Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Installing the ATP Appliance Virtual Core OVA

Juniper’s Advanced Threat Prevention extensible deployment options include a Virtual Core (vCore) detection engine product as an Open Virtual Appliance, or OVA, that runs as a virtual machine. Specifically, an OVA-packaged image is available for VMware Hypervisor for vSphere 6.5, 6.0, 5.5, and 5.0.

The OVF package consists of several files contained in a single directory with an OVF descriptor file that describes the ATP Appliance virtual machine template and package (metadata for the OVF package and a ATP Appliance software image). The directory is distributed as an OVA package (a tar archive file with the OVF directory inside).

Juniper generates an .ovf and a .vmdk file for every ATP Appliance build. Download both the OVF and the VMDK into the same directory. Then, from the vSphere client, click on File -> Deploy OVF Template. Choose the .ovf file and then complete the deployment of the ovf wizard. The configuration wizard prompts for collector/core properties such as IP address, hostname, device key. Log in to the CLI and configure each setting.

vCore Provisioning Requirements and Sizing Options

Table 1: Provisioning Requirements

VM vCenter Version Support

Recommended vCore ESXi Hardware

vCore CPUs

vCore Memory

VM vCenter Server Versions: 6.5, 6.0, 5.5, and 5.0

vSphere Client Versions: 6.5, 6.0, 5.5, and 5.0

ESXi version: 6.0, 5.5.1, and 5.5

Processor speed 2.3-3.3 GHz

As many physical CORES as virtual CPUs

Hyperthreading: either enable or disable

CPU Reservation: Default

CPU Limit: Unlimited

Hyperthreaded Core Sharing Mode: None (if Hyperthreading is enabled on the ESXi)

Memory Reservation: Default

Memory Limit: Unlimited
Table 2: Sizing Options

Model

Number of vCPUs

Memory

Disk Storage

v500M

8

32 GB

Disk 1: 512 G

Disk 2: 1 TB

v1G

24

96 GB

Disk 1: 512 G

Disk 2: 2 TB

Install the ATP Appliance OVA to a VM

Note:

Starting in release 5.0.5, Windows 10 sandbox is supported (in addition to Windows 7) for behavior analysis. Windows 10 sandbox requires “nested hypervisor support” or “guest VM hypervisor support” enabled from vSphere. See instructions for “Enable Nested Virtualization for Windows 10 Sandboxing” at the end of this page.

  1. Download the ATP Appliance OVA file from the location specified by your ATP Appliance support representative to a desktop system that can access VMware vCenter.
  2. Connect to vCenter and click on File>Deploy OVF Template.
  3. Browse the Downloads directory and select the OVA file, then click Next to view the OVF Template Details page.
  4. Click Next to display and review the End User License Agreement page.
  5. Accept the EULA and click Next to view the Name and Location page.
  6. A default name is automatically created. Optionally, enter a new name for the Virtual Core.
  7. Choose the Data Center on which the vCore will be deployed, then click Next to view the Host/Cluster page.
  8. Choose the host/cluster on which the vCore will reside, then click Next to view the Storage page.
  9. Choose the destination file storage for the vCore virtual machine files, then click Next to view the Disk Format page. The default is THICK PROVISION LAZY ZEROED which requires 512GB of free space on the storage device. Using Thin disk provisioning to initially save on disk space is also supported.

    Click Next to view the Network Mapping page.

  10. Set up the vCore interface:

    • Management (Administrative): This interface is used for management and to communicate with the ATP Appliance Traffic Collectors. Assign the destination network to the port-group that has connectivity to the CM Management Network IP Address.

    • Click Next to view the ATP Appliance Properties page.

  11. IP Allocation Policy can be configured for DHCP or Static addressing-- Juniper recommends using STATIC addressing. For DHCP instructions, skip to Step 12. For IP Allocation Policy as Static, perform the following assignments:

    • IP Address: Assign the Management Network IP Address for the vCore.

    • Netmask: Assign the netmask for the vCore.

    • Gateway: Assign the gateway for the vCore.

    • DNS Address 1: Assign the primary DNS address for the vCore.

    • DNS Address 2: Assign the secondary DNS address for the vCore.

  12. Enter the Search Domain and Hostname for the vCore.
  13. Complete the ATP Appliance vCore Settings:

    • New ATP Appliance CLI Admin Password: this is the password for accessing the vCore from the CLI.

    • ATP Appliance Central Manager IP Address: If the virtual core is stand-alone (no clustering enabled) or Primary (clustering is enabled), the IP address is 127.0.0.1. If the virtual core is a Secondary, the Central Manager IP address will be the IP address of the Primary.

    • ATP Appliance Device Name: Enter a unique device name for the vCore.

    • ATP Appliance Device Description: Enter a description for the vCore.

    • ATP Appliance Device Key Passphrase: Enter the passphrase for the vCore; it should be identical to the passphrase configured in the Central Manager for the Core/CM. Click Next to view the Ready to Complete page.

  14. Do not check the Power-On After Deployment option because you must first (next) modify the CPU and Memory requirements (depending on the vCore model--either 500Mbps, or 1Gbps. Note that it is important to reserve CPU and memory for any virtual deployment.
  15. To configure the number of vCPUs and memory:

    1. Power off the virtual collector.

    2. Right click on the virtual collector -> Edit Settings

    3. Select Memory in the hardware tab. Enter the required memory in the Memory Size combination box on the right.

    4. Select CPU in the hardware tab. Enter the required number of virtual CPUs combination box on the right. Click OK to set.

  16. To configure CPU and memory reservation:

    1. For CPU reservation: Right click on vCore-> Edit settings:

    2. Select Resources tab, then select CPU.

    3. Under Reservation, specify the guaranteed CPU allocation for the VM. It can be calculated based on Number of vCPUs *processor speed.

    4. For Memory Reservation: Right click on vCore -> Edit settings.

    5. In the Resources tab, select Memory.

    6. Under Reservation, specify the amount of Memory to reserve for the VM. It should be the same as the memory specified by the Sizing guide.

  17. If Hyperthreading is enabled, perform the following selections:

    1. Right click on the vCore -> Edit settings.

    2. In the Resources tab, select HT Sharing: None for Advanced CPU.

  18. Power on the Virtual Core (vCore).
  19. Log into the CLI and use the server mode “show uuid” command to obtain the UUID; send to Juniper to receive your license. Refer to the Operator’s Guide for licensing instructions.
Note:

When an OVA is cloned to a create another virtual Secondary Core, the value for column "id" in the Central Manager table is the same by default. Admins must reset the UUID to make it unique. A new Virtual Core CLI command “set id” is available to reset the UUID on a cloned Virtual Core from the CLI’s core mode. Refer to the Juniper ATP Appliance CLI Command Reference to review the Core mode "set id" and "show id" commands. Special characters used in CLI parameters must be enclosed in double quotation marks.

Enable Nested Virtualization for Windows 10 Sandboxing

Before You Begin

  • The VM should be upgraded to ESXi 6 and later (VMWare version 11).

  • Shut down the ATP Virtual Appliance VM.

To enable nested virtualization, the “hardware-assisted virtualization” capabilities need to be exposed to the VM, in this case ATP Virtual Appliance.

  1. Once the VM is powered off, use the vSphere web client to navigate to the Compatibility option and select Upgrade VM Compatibility.
  2. Once the VM compatibility upgrade finishes, use the vSphere web client to navigate to the Processor Settings screen. Select the check box next to Expose hardware-assisted virtualization to the guest operating system.
  3. Click OK.