PCA requirements for a Microsoft Azure virtual machine

Before you install the PCA into a Microsoft Azure virtual machine, make sure that the virtual machine meets the hardware and software requirements for the PCA software. The hardware and software requirements are identified in a pre-installation checklist.

The following items are also required:

• Each server that hosts a web server instance, must have one CPU core that is dedicated to running the packet forwarder service. Minimum core speed is 2.0 GHz.
• If the web server application and packet forwarder instances are installed on Linux™ Red Hat, a minimum version of RHEL 6.4 is required.
• It is recommended to disable SELinux. If it is enabled, configure the firewall settings to allow communication on the ports that are used by the packet forwarders and packet listeners.
• If the web server instance is using a 64-bit version of Linux Red Hat, 32-bit versions of glibc and zlib must be deployed during the installation process.
• On the PCA server, each packet listener service requires four CPU cores. Each CPU core must be 2.0 GHz or higher and have 8 GB of dedicated memory.
• Configure your firewall settings to allow communication on port 1888. The communication ports incrementally increase by one for each additional packet forwarder that is deployed. If five packet forwarders are deployed, then ports 1888-1892 must be open. The ports are used by the packet forwarders to send information to the packet listeners, which process the data at the PCA.

Installing the packet forwarder

Note: The maximum number of web server instances must be known before the installation process. The number of web server instances is used in the configuration of the packet forwarder to determine the maximum number of active TCP connections that can connect to the destination PCA socket receiver.

Note: You must be logged in as a root user to perform all PCA-related installations. Performing an installation using another account may prevent the necessary permissions that are required to successfully install the software.

Use the installation rpm to install the packet forward on each web instance. The default installation directory is /usr/local/ctccap. You can use the --prefix option when performing the installation command to install the software to another directory.

To install the software, run rpm -ivh --prefix=/opt/tealeaf tealeaf-pktfwdr-xxxx-1.SUSE11.i586.rpm where xxxx is the version number of the PCA software.

The packet forwarder requires an extra 32-bit library if you are installing the packet forwarder to a 64-bit version of Linux. To install all of the dependent libraries, run the following command:

Run zypper clean -a to clear the local rpm cache.

The following files are used to configure and run the packet forwarder.

Configure the packet forwarder by editing the /etc/fwdr-conf.xml configuration file.

1. Edit the PrimaryInterface tag to add the virtual NIC device name that the packet forwarder uses to capture the web server's traffic. In most installations, the NIC device name is eth0.
2. Locate the ListenTos tag and add any additional ports that you want to capture traffic from to the configuration file. Port 80 and 443 are listed by default.
3. Locate the Delivery tag and edit the Address and Port tags with the IP address and port number of the virtual machine that is hosting the centralized PCA server.

   Note: Each packet forwarder and listener pair uses one port. The default port number is 1888. When multiple pairs are used, the port address defines the first port number that is used to define a block of port numbers. For example, if you are capturing traffic from five web servers, then five packet forwarder and packet listener pairs are used to capture the traffic. In this scenario, ports 1888 - 1892 are used.

4. Edit the Address tag to define the IP address or host name of the PCA. This the IP address of the virtual machine.
5. Edit the Port tag to define the port number for the network connection. Each packet forwarder requires a unique port number to identify a unique network connection to the centralized PCA VM instance. The port numbers must be assigned in sequential order. This is required by the PCA's socket receiver when configuring it for the packet forwarders' network connections. If you decide to start with port number 1888 for the first packet forwarder, then defining five of them would be ports 1888 - 1892 explicitly.
6. Edit the MaxRotatePeers tag to define the maximum number of web server instances that are dynamically provisioned. The default value is 1. If you are capturing traffic from five web servers, then set this value to 5.

   Note: If you are statically assigning a fixed number of web server instances with associated packet forwarders, then the MaxRotatePeers would remain set to the default value of 1. Each packet forwarder would needs to be configured with a unique Port number to identify a unique network connection to the centralized PCA VM instance. The port numbers must be assigned in sequential order. This is required by the PCA's socket receiver when configuring it for the packet forwarders' network connections. If you decide to start with port number 1888 for the first packet forwarder, then defining five of them should be 1888 - 1892 explicitly.

7. Save you changes to the /etc/fwdr-conf.xml file.

Installing a centralized PCA in a Microsoft Azure virtual machine

A centralized PCA is used to receive communication from the packet forwarders that are deployed to the web server instances in your cloud environment. Installing the PCA software to a virtual machine is similar to the installation process on a physical server. Use the following process to install the PCA software to a virtual machine.

1. Install the PCA software to your virtual machine.

   In the native Azure image for Suse 11 SP3 (64 bit), the following 32-bit dependent libraries are needed:

   • libgcc_s1-32bit-4.7.2_20130108-0.17.2.x86_64.rpm
   • libuuid1-32bit-2.19.1-6.54.1.x86_64.rpm
   • libxml2-32bit-2.7.6-0.25.1.x86_64.rpm
   • libstdc++6-32bit-4.7.2_20130108-0.17.2.x86_64.rpm
   • zlib-32bit-1.2.7-0.10.128.x86_64.rpm

   To install the 32-bit libraries, run zypper install zlib-32bit-1.2.7-0.10.128.

   After the libraries are extracted to the disk, run zypper clean -a to clear the local rpm cache.

   Note: You have already installed the packet forwarders to your web server instances.

2. Log on to the PCA web console.
3. Go to the Delivery tab and edit the delivery settings for your environment.
4. Go to the Pipeline tab and edit the Pipeline Instances setting to configure the number of pipeline instances for your configuration.
5. Select Save Changes to save your updated configuration settings.

   Note: Do not restart the PCA server.

6. Edit the PCA configuration file by opening /usr/local/ctccap/etc/ctc-conf.xml in a text editor.
7. Go to the Capture tag settings and edit the following settings.
   • Set ListenerSocketEnabled to true
   • Set TransparentLoadBalancingEnabled to false
   • Set SslSessionInfoOnMemcachedServer to false

     Note: If the PCA server is configured to decrypt SSL traffic from the packet forwarders, set SslSessionInfoOnMemcachedServer to true.

8. Go to the Listener tag settings and edit the following settings.
   • Set BasePort to match the port number that is defined in the ListenTos settings of the packet forward configuration file. The packet forwarder configuration file can be accessed by opening /etc/fwdr-conf.xml on a web server instance.
   • Set Instances to equal the number of packet forwarders that the PCA connects to.
9. Save your changes to /usr/local/ctccap/etc/ctc-conf.xml.
10. Run tealeaf restart to restart the PCA services.

Starting the PCA server and packet forwarders

It is recommended to start the central PCA server before you start the packet forwarders. If the packet forwarders are started before the PCA server is running, they can experience network timeout conditions that and cause a delay in the time it takes to connect with the PCA server.

To start the PCA server, run /usr/local/bin/tealeaf start all from the virtual machine that is hosting the PCA server.

To start a packet forwarder instance, run service pktfwdr start from each web server instance.

To stop a packet forwarder, run service pktfwdr stop from each web server instance.

To check the operational status of a packet forwarder, run service pktfwdr status from each web server instance.

To view the available metrics of a packet forwarder, run /opt/tealeaf/bin/ctcstats -p from each web server instance.

To test that a packet forwarder is connecting to the PCA server, use the netstat utility. If the port connection is configured for port 1888, run netstat -an|grep 1888. The output returns a status of ESTABLISHED if the packet forwarder is connected to the PCA server. If a connection is not established, the firewall rules for your network might not be configured to allow communication between the packet forwarders and the PCA server. Check your network configuration settings for the packet forwarders and your PCA server, then make sure that your firewall settings allow communication on those network settings.