Installing External Data Feeder for NFO

Starting with release 2.7 both NetFlow Optimizer and EDFN are installed from the same installer.

In certain cases you may need to install EDFN on a separate machine (e.g. in your DMZ) or you may need to install several EDFNs for one NFO instance (e.g. EDFN-1 installed with NFO feeding data from VMWare environment, EDFN-2 in DMZ to feed GeoIP from Maxmind and security threat lists, and EDFN-3 on Windows connecting to your Active Directory Domain controllers to provide login events for user name enrichment).

If you need only one EDFN installed with NFO, you can skip this section.

Disabling Default EDFN Instalation

If you are going to install EDFN separately from NFO, you may need to disable default EDFN installation.

Procedure

Go to the default EDFN directory /opt/nfi-updater and perform the following: ./register_daemon.sh -u

Linux RPM Installation

Download the External Data Feeder for NFO RPM package.

Procedure

To begin the RPM installation of External Data Feeder for NFO in the default directory /opt/nfi-updater perform the following:

Open a shell prompt and enter the following command to begin the installation rpm –ihv <RPM-package>

To begin the RPM installation of External Data Feeder for NFO in another directory, perform the following:

Open a shell prompt and enter the following command to begin the installation rpm –ihv --relocate /opt=<new-path> <RPM-package>

A message will display indicating that the External Data Feeder for NFO installation has been successfully completed.

Linux TAR Installation

Download the External Data Feeder for NFO TAR package.

Procedure

To begin the TAR installation of External Data Feeder for NFO in the default directory /opt/nfi-updater perform the following:

1. Open a shell prompt and enter the following command to un-compress the installer tar zxvf <TAR-package> -C /opt/nfi-updater
2. Go to the /opt/nfi-updater directory and enter the following command to begin the installation setup.sh -i

To begin the TAR installation of External Data Feeder for NFO in another directory, perform the following:

1. Open a shell prompt and enter the following command to un-compress the installer tar zxvf <TAR-package> -C <directory>
2. Go to the directory and enter the following command to begin the installation setup.sh –i

A message will display indicating that the External Data Feeder for NFO installation has been successfully completed.

Windows Installation

Download the External Data Feeder for NFO Windows installation package.

Procedure

To begin the Windows installation of External Data Feeder for NFO perform the following:

1. Open the installation file and click ‘Run’ to launch the installer and Click ‘Next’ To begin the ‘External Data Feeder for NFO Setup’
2. Click ‘Next’ to install External Data Feeder for NFO in the default location: C:\Program Files\NetFlow Logic\NetFlow Integrator Updater
3. Click on ‘Install’ To begin the installation (follow the installation steps)
4. Click on ‘Finish’ to complete the installation and exit the installer

A message will display indicating that the External Data Feeder for NFO installation has been successfully completed.

EDFN Installed Separately or Several EDFNs Installations

note

If External Data Feeder for NFO is installed on a separate server, or if you have several EDFNs connected to one NFO, perform the following:

1. Stop EDFN service

   • for Linux OSes which support systemd use command systemctl stop nfi_updd
   • for Linux OSes which support OpenRC use command rc-service nfi_updd stop
   • for other Linux OSes use command service nfi_updd stop
   • for Windows OSes use Microsoft Management Console snap-in "Services"

2. Change uri parameter in updater.properties file located in /opt/nfi-updater/conf (In Windows C:\Program Files\NetFlow Logic\NetFlow Integrator Updater\conf) to IP address or DNS name of NetFlow Optimizer

   uri = https://<nfo-host>:8443

3. If this is your second EDFN instance, set a unique EDFN identifier in uid

   uid = EDFN2

4. Copy Java KeyStore and TrustStore from EDFN installed with NFO ($EDFN1_HOME) to EDFN installed on a separate machine ($EDFN2_HOME)

From	To
$EDFN1_HOME/conf/.updater_keystore	$EDFN2_HOME/conf/.updater_keystore
$EDFN1_HOME/conf/.updater_truststore	$EDFN2_HOME/conf/.updater_truststore

5. Start EDFN service

   • for Linux OSes which support systemd use command systemctl start nfi_updd
   • for Linux OSes which support OpenRC use command rc-service nfi_updd start
   • for other Linux OSes use command service nfi_updd start
   • for Windows OSes use Microsoft Management Console snap-in "Services"

What to do next

• Verify that NetFlow Optimizer and External Data Feeders for NFO are connected. In NFO GUI go to External Data Feeders on the left navigation bar
• If you require Proxy Server authentication before External Data Feeder for NFO can access external URLs, see Proxy Server Configuration section in EDFN Administration Guide for further instructions.
• If you installed two or more EDFNs and would like to select agents per EDFN, see EDFN Agents Configuration section in EDFN Administration Guide for further instructions.