Deploy and VM Installation#

Base Install and Configuration#

This procedure installs the base system, and involves the following tasks:

  • Download the OVA.

  • Deploy the OVA.

  • Run the VM.

  • Log in as admin.

  • Change your password.

  • Configure network settings.

  1. Download the OVA for your system to a directory accessible by the VM client.

  2. Deploy the OVA:

    1. Select the downloaded OVA file, and choose a VM name.

      ../../../_images/insights-deploy-ova.png

    2. Configure storage settings via the Select storage menu, based on the recommended hardware specifications for the required configuration.

      See the VMWare Specification and Requirements for your system.

    3. Configure the network mappings based on the recommended hardware specifications for the required configuration.

      See the VMWare Specification and Requirements for your system.

  1. Run the VM, and monitor installation of the packages (this may take some time).

    ../../../_images/analytics-install-2.png

    Once all packages are installed, the VM is automatically powered off, confirmed via the auto-poweroff message on the console.

    ../../../_images/insights-install-3.png

    The system reboots. Wait until you see the About console, which displays placeholder values for hostname, version, license, days licensed and remaining, and so on.

                        About
===============================================
      Hostname:  <hostname>
       Version:  <version>
         Theme:  <theme>
        Flavor:
       License:  NNNNN-NNNNN-NNNNN-NNNNN-NNNNN
 Days Licensed:  nnnnn
Days Remaining:  nnnnn
   Product Key:
       Website:  <website>
        Kernel:  Linux n.nn.nn-lxt-3 x86_64 GNU/Linux

<hostname> login:

  2. Log in:

    • On the About console, at <hostname> login:, log in as admin. For the password, use the last 10 characters of the value at License, excluding the dash.

      Important

      The License key value is only displayed on the About console. When you ssh in, it is not visible, thus, you must copy the admin password from the About console.

    • Once logged in, the Administration menu displays (the image displays an example for DS9):

      ../../../_images/insights-install-6.png

  3. Change your password:

    On the Administration menu, select Change Passwords, then change your password.

    Note

    • It is strongly recommended that you change your password immediately.

    • The Reset GUI admin user option on the allows for this admin user’s password reset.

      ../../../_images/su-admin-ldap-passw.png

  4. Configure network settings:

    1. On the Administration menu, select Network Configuration.

    2. Configure interface settings via the Interface Settings menu:

      1. Select the relevant interface.

        ../../../_images/insights-install-7.png

      2. Select IPs, then set the IP address and netmask in the format nn.nn.nn.nn/24, and save your changes.

        ../../../_images/insights-install-IP.png

    3. Configure the default gateway via the Extra Routes menu.

      ../../../_images/insights-install-7.png

      • Use the following format for the entry: default <gateway IP address>

      • The word default is required. For additional route entries use the <subnet> < gateway> format. Similar to what would be done on a Linux system at the CLI.

      ../../../_images/insights-install-8.png

    4. Configure DNS settings via the DNS Settings menu:

      ../../../_images/dns-settings-1.png

      1. Select DNS Servers.

        ../../../_images/dns-settings-2.png

      2. Add the IP address for each DNS server, one per line, then click OK.

        ../../../_images/dns-settings-3.png

      3. Click Save.

        ../../../_images/dns-settings-4.png

    5. Configure the hostname via the Hostname menu, then save to trigger the update.

      The console displays a message, Updating hosts. This setup may take a few minutes.

      ../../../_images/insights-install-9.png

    6. Update SSL ciphers via the Apache Config menu.

      SSLCipherSuite HIGH: !MEDIUM: !ADH: !LOW

      Note

      • SSLCipherSuite defaults to HIGH encryption.

      • For SSLProtocol, only TLSv1.2 is supported.

      • OpenLDAP defaults to HIGH encryption.

      • OpenSSH does not support weak ciphers.

      ../../../_images/insights-install-9.png

    7. Configure SSH settings via the SSH Config.

      Custom entries can be added, if required. The following entries have been added:

      kexalgorithms
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
hostkeyalgorithms
ssh-rsa

    8. Configure SSHD via the SSHD Config menu.

      Note

      • Multi-line entries can be added, if required. For example, for CUCM v11.5 support, see: Multi-line CUCM Cipher Support.

      • This step is relevant only to an Insights Assurance solution and its integration with Cisco UC systems. This step is not relevant to the DS9 and Insights NetFlow solution.

    9. Enable/disable FTPD or restart the FTPD daemon:

      1. On the Administration menu, select Network Configuration.

      2. Select FTPD Config.

        Important

        On new installs, the FTPD daemon is disabled by default.

        It is strongly recommended that the FTPD daemon remains disabled, unless there is a good reason you need to use it. It has been seen that enabling the FTPD daemon may introduce a system vulnerability.

        FTPD is typically only required in rare situations, where FTP is the only way to transfer files to the server. Instead of using FTPD, it is recommended that you use the drop account with SCP or SFTP.

        The drop account username is “drop”. You can set the password via the Administration menu.

        ../../../_images/insights-network-config-ftpd.png

  5. Base system installation is now complete. Select Quit to exit the Administration menu on the console.

    Continue with product registration, and with the configuration of your system through the GUI:

Multi-line CUCM Cipher Support#

This section provides details for the use of the SSHD Config menu option.

Note

This section is not relevant to the DS9 and Insights NetFlow solution. This solution is relevant only to an Insights Assurance solution and its integration with Cisco UC systems.

You can copy the keys into the screen in a comma separated list (without spaces).

For CUCM v11.5 support:

kexalgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
ciphers aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
macs hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
hostkeyalgorithms ssh-rsa,ssh-dss