Configuring Byte25 Appliances

Configuring the Appliance for Data Collection & Export

The first part of the configuration process is to log into the Byte25 appliance and configure it for data collection and export to the Byte25 cloud server using the Byte25 Command Line Interface (CLI).

A basic configuration can be completed in just a few minutes requires the folowing steps:

1. Set the Customer ID
2. Set the Byte25 Cloud Server address
3. Set the IP Address (if not using DHCP)
4. Enable relevant data collection mechanism

Once the configuration is complete, the appliance should be visible from the cloud server dashboard after which time subsequent configuration can be undertaken remotely.

As of Release 2.5.0, Byte25 Appliances (with the exception of Branch appliances) are fully hardened and now act as a ‘dark’ device in the network. That is, the appliance does not have any open TCP/UDP ports nor will it respond to ICMP ping requests. This is intended for deployment in secure environments.

The only way to configure the Byte25 Hardened Appliance is to physically connect a keyboard and monitor to the appliance and login directly from the console. In the case of a Byte25 Virtual Appliance, the configuration must be done from the hypervisor console.

Accessing the CLI

For Byte25 physical appliances you will need an attached  keyboard and monitor to access the Byte25 console. For virtual appliances, the console needs to be accessed from the  hyper-visor management interface.

Use the following credentials to login and access the Byte25 CLI:

Username: admin
Password: byte25password 

Note that Branch Appliances can still be accessed via SSH, Branch Appliance default credentials are:

Username: admin
Password: byte25passwd

Configure IP Address (optional)

By default, the appliance will use DHCP on Ethernet port ‘eth0’. Even though the Byte25 Appliance has no open UDP/TCP ports, an IP address is required to establish outbound connections to the Byte25 Cloud server.

By default, Byte25 appliances use DHCP to obtain a management IP address. If you need to set a static IP address, use the setip command:

setip [interface] [static | dhcp | noip

or

setip [interface] static [IP address] [netmask] [gateway]

For example:
setip enp2s0 static 10.1.1.1 255.255.255.0 10.1.1.254

To see the list of available interfaces, use the showinterfaces or showconfig comands

Configuring Data Export (Setting Customer ID and Cloud Server URL)

The Byte25 hardware and virtual appliances do not store network performance or security data locally. The appliance must be configured to export data to a Byte25 Cloud based server.

To export data, the Byte25  Appliance needs to have a ‘Customer ID’ and the URL of the ‘Cloud Server’. The customer ID is a 12-character hexadecimal string that uniquely identifies your tenancy.

As part of the account creation, you should have received a Customer ID, if you are unsure of the ID please contact Byte25 support.

To set the Customer ID, use the setcustid command:

setcustid [customer ID]

For example:

setcustid 27badb594ea3

To set the Cloud Server URL, use the setcloudserver command:

setcloudserver [URL]

For example:

setcloudserver demo.byte25.com

Configure Data Collection

Byte25 appliances can be configured to collect performance and security data in several modes.   DPI Mode use the Byte25 deep packet inspection engine to analyse and classify network traffic.  NetFlow mode utilises flow based agents in external devices such as switches and routers to collect statistical information on network performance.

Configure Appliance for DPI Data Collection

If your subscription supports data collection via the Byte25 deep packet inspection engine (DPI), you will need to check that DPI is enabled on the appliance. You can confirm the status of DPI collection from the ‘showconfig’ command.

To enable/disable DPI, use:

setdpi <enable | disable>

If you are using DPI, you may need to also configure the relevant ‘capture’ port. A capture port is the port on with the appliance will listen for network traffic. The configured switch SPAN/mirror ports or network tap outputs will be connected to appliance capture ports.

Check the status of the capture ports with the ’showconfig’ command.  To alter the capture status of appliance ports, use:

setcapture <port name> <enable | disable>

Configure Appliance for NetFlow Data Collection

If your subscription supports data collection via NetFlow, you will need to check that NetFlow is enabled on the appliance. You can confirm the status of NetFlow collection from the ‘showconfig’ command.

To enable/disable NetFlow, use:

setnetflow <enable | disable>

You will also need to set the UDP port that the appliance will expect NetFlow data, to set the NetFlow listening port, use:

 setnetflowport <port number>

Configure Appliance for Threat Detection Collection

If your subscription supports Threat Detect data collection, you will need to check that the Threat Detection Engine is enabled on the appliance. You can confirm the status of Threat Detect from the ‘showconfig’ command.

To enable/disable Threat Detect, use:

 setthreatdetect <enable | disable>

Configure the Timezone

By default, Byte25 appliances are configured with a Sydney based time zone setting. The local time zone should be set for production installed Byte25 appliances.

To set the time zone, use:

settimezone <timezone>

A list of all available time zones can be obtained using:

settimezone list

The settimezone list’ command can also take a search string as a parameter to lessen the number of values returned, for example:

 settimezone list Australia

will return a list of all the time zones available in Australia. Note that time zones typically use a leading capital letter.

Completing and Verifying the Configuration

Once the initial config is complete check, check the configuration with the ‘showconfig’ command, if all looks good reboot the Byte25 appliance using the ‘reboot’ command and the new configuration will be made active.

At this point, connect to the Byte25 cloud server from a web browser and log into your tenancy to confirm that data is coming through from the appliance/.Note that it may take up to 10 minutes from the initial data export to occur.

As always, if you are having any issues, please contact Byte26 support at suppor@byte25.com for assistance.

Configuring the Byte25 Cloud Dashboard for Reporting & Analysis

The second part of the configuration process is to log into the Byte25 cloud server to configure the subnets and flow sources specific to your environment. This allows detailled analysis of network, application and cyber security information for individual sites, subnets and VLANs.

To complete this configuration, you must log into the Byte25 Cloud Dashboard. You should have received a logon for the Byte25 cloud server specific to your account. If you need assistance or a new account, please contact Byte25 at support@byte25.com.

If you encounter any issues with installation and configuration, please contact Byte25 support at support@byte25.com. We are always happy to assist and organise a remote desktopor teams session to help you get up and running with a minum of fuss.