator(s) from your cluster using Central Management.

a. Open Central Management.

b. On the Appliance Manager page, click the (Ellipsis) icon in the Actionscolumn for the Endpoint Concentrator.

c. Select Remove This Appliance, then click Yes.

2. Configure flows from the NVM client to the Flow Collector using the ConfigureNVM profile on AnyConnect Secure Mobility Client section.

3. Update your cluster to v7.3.2 using the Stealthwatch Update Guide (v7.2.1 and v7.3.x tov7.3.2).

4. Add the NVM processing port to your Flow Collector Advanced Settings using theConfigure the Flow Collector section.

5. Verify NVM data is processed using the Report Builder app or Flow Search using theVerification section.

For assistance, please contact Cisco Stealthwatch Support.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 5 -

Introduction

ConfigurationConfigure NVM profile on AnyConnect Secure Mobility Client

The AnyConnect Profile Editor is available through Cisco Adaptive Security DeviceManager (ASDM) or as a standalone offering. For more information about how to usethe AnyConnect Profile Editor, refer to the AnyConnect Administrator Guide.

1. Verify you have installed the Network Visibility Module.

2. Open the Network Visibility Module Profile Editor.

3. In the Collector Configuration section, enter the IP Address and Port of your FlowCollector.

We recommend you use port 2030 rather than the default port, 2055. If port 2030 isalready in use, you may use any non-reserved port. Do not use ports 2055, 514, or8514. You will use this port in step 5 of the Configure the Flow Collector section.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 6 -

Configuration

4. Click File > Save to save your NVM Profile.

5. Close the NVM Profile Editor.

6. Open the VPN Profile Editor.

7. Click on Preferences (Part 2).

8. Check the Automatic VPN Policy check box.

9. For Trusted Network Policy, select Connect from the drop down.

10. For Untrusted Network Policy, select DoNothing from the drop down.

11. Enter your Trusted DNS Domains, Trusted Servers, and Certificate Hash.

l The Trusted DNS Domain should be the same domain that the Flow Collectoris running on. Wildcards (*) are supported for DNS suffixes.

l The Trusted Servers should be the IP addresses of the DNS servers on thenetwork.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 7 -

Configuration

12. Click File > Save to save your preferences.

13. Close the AnyConnect Profile Editor.

Make sure DTLS is disabled. In the Adaptive Security Device Manager (ASDM), goto Configuration > Remote Access VPN > Network (Client) Access > AnyConnectConnection Profiles, and uncheck the Enable DTLS check box if needed. For moredetails, refer to the AnyConnect Administrator Guide.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 8 -

Configuration

Configure the Flow Collector1. Log in to your SMC.

2. From the navigation menu, click the (Global Settings) icon and select CentralManagement.

3. Click the (Ellipsis) icon for your Flow Collector, then click View ApplianceStatistics. The Flow Collector Admin interface opens.

4. Click Support > Advanced Settings.

5. In the nvm_netflow_port field, set the value to the port specified in step 2 of theConfigure NVM profile on AnyConnect Secure Mobility Client section. For example, port2030.

If a field is not shown, scroll to the bottom of the page. Click the Add New Optionfield. For more information about editing advanced settings on the Flow Collector,refer to the Advanced Settings online help topic.

6. Click Apply.

7. When the confirmation message is shown, click OK.

8. To configure the Flow Collector for Offline Data Collection, continue to the next section.Do not close the Flow Collector.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 9 -

Configuration

Configure the Flow Collector for Off-Network Cached Flows(optional)Use the following instructions to configure cache flow processing for collecting off-networkNVM data.

Collecting off-network NVM data impacts system performance. Do not enable thisconfiguration if you do not need to collect or analyze this data.

If you enable the configuration and your system performance is impacted, adjust thethrottle rate (refer to the AnyConnect Administator Guide) and/or decrease the nvm_age_limit_days (refer to the instructions in this section).

1. Before you start this procedure, make sure you finish the previous procedures. You willcontinue this configuration in the Flow Collector engine Support > Advanced Settings.If the Flow Collector is closed, log in to it directly, or:

l Log in to your SMC.

l From the navigation menu, click the (Global Settings) icon and select CentralManagement.

l Click the (Ellipsis) icon for your Flow Collector, then click View ApplianceStatistics. The Flow Collector Admin interface opens.

l Click Support > Advanced Settings.

2. Update the following fields:

l process_old_nvm_flows: Enter 1 to enable cached flows.

l nvm_age_limit_days: Enter the maximum number of days to collect cachedflows.For example, if you enter 7, it collects the last 7 days. If you enter 0 (zero), there isno limit. For best performance, set a limited number of days.

If a field is not shown, scroll to the bottom of the page. Click the Add New Optionfield. For more information about editing advanced settings on the Flow Collector,refer to the Advanced Settings online help topic.

3. Click Apply.

4. When the confirmation message is shown, click OK.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 10 -

Configuration

Install the Report Builder App (Data StoreOnly)Downloading Report BuilderTo download Stealthwatch apps, log in to your Cisco Smart Account athttps://software.cisco.com or contact your administrator.

Installing Report BuilderUse the App Manager in Central Management to install Report Builder. We recommend thatyou use Chrome or Firefox for your browser. For app installation details, refer to the ReportBuilder Release Notes.

If you have a previous version of Report Builder installed, install the new version overthe existing version. Do not delete the Report Builder app. If you uninstall ReportBuilder, all files associated with it, including your saved reports and temporary files,are deleted.

1. Log in to your primary Stealthwatch Management Console.

2. Click the (Global Settings) icon.

3. Select Central Management.

4. Click the App Manager tab.

5. Click Browse.

6. Follow the on-screen prompts to upload the app file.

Required Available Disk Space: 600 MB on /lancope/var. Refer to the ReportBuilder Release Notes for more details.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 11 -

Install the Report Builder App (Data Store Only)

VerificationFlow Search1. Log in to your Stealthwatch Management Console.

2. Click Analyze > Flow Search.

3. Run a Flow Search.

4. On the Flow Search Results, filter the table by the Subject Process Name to verify youare getting NVM flows.

Opening Report Builder (Data Store Only)1. Log in to your Stealthwatch Management Console.

2. Select the Dashboards menu.

3. Select Report Builder.

4. Click Create New Report and select Endpoint Traffic (NVM).

5. Click Run.

6. Verify the report is showing NVM fields.

To access the online help for Report Builder, click the (Help) icon. The helpincludes instructions and details about the Endpoint Traffic (NVM) report.

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 12 -

Verification

Contacting SupportIf you need technical support, please do one of the following:

l Contact your local Cisco Partnerl Contact Cisco Supportl To open a case by web: http://www.cisco.com/c/en/us/support/index.htmll To open a case by email: tac@cisco.coml For phone support: 1-800-553-2447 (U.S.)l For worldwide support numbers: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved. - 13 -

Contacting Support

Copyright InformationCisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliatesin the U.S. and other countries. To view a list of Cisco trademarks, go to thisURL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are theproperty of their respective owners. The use of the word partner does not imply a partnershiprelationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are notintended to be actual addresses and phone numbers. Any examples, command displayoutput, network topology diagrams, and other figures included in the document are shown forillustrative purposes only. Any use of actual IP addresses or phone numbers in illustrativecontent is unintentional and coincidental.

© 2021 Cisco Systems, Inc. and/or its affiliates.

All rights reserved.