SASE Installation

[#1]

The SASE Hybrid Cloud Configuration is a data driven design. The NetWitness Admin Server contains a script nw-create-cloud-hybrid that has a command --enable-cloud-sase, which will deploy the NetWitness Overlay Network, and the defined NetWitness Nodes in their respectively defined regions in the requested Cloud Platform. The 12.5.1.0 implementation supports deploying the overlay network and NetWitness nodes to the Google Cloud Platform (GCP). The recommended SASE deployment includes 3 cloud compute instances, a PPN-Server node to support Overlay Network communication, a NetWitness Decoder, and a NetWitness Concentrator. The deployed GCP based Decoder and Concentrator will have available storage based on the chosen host-model for each. The Decoder and Concentrator service and storage configuration must be completed after the SASE Deployment following the appropriate 12.5.1.0 NetWitness documentation.

GCP Prerequisites

1. Customer must have an On-Prem or cloud based NetWitness Admin Server at Version 12.5.1.0.

2. Customer must have a GCP Cloud Project.

3. Customer’s GCP Cloud Project must have enabled the following Google APIs.

   1. Cloud Compute API

   2. Cloud Resource Manager API

   3. Identity and Access Management (IAM) API

   4. Cloud DNS API

4. Customer’s on-prem Admin Server outbound network configuration must allow access to the external-ip of the ppn-server on UDP port 4242.

5. To deploy resources in the cloud, a service account credential file must be available on the NetWitness Admin Server that has the necessary permission to create vpcs, subnetworks, nats, disks, service accounts, and instances from images.

   1. To enable automated deployment of NetWitness resources to the customer’s GCP Cloud Project, a JSON based Service Account Key File must be generated.

   2. Create a Service Account with the Roles mentioned below. To create a Service Account and its key in GCP, refer to https://cloud.google.com/iam/docs/service-accounts-create and https://cloud.google.com/iam/docs/keys-create-delete.

      Note: These roles are the default OOTB GCP roles. Permissions can be future limited with custom role(s).

   1. Compute Admin

   2. IAP-secured Tunnel User

   3. Service Account User

   4. Storage Admin

   3. Provide the service account email to NetWitness to give access to the gcp image. Email can be found in the token as client_email or from GCP console go to IAM > Service Account.

   4. GCP JSON based service account file must be saved to the On-Prem NetWitness Admin Server to /root/.gcp/gcp-auth-token.json. This is the expected default location of the NetWitness Installation scripts. The JSON token file can be stored in another location on the NetWitness Admin Server, but it will require passing in that location during the SASE deployment installation.

   5. GCP JSON Service Account File must be like:

      {

      "type": "service_account",

      "project_id": "nw-nwp-xxx",

      "private_key_id": "d143529509c56b28e7186fea465XXXXXXXXXXXXX",

      "private_key": "-----BEGIN PRIVATE KEY-----<private key>-----END PRIVATE KEY-----\n",

      "client_email": "<email associated with service account>",

      "client_id": "<client id>",

      "auth_uri": "https://accounts.google.com/o/oauth2/auth",

      "token_uri": "https://oauth2.googleapis.com/token",

      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<service account name>",

      "universe_domain": "googleapis.com"

      }

      Note: The Service Account has significant privileges and should be disabled in GCP for security purposes when not required by a NetWitness SASE Deployment or Validation Action via the nw-create-cloud-hybrid script.

6. The customer’s cloud project can access the NetWitness Production Project that hosts the cloud image that matches the version of the On-Prem NetWitness Admin Server. The minimum NetWitness version is 12.5.1.0.

   GCP Details

   1. The NetWitness GCP production project name is: nw-onprem-images-prod.

   2. This project name MUST be provided as the value for the “image_project” attribute in the sase-deployment-models.yml configuration file prior to SASE Deployment. Details are provided in the later sections.

   3. The NetWitness SASE Image Name will look like: rsa-nw-12-5-1-0-<build #>-lite. The build number can be found in the initial lines of the /etc/netwitness/component-descriptor/data/nw-component-descriptor.json file on the NetWitness Admin Server.