QRadar Network Insights software installations on VMWare ESXi

You can install QRadar Network Insights software on a VMWare ESXi virtual machine.

A virtual appliance provides the same visibility and function in your virtual network infrastructure that QRadar Network Insights appliances provide in your physical environment.

To install a virtual appliance, complete the following tasks in order:
  • Ensure that your virtual appliance meets the minimum system requirements.
  • Create a virtual machine.
  • Install QRadar Network Insights software on the virtual machine.
  • Add the virtual appliance to your QRadar deployment.

You cannot stack virtual QRadar Network Insights appliances.

Your VMWare ESXi server network adapter must be in promiscuous mode for your QRadar Network Insights virtual appliances to receive network traffic.

Important: Do not install software other than QRadar Network Insights on the virtual machine.

Minimum system requirements for QRadar Network Insights installations on a VMWare ESXi server

Before you install IBM QRadar Network Insights, ensure that your virtual appliance meets the minimum system requirements.
Table 1. Requirements for virtual appliances

Requirement

Description

VMware Server

VMware ESXi Version 6.7+

For more information about VMWare clients, see the VMware website (www.vmware.com)

VMware compatibility level

Hardware version 14+ (ESXi 6.7+)

VMware CPU settings

Enable hardware virtualization passthrough.

Enable I/O MMU.

Virtual disk size

480 GB

Network adapters

At least two network adapters are required.

One adapter is dedicated to network management, and at least one more adapter is required for network capture.

Virtual CPUs

28 cores

Cores per socket

28 (Sockets: 1)

If you are using a higher number of cores and monitoring a single network interface, place as many cores on a single socket as possible.

Memory

64 GB

Installing QRadar Network Insights software on a VMWare ESXi server

You can install QRadar Network Insights 7.4.0 or later on a virtual machine. Installing earlier versions of QRadar Network Insights is not supported.

After you create your virtual machine, install the QRadar Network Insights software.

Restriction: Resizing logical volumes is not supported.

Before you begin

Download the installation file from Fix Central (www.ibm.com/support/fixcentral/).

Procedure

  1. Log in to the virtual machine by typing root for the user name.

    The user name is case-sensitive.

  2. Review the End User License Agreement (EULA) and accept the license.
    Tip: Press the Space bar to advance through the document.
  3. Select Software Install.
  4. On the Select the Appliance ID page, choose QRadar Network Insights Software (6500).
  5. For the type of setup, select normal.
  6. Follow the instructions in the installation wizard to complete the installation.
    The Network Information Setup window prompts for the following network settings:
    • Host name (fully qualified domain name)
    • IP Address
    • Network Mask
    • Gateway
    • Primary DNS
    • Secondary DNS (Optional)
    • Public IP address (Not supported)

    After you configure the installation parameters, a series of messages are displayed. The installation process might take several minutes.

  7. Add the QRadar Network Insights managed host to QRadar:
    1. Log in to QRadar:
      https://IP_Address_QRadar

      The default user name is admin. The password is the password of the root user account.

    2. On the Admin tab, in the System Configuration section, click System and License Management.
    3. In the Display list, select Systems.
    4. On the Deployment Actions menu, click Add Host.
    5. Configure the settings for the managed host by providing the fixed IP address, and the root password to access the operating system shell on the appliance.
    6. Click Add.
    7. On the Admin tab, click Advanced > Deploy Full Configuration.
  8. On the Admin tab, click Flow Sources and add a new QNI interface. To complete the installation, you have to deploy again
  9. Apply your license key.
    1. On the Admin tab, click System Configuration.
    2. Click the System and License Management icon.
    3. From the Display list, select Licenses, and upload your license key.
    4. Select the unallocated license and click Allocate System to License.
    5. From list of licenses, select the license, and click Allocate License to System.

    Only the QRadar Network Insights managed host requires a license. The QRadar Console does not need a QRadar Network Insights license.