Network Considerations

Required Network Configuration

Sensor External Network AccessConfigure your firewall to allow the following traffic from the sensor to the external internet:

[REQUIRED] Outbound HTTPS traffic from the sensor's Control interface to the Stealthwatch Cloud service hosted on Amazon Web Services.

[REQUIRED] Outbound traffic from the Control interface to an Ubuntu Linux server for downloading Linux updates

us.archive.ubuntu.com:443/TCP
us.archive.ubuntu.com:80/TCP

[REQUIRED] Outbound traffic from the Control interface to a DNS server for hostname resolution

[local DNS server]:53/UDP

[OPTIONAL] inbound traffic from a remote troubleshooting appliance to your sensor, for remote troubleshooting assistance

54.83.42.41:22/TCP

NOTE: If you use a proxy service, create a proxy exception for sensor Control interface IP addresses.Network Device Mirrored Traffic ConfigurationSee the following to configure mirrored traffic on network switches:

Cisco Switch Port Analyzer (SPAN) Configuration Examples

Juniper Port Mirroring Overview

NETGEAR Port Mirroring Overview

ZyXEL Port Mirroring Configuration Commands

Wireshark Wiki Switch Reference (for other switch manufacturers)

See the following to configure mirrored traffic on network taps:

Ixia Reference for NetOptics

Gigamon Reference Resources

Flow ConfigurationYou must configure your network device to pass NetFlow data. See https://configurenetflow.info/ or this Cisco NetFlow Configuration PDF to configure NetFlow on Cisco network devices.