Configure UCT-C Controller and TAP through GigaVUE-FM

The recent GigaVUE-FM image files can be downloaded from the Gigamon Customer Portal. After fetching the image, upload and launch GigaVUE-FM on the supported Cloud environment. For assistance,Contact Technical Support of Gigamon or refer to GigaVUE-FM Installation Guide and GigaVUE Fabric Management Guide for details on installing and launching GigaVUE-FM.

In GigaVUE-FM, on the left navigation pane, go to Inventory > CONTAINER > Universal Cloud Tap - Container. You can view the following tabs on the Universal Cloud Tap - Container launch page:

To view and filter the list of Monitoring Domains, Cluster, and Node details, click the filter button on the left side of any of the above listed tabs. You can also create a new Monitoring Domain, edit, and delete the existing Monitoring Domains.

On Clusters, Nodes, and Pods screens, you can click the Filter button displayed on the right of the page to filter the details on that particular screen.

To create a monitoring domain in GigaVUE-FM:

1. In GigaVUE-FM, on the left navigation pane, go to Inventory > CONTAINER > Universal Cloud Tap - Container > Monitoring Domains.
2. In the Monitoring Domains page, click New. The New Monitoring Domain wizard appears.
   
3. Enter or select the required information as described in the following table.
   

   Fields	Description
   Monitoring Domain Name	Enter a name for the monitoring domain
   Clusters
   Cluster Name	Enter a name for the cluster
   API Server URL	Enter or select the URL of the API server
   Option
   CA	Select the required CA name from the drop-down menu. Note:  CA is required for deploying the policy with Secure Tunnels.

   Click to add another cluster and click to remove an existing cluster.

4. Click Save to create a monitoring domain.

You can view the monitoring domain created in the list view. The list view shows the following information for UCT-C and controllers:

■

Cluster - Displays the status of GigaVUE-FM to UCT-C Controller connectivity. You can click the number link next to (connected) or the (disconnected) icons to view the cluster details for the selected Monitoring Domain.

Use the following buttons to manage your Monitoring Domain:

When setting up a traffic flow, it is important to define the selection criteria for the sources of traffic. Use the Source Selectors page to configure the sources of the traffic to be monitored.

To configure the Source Selectors:

1. Go to Inventory > Resources> Source Selectors> Container.
2. Click Create. The New Source Selector wizard appears.
   
3. Enter or select the required information:

   Field	Action
   Name	Enter a name for the source
   Inclusion Criteria You can select any one of the following options: All Sources - Select this option to acquire traffic from all namespaces and pods within the selected cluster(s). The volume of traffic may be large, depending on the size of the cluster(s). Criteria1- You must enter the following options:
   Object Property	Select an object property to filter the traffic source.
   Operator	Select the operator.
   Values	Enter the values for the filter. Values are case-sensitive.
   On the Criteria, click to add another object and click to remove an existing object. Exclusion Criteria On the Criteria, click to add another Object and click to remove an existing Object.
   Host Network Enabled	Uncheck the Host Network Enabled to monitor the Host Network Enabled pods. Refer to the Exclusion Criteria for more information.
   Object Property	Select an object property to filter the traffic source.
   Operator	Select the operator.
   Values	Enter the values for the filter. Values are case-sensitive.

   On the Inclusion or Exclusion Criteria sections, click to add another Criteria and click to remove an existing Criteria.

4. Click Save.

A tunnel of type L2GRE, VXLAN, or TLS-PCAPNG can be created. The tunnel is an egress tunnel. For more information on how to create a tunnel of type TLS-PCAPNG, refer to Secure Tunnels Secure Tunnels . Secure Tunnels

Note:   Secure Tunnels

To configure the tunnels:

1. Go to Inventory > Resources > Tunnel Specifications.
2. On the Tunnel Specifications page, navigate to the Container tab and click Create. The Create Tunnel Specification wizard appears.
3. Enter or select the following information:

   Field	Description
   Name	The name of the tunnel endpoint. Note:  Do not enter space or Invalid characters.
   Tunnel Type	Select L2GRE, VXLAN, or TLS-PCAPNG tunnel type to create a tunnel.
   Destination IP Address	Enter the IP address of the destination endpoint.
   Key (Applicable when the selected tunnel type is L2GRE)	Enter a value for the tunnel key.
   VXLAN Network Identifier (Applicable when the selected tunnel type is VXLAN)	Enter the identifier key for VXLAN network.
   Destination Port (Applicable when the selected tunnel type is VXLAN or TLS-PCAPNG)	Specify the destination port value. Enter a value between 1 and 65535.

4. Click Save to save the configuration.

The traffic from the workload pods is processed based on the Traffic Policy configuration. The UCT-C TAP routes the traffic to the tunnel destination IP addresses specified in the Traffic Policy rules.

You can refer to the GigaVUE API Reference for detailed information on the REST APIs of UCT-C. 

To create a UCT-C Traffic Policy in GigaVUE-FM, follow the below steps:

Note:  You can deploy a maximum of eight policies per Monitoring Domain.

5.

In the Source Selectors page, click to expand the Default Exclusion section. DefaultExclusion Source Selector is applied automatically for all policies.

Note:  You can edit the values across the Monitoring Domain in Inventory > Resources > Source Selectors section. On the Source Selectors Specifications page, navigate to Container > Default Exclusion. In the Edit Source Selector wizard, you can edit the values in the Exclusion Criteria section.

Enable Selective Precryption

If you wish to use selective Precryption follow the steps given below:

1. Disable the Enable toggle button to turn off the default passall rule.
2. Click to add another rule.
3. Enter the following details as mentioned in the below table:

   Fields	Description
   Rule Name	Enter a name for the rule.
   Action	Choose any one of the following options: ● Pass — Passes the traffic. ● Drop — Drops the traffic. Note:  In the absence of a Precryption rule, traffic is implicitly allowed. However, once rules are defined, they include an implicit pass all rule. Should the traffic not conform to any of the specified rules, it will be passed.
   Direction	Choose any one of the following options: ● Bi-Directional —- Allows the traffic in both directions of the flow. A single Bi-direction rule should consist of 1 Ingress and 1 Egress rule. ● Ingress — Filters the traffic that flows in. ● Egress — Filters the traffic that flows out.
   Priority	Select the value of the priority based on which the rules must be prioritized for filtering. Select the value as 1 to pass or drop a rule in top priority. Similarly, you can select the value as 2, 3, 4 to 8, where 8 can be used for setting a rule with the least priority. Drop rules are added based on the priority and, then pass rules are added.
   Filters
   Filter Type	Select the Filter Type from the following options: ● L3 ● L4
   L3:
   Filter Name	Select the Filter Name from the following options: ● IPv4 Source ● IPv4 Destination ● IPv6 Source ● IPv6 Destination ● Protocol - It is common for both IPv4 and IPv6
   Value	Enter or Select the Value based on the selected Filter Name. Note:  When using Protocol as the Filter Name, select TCP from the drop-down menu.
   L4:
   Filter Name	Select the Filter Name from the following options: ● Source Port ● Destination Port
   Filter Relation	Select the Filter Relation from any one of the following options: ● Not Equal to ● Equal to
   Value	Enter the source or destination port value.

Note:  If policy deployment for pods fails with a Duplicate Filter Rules error, you need to decide which policy the pod should be monitored under and make changes to the failed policies by removing the overlapping sources from the failed policy.

In the Policies page, you can view various details related to a policy such as Policy Name, Monitoring Domain, Cluster, Deployment Status, and Statistics etc., The fields and the description of the field names are given in the following table:

Note:  Click the gear icon to add or remove column or columns as per your requirement.

Use the following buttons on the Policies screen to manage your Policy:

To view the Deployment status, click the Deployment status link in the Deployment Status column of a policy. The Deployment status appears on the bottom of the Policies page.
You can view the following fields along with the policy name:

Click Filter to filter the details like Cluster, Node, Namespace, Pod Name, and Pod Status in the Deployment Status Wizard.

To view the Policy Configurations of the traffic policy configured in the GigaVUE-FM, click the policy name. The configurations appear on the bottom of the Policies page.
You can view the following tabs along with the policy name:

You can scroll each of the tables to view more columns. The fields and description for the tab that appears when you click the tabs are described in the topics respectively.

Source Specifications

You can view the criteria based on which pod is selected for tapping.

The fields and descriptions of the Source Specifications tab are described in the following table:

Mirroring Rules or Precryption Rules

The fields and descriptions of the Mirroring Rules or Precryption Rules tab are described in the following table:

Traffic Policy Statistics in GigaVUE-FM provides the visibility of the policies within a Monitoring Domain and displays the information of the policies and its rules statistics in the dashboard.

Rules are configured in the UCT-C to either forward the traffic to a Tunnel or drop the flow of the traffic.

The activities of the rules are reflected by the statistics counters. The statistics counters show how the policy statistics are directly co-related to the policy and its rules being configured through the GigaVUE-FM.

To view the statistics of the traffic policy configured in the GigaVUE-FM, click the View status link in the Statistics column of a policy. The Policy Statistics and the Mirroring Statistics or Precryption Statistics appears on the bottom of the Policies page: