Windows UCT-V Installation

Windows UCT-V allows you to select the network interfaces by subnet/CIDR and modify the corresponding monitoring permissions in the configuration file. This gives you more granular control over what traffic is monitored and mirrored.

Points to Note:

  • VXLAN is the only supported tunnel type for Windows UCT-V.
  • Loopback Interface is not supported for Windows UCT-V.

Windows Network Firewall Requirements

If Network Firewall requirements or Security Groups are configured in your environment, then you must open the following ports for the virtual machine. Refer to Network Firewall Requirement for GigaVUE Cloud Suite to know more details on the firewall requirements or security groups required for your environment.

The following ports for Network Firewall rules can be added from Firewall Settings.

Direction

Port

Protocol

CIDR

Purpose

Inbound

9901

TCP

UCT-V Controller IP

 Allows UCT-V to receive control and management plane traffic from UCT-V Controller

Outbound

8891

TCP

UCT-V Subnet IP

Allows UCT-V to communicate with UCT-V Controller for registration and heartbeat

Outbound

4789

UDP

UCT-V Subnet IP

Allows UCT-V to tunnel VXLAN traffic to GigaVUE V Series Nodes

Outbound

4789

UDP

UCT-V Subnet IP

Allows UCT-V to tunnel L2GRE traffic to GigaVUE V Series Nodes

Windows UCT-V Installation Using MSI Package

To install the Windows UCT-V using the MSI file:

  1. Download the Windows UCT-V6.8.00 MSI package from the Gigamon Customer Portal. For assistance contact Contact Technical Support.
  2. Install the downloaded MSI package as Administrator and the UCT-V service starts automatically.
  3. Once the UCT-V package is installed, modify the file C:\ProgramData\Uct-v\uctv.conf to configure and register the source and destination interfaces.

    Note:  When you have an active, successful monitoring session deployed, any changes to the UCT-V config file made after the initial setup require an UCT-V restart and an inventory refresh or sync from GigaVUE-FM to pick up the new changes and re-initiate the traffic mirroring. GigaVUE-FM does a periodic sync on its own every 15 minutes.


    Following are the rules to modify the UCT-V configuration file:
    • Interface is selected by matching its CIDR address with config entries.
    • For the VMs with single interface (.conf file modification is optional):
      • if neither mirror-src permissions is granted to the interface, both mirror-src-ingress and mirror-src-egress are granted to it.
      • mirror-dst is always granted implicitly to the interface.
    • For the VMs with multiple interfaces:
      • mirror-dst needs to be granted explicitly in the config file. Only the first matched interface is selected for mirror-dst, all other matched interfaces are ignored.
      • if none interfaces is granted any mirror-src permission, all interfaces will be granted mirror-src-ingress and mirror-src-egress.

    Example 1—Configuration example to monitor ingress and egress traffic at interface 192.168.1.0/24 and use the same interface to send out the mirrored packets.

    For IPv4:

    # 192.168.1.0/24  mirror-src-ingress mirror-src-egress mirror-dst

    For IPv6:

    2001:db8:abcd:ef01::/64 mirror-src-ingress mirror-src-egress 2001:db8:abcd:ef01::/64 mirror-src-egress

    2001:db8:abcd:ef01::/64 mirror-dst

    Example 2—Configuration example to monitor ingress and egress traffic at interface 192.168.1.0/24 and use the interface 192.168.2.0/24 to send out the mirrored packets.

    For IPv4:

    192.168.1.0/24   mirror-src-ingress mirror-src-egress

    192.168.2.0/24   mirror-dst

    For IPv6:

    2001:db8:abcd:ef01::/64 mirror-src-ingress mirror-src-egress 2001:db8:abcd:ef02::/64 mirror-src-egress

    2001:db8:abcd:ef01::2/64 mirror-dst

  4. Save the file.
  5. Restart the Windows UCT-V using one of the following actions:
    • Run 'sc stop uctv' and 'sc start uctv' from the command prompt.
    • Restart the UCT-V from the Windows Task Manager.

You can check the status of the UCT-V in the Service tab of the Windows Task Manager.

Windows UCT-V Installation Using ZIP Package

To install the Windows UCT-V using the ZIP package:

  1. Download the Windows UCT-V6.8.00 ZIP package from the Gigamon Customer Portal. For assistance contact Contact Technical Support.
  2. Extract the contents of the .zip file into a convenient location.
  3. Run ‘install.bat’ as an Administrator and the UCT-V service starts automatically.
  4. Once the UCT-V package is installed, modify the file C:\ProgramData\Uct-v\uctv.conf to configure and register the source and destination interfaces.

    Note:  When you have an active, successful monitoring session deployed, any changes to the UCT-V config file made after the initial setup require an UCT-V restart and an inventory refresh or sync from GigaVUE-FM to pick up the new changes and re-initiate the traffic mirroring. GigaVUE-FM does a periodic sync on its own every 15 minutes.


    Following are the rules to modify the UCT-V configuration file:
    • Interface is selected by matching its CIDR address with config entries.
    • For the VMs with single interface (.conf file modification is optional):
      • if neither mirror-src permissions is granted to the interface, both mirror-src-ingress and mirror-src-egress are granted to it.
      • mirror-dst is always granted implicitly to the interface.
    • For the VMs with multiple interfaces:
      • mirror-dst needs to be granted explicitly in the config file. Only the first matched interface is selected for mirror-dst, all other matched interfaces are ignored.
      • if none interfaces is granted any mirror-src permission, all interfaces will be granted mirror-src-ingress and mirror-src-egress.

    Example 1—Configuration example to monitor ingress and egress traffic at interface 192.168.1.0/24 and use the same interface to send out the mirrored packets.

    For IPv4

    # 192.168.1.0/24  mirror-src-ingress mirror-src-egress mirror-dst

    For IPv6

    2001:db8:abcd:ef01::/64 mirror-src-ingress mirror-src-egress 2001:db8:abcd:ef02::/64 mirror-src-egress

    2001:db8:abcd:ef01::2/64 mirror-dst

    Example 2—Configuration example to monitor ingress and egress traffic at interface 192.168.1.0/24 and use the interface 192.168.2.0/24 to send out the mirrored packets.

    For IPv4

    192.168.1.0/24   mirror-src-ingress mirror-src-egress

    192.168.2.0/24   mirror-dst

    For IPv6

    2001:db8:abcd:ef01::/64 mirror-src-ingress mirror-src-egress 2001:db8:abcd:ef02::/64 mirror-src-egress

    2001:db8:abcd:ef01::2/64 mirror-dst

    Example 3— Configuration example to tap and mirror the loopback interface (lo) traffic.

    lo mirror-src-ingress mirror-src-egress

    ens3 mirror-dst

  5. Save the file.
  6. Restart the Windows UCT-V using one of the following actions:
    • Run 'sc stop uctv' and 'sc start uctv' from the command prompt.
    • Restart the UCT-V from the Windows Task Manager.

You can check the status of the UCT-V in the Service tab of the Windows Task Manager.

Note:  You must edit the Windows Firewall settings to grant access to the uctv process. To do this, access the Windows Firewall settings and find “uctvd” in the list of apps and features. Select it to grant access. Be sure to select both Private and Public check boxes. If “uctvd” does not appear in the list, click Add another app... Browse your program files for the uctv application (uctvd.exe) and then click Add. (Disclaimer: These are general guidelines for changing Windows Firewall settings. See Microsoft Windows help for official instructions on Windows functionality.)