This product can only be installed on a server with the mentioned Operating System, configuration and version and necessary network settings as follows:
- System Requirements
- 32 Gb RAM
- 8 core CPU
- 100GB Disk (For Collector 500GB)
- Ubuntu v18 or higher
- Docker Engine installed
- Docker compose installed
- On firewalls where POC is planned a user account having administrative rights needs to be created.
- Network access from the server to the related firewalls and their related L3 switch components must also be given on the following service ports:
- TCP/22: for switches/routers
- TCP/80
- TCP/443
- ICMP
- Any other port that may be needed to access if non-standard ports are used.
- Syslog traffic to the related syslog server must be allowed from the manager.
- For Collector: Syslog traffic to the related server needs to be configured and firewall access be given if required.
- SMTP reach to the related mail server needs to be configured and firewall access be given if required.
- LDAP access to the internal directory server needs to be given on firewalls.
- Radius access to internal AAA servers needs to be given on firewalls and necessary configuration be done if the preferred remote authentication is Radius.
Installation Steps
- Docker Engine Installation (if not installed already)
- Docker Compose Installation (if not installed already)
- Downloading files
- Running script
Step-by-Step Instructions
- Docker Engine and Docker Compose Installation
You can also follow the instructions from docker website:
Docker engine installation : https://docs.docker.com/engine/install/ubuntu/
Docker compose installation: https://docs.docker.com/compose/install/linux/#install-using-the-repository
// Uninstall old version
sudo apt-get remove docker docker-engine docker.io containerd runc
// Update apt package
sudo apt-get update
sudo apt-get install \
ca-certificates \
curl \
gnupg
// Add docker official GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg –dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
// Use the following command to set up the repository
echo \
“deb [arch=”$(dpkg –print-architecture)” signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
“$(. /etc/os-release && echo “$VERSION_CODENAME”)” stable” | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
// Update the apt package index
sudo apt-get update
// Install docker engine and docker compose
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
// Check if it is ok.
Sudo docker run hello-world
- Downloading files
Following are the files needed:
- several .tar files that are containing Opinnate Docker images,
- a docker-compose.yml file,
- run.sh file that is a bash script to load the Docker images and run the compose file.
Extract the contents of the compressed file, preferably to /srv/opinnate directory.
Execute the bash script with sudo privileges.
- Running Script
- sudo bash run.sh
Script will import the docker images and run docker-compose file.
Access Opinnate application in https://localhost:443 or in https://<ip of the device that the app is running on>:443 from any other machine.
Default username and password of the system is admin for the username and opinnate for the password.
Upgrading from 2.1 release
- Create a backup file from Global/System Configuration page and download it.
- Connect the system via SSH.
- Download and copy the upgrade zip file to the directory /srv/opinnate
- Move the remaining files to another directory or change their names
- Unzip the downloaded file
- Execute sudo bash run.sh command
Opinnate Collector Installation
Opinnate Collector installation is made on a separate server with the requirements mentioned before through the same installation steps using the related image file. Once installed, syslog configuration can be made on Opinnate Manager after integrating with collector.
- Opinnate Manager Integration:
Integration with the Collector component can be made via Global Area/Settings/Collector menu. There is API integration between each component, so for manager to connect to collector component the IP address must be given in the form IP Address:8081. Once it is added each firewall integrated to the related Virtual Area be seen with the trusted IP field missing. For each firewall the related IP address used for sending syslog messages must be identified for rule usage to work.
- Syslog Configuration on Firewalls:
Syslogs are collected on UDP port 514. For each firewall from which the syslog messages are collected must be configured for sending syslog messages. The related syslog configuration steps can be found on each firewall vendor administration guide for the related version. However, there are a couple of important items to remind for this integration.
- For Check Point firewalls the syslog format must be json.
- For Fortinet firewalls the sender IP address for syslog messages must not be on the same network or broadcast domain with Collector.
- If there are firewalls or other L3 devices between the Collector and firewalls, the necessary configuration to give access to syslog messages must be made.
Finally, once every step is clear It would be better to check if the needed syslog messages are coming with the tcpdump command on Collector via connecting through SSH.
tcpdump -i any host “IP Address of firewall” port 514
