Sophos NDR on ESXi or Hyper-V

If you're using ESXi, port mirroring involves the following steps:

• Configure virtual switches.
• Configure a physical switch.

Configure virtual switches

To set up port mirroring for virtual, internal switches, do as follows:

1. In ESXi, go to Networking. On the Virtual switches tab, select a switch to use for port mirroring.

If you don’t already have a switch to use, click Add standard virtual switch to add a new one and add port groups to it.

1. On the Port groups tab, click Add port group.

   

2. In the settings for the new port group, do as follows:

   1. Enter a name.
   2. Set the VLAN ID to 4095. This allows all other port groups already on the switch to forward traffic to the new port group.
   3. Click Security and set Promiscuous mode to Accept.
   4. Click Add.

   

   You've set up forwarding for your virtual internal network traffic. Next do the same for physical external traffic, as described in the steps that follow.

3. In ESXi, select or create another virtual switch that will handle physical external traffic sent to it by a physical switch on your network.

4. Configure the switch as follows:

   1. Go to Port groups and click Add port group.
   2. Enter a name.
   3. Set VLAN ID to 4095.
   4. Click Security and set Promiscuous mode to Accept.

Next you connect your virtual switch to your physical network so that it can receive external traffic.

1. In the ESXi left menu, go to Networking and select the switch you want to use for external traffic.

   

2. In the switch details, look for vSwitch topology. You can see “No physical adapters”.

   

3. Click Add uplink.

   

4. In Uplink 1, select a NIC (Network Interface Card) that's available. This connects the virtual switch to a port on your ESXi server.

   

5. In Network topology, check that you can see a physical adapter connected.

   

6. Go to your physical switch and use a cable to connect directly to the port on your ESXi server.

Next you need to set up mirroring on your physical switch.

Configure a physical switch

This section describes setting up port mirroring on a Sophos switch. Setup steps for other switches differ.

To set up mirroring, do as follows:

1. In Sophos Central go to Switches.

2. Select the switch you want to configure and click Run commands.

   

3. In the Run switch commands console, enter the commands to mirror all traffic. In this example, the commands will mirror all incoming and outgoing traffic on ports 1-4, and send it out on port 8.

configure terminal
monitor session 1 destination interface gigabitethernet 0/8 allow-ingress
monitor session 1 source interface gigabitethernet 0/1 both
monitor session 1 source interface gigabitethernet 0/2 both
monitor session 1 source interface gigabitethernet 0/3 both
monitor session 1 source interface gigabitethernet 0/4 both
save
end
show monitor session 1

![Switch command-line console.](../../../../images/ndr-switch-commands.png)

1. Click Execute. The console shows the commands as they run on a green background.

   

2. When the last command is run, the console shows the completed configuration. Click Close.

   

You've finished setting up forwarding of traffic to SPAN ports. Later you'll configure Sophos NDR to monitor that traffic.

If you're using Hyper-V, port mirroring involves the following steps:

• Configure a traffic mirroring port with Hyper-V.
• Attach a SPAN Virtual Interface to the virtual switch.
• Turn on Microsoft NDIS capture extensions.
• Configure the switch's mirroring mode.
• Validate traffic mirroring.

For instructions, see Configure traffic mirroring with a Hyper-V vSwitch.

1. Go into your ESXi host.

2. Select Virtual Machines and click Create/Register VM.

   

3. In Select creation type, select Deploy a virtual machine from an OVF or OVA file. Click Next.

   

4. In Select OVF and VMDK files, enter a VM name.

   Click the page to select files. Select the OVA file ndr-sensor.ova. Click Next.

   

5. In Select storage, select Standard storage. Then select the datastore where you want to put your VM. Click Next.

   

6. In Deployment options, enter settings as follows.

   1. In SPAN1, select the port group that will receive SPAN traffic for the NDR application. You configured this earlier. See Configure your switches.

   2. In SPAN2, select a second port group that will receive SPAN traffic and needs monitoring (if you have one). For example, you might have a physical switch and a vSwitch that doesn't send traffic to the physical switch.

      If you use SPAN2, you must increase the number of CPUs for the VM to at least 8. See Sophos NDR appliance size guide.

   3. SYSLOG isn't needed for Sophos NDR. Select any port group as a placeholder and disconnect it in the VM settings later.

   4. In MGMT, select the management interface. This interface lets the appliance send data to Sophos Central.

      You set up this interface earlier in Sophos Central in Internet-facing network port settings.

      If you selected DHCP during appliance setup, make sure the VM can get an IP address via DHCP.

   5. In Disk Provisioning, make sure Thin is selected.

   6. Make sure Power on automatically is selected.
   7. Click Next.

   

7. Skip the Additional settings step.

8. Click Finish. Wait for the new VM to appear in the VMs list. This can take a few minutes.

   

9. Power on the VM and wait for the installation process to complete.

   The VM boots for the first time and checks that it can connect to the correct vSwitches and to the internet. Then it reboots. This can take up to 10 minutes.

   Warning

   Don't interrupt this process.

10. In Sophos Central, go to the NDR Integrations page and refresh it. The VM's status is now Connected.

    

If the status of the VM is Connected but it doesn't appear to be working, check the status of the Dragonfly service in the Sophos VA console for NDR. See Sophos VA Console.

If you see in the console that the Dragonfly service is in Pending state, and your VM is in an Enhanced vMotion Compatibility (EVC) cluster, check that the EVC mode is Skylake or later.

The Sophos NDR VA doesn't support running in EVC clusters in Sandy Bridge mode.

The Zip file you downloaded in Sophos Central contains the files you need to deploy your VM: virtual drives, seed.iso, and a Powershell script.

To deploy the VM, do as follows:

1. Extract the Zip file to a folder on your hard drive.
2. Go to the folder, right-click the ndr-sensor.ps1 file, and select Run with PowerShell.

3. If you see a Security Warning message, click Open to allow the file to run.

   You're prompted to answer a series of questions.

4. Give the VM a name.

5. The script shows the folder where the VM files will be stored. This is a new folder in your default installation location for virtual drives. Enter C to allow the script to create it.
6. Enter the number of processors (CPUs) to use for the VM.
7. Enter the amount of memory to use in GB.

8. The script shows a numbered list of all your current vSwitches.

   Select the vSwitch you want to attach the management interface to and enter its number. This interface lets the appliance send data to the Sophos Data Lake.

   You set up this interface earlier in Sophos Central in Internet-facing network port settings.

   If you selected DHCP during setup, make sure the VM can get an IP address via DHCP.

   

9. You don't need to enter a vSwitch for the syslog interface. This is only relevant for third-party product integrations.

   Select any vSwitch as a placeholder and disconnect it in the VM settings later.

10. Select the vSwitch that will receive SPAN traffic for the NDR application. You configured this earlier. See Configure your switches.

11. Optionally, select a second vSwitch that will receive SPAN traffic and needs monitoring (if you have one). For example, you might have a physical switch and a vSwitch that doesn't send traffic to the physical switch.

    If you use a second vSwitch, you must increase the number of CPUs for the VM to at least 8. See Sophos NDR appliance size guide.

12. The PowerShell script sets up the VM in Hyper-V. You'll see an Installation Completed Successfully message.

13. Use any key to exit.

14. Open the Hyper-V Manager to see the VM added to the list of virtual machines. If you need to change any settings, you can. Then power it on.

    The VM boots for the first time and checks that it can connect to the correct vSwitches and the internet. Then it reboots. This can take up to 10 minutes.

15. In Sophos Central, go to the Integrations page for the product you're integrating and refresh it. The VM's status is now Connected.