Faddom Help Center

Setting up network traffic collection in VMware

Run VMware Discovery

Open the Getting Started wizard if it is not open yet (Help -> Getting Started).

Select VMware under Data Sources, enter login credentials to vCenter, and click Discover (See the required permissions here What are the required vCenter permissions?). 

After the discovery has completed, Faddom will detect the type of switches you are using and will allow you to either setup Netflow or deploy sensors. One of these two must be completed in order for Faddom to function.

Netflow

Select the distributed switches for which you would like to receive netflow, then click Enable Netflow. Faddom will perform all the necessary configuration in the environment and will validate that it is receiving netflow.

To configure Netflow manually or if you are using NSX-T, please see the following guide: Configure Netflow In VMware

 

Sensor Deployment

If you are using standard switches or if you want to enable full packet analysis (required to discover SSL certificates), you need to use the sensor deployment feature. Here, Faddom will deploy a lightweight VM to each of your ESX hosts and configure them so that the can collect all of the traffic for that host.

In order to deploy the sensors, the sensor template must first be copied to a content library on vCenter. Select the datastore for that content library (Approximately 1GB of free space is required).

Next, select the hosts you would like to deploy on, provide a free IP address for each of the sensors, and select the datastore and port group to allow the sensors to communicate back to the Faddom server.

Click on Deploy Sensors to have Faddom deploy to each of the hosts. This may take some time, you may navigate away from the page, a notification will be shown once deployment is complete. You can see a full list of the changes Faddom will perform on your vCenter environment here: What are the configuration changes the auto deployment performs?

In case you have a vCenter version prior to 6.5, you will need to perform the deployment manually or using a powershell script. See details here:

Configuring a vSwitch with promiscuous mode

Deploying Faddom Sensors Using Powershell

Was this article helpful?
0 out of 0 found this helpful

Comments