Trend Micro VNS Deployment Guide for OCI

=============================================================================
===
TREND MICRO VISION ONE - VIRTUAL NETWORK SENSOR (VNS)
DEPLOYMENT GUIDE FOR ORACLE CLOUD INFRASTRUCTURE (OCI)
=============================================================================
===
=============================================================================
===
1. OVERVIEW
=============================================================================
===
To monitor the traffic of your network on Oracle Cloud Infrastructure (OCI),
you can deploy a Virtual Network Sensor (VNS) to your OCI environment. The VNS
monitors traffic and feeds network activity data to TrendAI Vision One,
enabling threat detection and response, network activity playback, and the
discovery of unmanaged assets.
Before you begin, review the Virtual Network Sensor system requirements.
To deploy the Virtual Network Sensor, complete the following steps in order:
1. Select or create a Virtual Cloud Network (VCN) for the VNS instance.
2. Select or create subnets on the VCN for the VNS data port and management
port. Trend Micro recommends separate, private subnets for the data and
management ports.
3. Choose or create separate network security groups (NSGs) for the VNS data
port and management port (see Section 3).
4. Launch an instance of the Virtual Network Sensor (see Section 4).
5. Mirror traffic to the Virtual Network Sensor (see Section 5).
After configuring your network settings, access the VNS console and use the
command "show traffic" to verify the VNS is receiving traffic. For
troubleshooting, see the Virtual Network Sensor FAQ and CLI commands
(Sections 6-7).
=============================================================================
===
2. PREREQUISITES AND SYSTEM REQUIREMENTS
=============================================================================
===
PREREQUISITES
- A VCN for the VNS instance (create or select one first).
- Two subnets on that VCN: one for the management port and one for the data
port. Trend Micro recommends separate, private subnets.
- Separate network security groups for the data port and management port
(created in Section 3 before launching the instance).
- A TrendAI Vision One account with access to:
Network Security > Network Inventory > Virtual Network Sensor.
SYSTEM REQUIREMENTS (minimum, by monitored throughput)
Throughput (Mbps) | vCPUs | Memory (GB) | Disk (GB) | NICs
------------------+-------+-------------+-----------+-----100
| 2 |
8
| 50 | 2
500
1000
2000
5000
10000
| 4 | 12
| 50 | 2
| 6 | 18
| 50 | 2
| 8 | 24
| 100 | 2
| 16 | 36
| 150 | 2
| 26 | 48
| 200 | 2
- Minimum two virtual NICs: one management port and one data port. Up to 20
virtual NICs total are supported (1 management + up to 19 data).
- On OCI, configure the OCPUs and memory of the VM.Standard3.Flex shape to
meet or exceed these values (see Section 4).
=============================================================================
===
3. CREATE NETWORK SECURITY GROUPS FOR VIRTUAL NETWORK SENSOR
=============================================================================
===
Before you deploy the VNS to OCI, create TWO network security groups (NSGs) one for the data port and one for the management port - because their security
settings differ. Create them before launching the instance.
The NSGs must be on the same VCN as your VNS deployment. Make sure you have
chosen or created a VCN first.
PROCEDURE
1. Go to https://www.oracle.com/cloud/sign-in.html and sign in to OCI.
2. In the top navigation bar, select your target region for deploying the VNS.
3. Click the navigation menu icon (top left) and go to:
Networking > Virtual cloud networks.
4. Click the VCN where you plan to deploy the VNS.
5. On the details page, do one of the following (depending on what you see):
- On the Security tab, go to the Network Security Groups section; or
- Under Resources, select Network Security Groups.
6. CREATE A NETWORK SECURITY GROUP FOR THE MANAGEMENT PORT:
a. Click Create Network Security Group.
b. Specify a name for the NSG.
c. Select a compartment. For ease of management, keep the NSG in the same
compartment as the VNS instance it protects.
d. Add the following INBOUND (ingress) rules to the management port:
Rule M1 - SSH access to the CLISH console
Direction:
Ingress
Source Type:
CIDR
Source CIDR:
<IP allowed to access the VNS, in CIDR>
IP Protocols:
SSH (TCP/22)
Source Port Range: All
Destination Port:
22
Purpose:
Accessing the VNS CLISH console
Rule M2 - Debug log export
Direction:
Ingress
Source Type:
CIDR
Source CIDR:
<IP allowed to access the VNS, in CIDR>
IP Protocols:
TCP
Source Port Range: All
Destination Port:
80
Purpose:
Exporting debug logs
Rule M3 - NLB health check (ADD THIS AFTER CREATING THE NLB)
Direction:
Ingress
Source Type:
CIDR
Source CIDR:
<IP of the NLB created for your VNS, in CIDR>
IP Protocols:
TCP
Source Port Range: All
Destination Port:
14789
Purpose:
Answering NLB health check
NOTE: Add this rule after you create the Network Load Balancer
(Section 5). It is repeated there as the final step.
e. Add the following OUTBOUND (egress) rule to the management port:
Rule M4 - Allow all outbound
Direction:
Egress
Destination Type:
CIDR
Destination:
0.0.0.0/0
IP Protocols:
All Protocols
Source/Dest Port:
Purpose:
Allowing all outbound traffic
f. Click Create. The NSG details screen is displayed.
7. Go back to the VCN details page.
8. CREATE A NETWORK SECURITY GROUP FOR THE DATA PORT:
a. Click Create Network Security Group.
b. Specify a name for the NSG.
c. Select the SAME compartment used by the management port NSG.
d. Add the following INBOUND (ingress) rule to the data port:
Rule D1 - Allow all inbound
Direction:
Ingress
Source Type:
CIDR
Source CIDR:
0.0.0.0/0
IP Protocols:
All Protocols
Source/Dest Port:
Purpose:
Allowing all inbound traffic
e. Add the following OUTBOUND (egress) rule to the data port:
Rule D2 - Allow all outbound
Direction:
Egress
Destination Type:
CIDR
Destination:
0.0.0.0/0
IP Protocols:
All Protocols
Source/Dest Port:
Purpose:
Allowing all outbound traffic
f. Click Create. The NSG details screen is displayed.
=============================================================================
===
4. LAUNCH A VIRTUAL NETWORK SENSOR INSTANCE
=============================================================================
===
Before you begin, confirm you have completed: a VCN, the data/management
subnets (separate, private), and the two NSGs from Section 3.
-------------------------------------------------------------------------------4.1 SPECIFY DEPLOYMENT SETTINGS AND DOWNLOAD THE IMAGE + TOKEN FROM VISION
ONE
-------------------------------------------------------------------------------1. In the TrendAI Vision One console, go to:
Network Security > Network Inventory > Virtual Network Sensor.
2. Click Deploy Virtual Network Sensor. The deployment panel appears.
3. Select Oracle Cloud Infrastructure for the platform.
4. Click Download Disk Image to download the VNS image, then extract the image
from the downloaded file.
5. Set the Admin password and confirm it. The password must contain:
- 12 to 32 characters
- Both uppercase and lowercase characters
- At least one number (0-9)
- At least one special character: ~!`@#$%^&*()/_+=[]{}-\|<>',.?:;" or space
This sets the default admin password for the VNS command line interface
after deployment.
6. Select the Connection method:
- Direct connection: VNS connects to Vision One directly (must have
internet access).
- Connect using a custom proxy: configure Proxy address, Proxy port, and
(optional) authentication User name and Password.
- Connect using a Service Gateway as proxy: select a Service Gateway that
has the Forward Proxy Service configured and enabled.
7. Click Download Token to download the token file. The token file contains
the configured admin password and the information that lets the VNS connect
and on-board with Network Inventory automatically.
-------------------------------------------------------------------------------4.2 UPLOAD THE IMAGE TO OBJECT STORAGE
-------------------------------------------------------------------------------1. Go to https://www.oracle.com/cloud/sign-in.html and sign in to OCI.
2. In the top navigation bar, select your target region.
3. Click the navigation menu icon (top left) and go to: Storage > Buckets.
4. Select a compartment (keep it the same as the VNS instance for simplicity).
5. Select an existing bucket or click Create Bucket to create one for the
VNS image.
6. On the bucket details screen, click Upload.
7. Drag the extracted VNS image file in QCOW2 format into the "Choose Files
from your Computer" section and click Upload.
8. Wait for the upload to complete (a few minutes) and click Close.
-------------------------------------------------------------------------------4.3 IMPORT THE IMAGE TO COMPUTE (CUSTOM IMAGES)
-------------------------------------------------------------------------------1. Click the navigation menu icon (top left) and go to:
Compute > Custom Images.
2. Click Import image.
3. Select a compartment (keep it the same as the VNS instance for simplicity).
4. Specify a name for the VNS image.
5. Select Rocky Linux for the operating system.
6. Use the default setting: Import from an Object Storage bucket.
7. Select the bucket compartment and bucket where you uploaded the image.
8. Select the object: vns_system.qcow2
9. Select QCOW2 for the image type.
10. Select Paravirtualized mode for the launch mode.
11. Click Import image and wait for the import to complete. When done, the
status tag changes to Available.
-------------------------------------------------------------------------------4.4 CREATE THE INSTANCE FROM THE IMPORTED IMAGE
-------------------------------------------------------------------------------1. On the VNS image details screen, click Create instance.
2. Specify a name for the instance.
3. Select an availability zone based on your requirements.
4. Select a compartment for the VNS instance.
5. In the Image and shape section, click Change shape.
6. On the Browse all shapes screen, select Intel from the shape series.
7. Select VM.Standard3.Flex from the shape list and click the triangle icon
in front of the shape to show details.
8. In the shape details, change the number of OCPUs and amount of memory based
on the network throughput you plan to monitor (see Section 2 / system
requirements).
9. Click Select shape.
10. Click Advanced options and scroll down to the Cloud-init script section.
11. Drag the token file you downloaded from Vision One (Section 4.1, step 7)
into the Cloud-init script section and click Next.
12. Click Next. The Networking settings are displayed.
13. CREATE A VNIC FOR THE MANAGEMENT PORT:
a. Specify a VNIC name for the management port.
b. Specify the compartment and VCN for the management port.
c. Specify the subnet compartment and subnet for the management port.
d. Retain "Automatically assign private IPv4 address".
e. Expand Advanced options and enable "Use network security groups to
control traffic".
f. Select the compartment and the management-port NSG (Section 3).
14. In the Add SSH keys section, select No SSH keys and click Next.
15. Click Next. Review the instance settings and click Create.
16. Wait for instance creation to complete (a few minutes). The status tag
changes to Running.
17. Click the Networking tab and record the Private IPv4 address of the VNS
instance (needed for verification and for the NLB backend).
-------------------------------------------------------------------------------4.5 VERIFY CONNECTION WITH NETWORK INVENTORY
-------------------------------------------------------------------------------1. In the TrendAI Vision One console, go to:
Network Security > Network Inventory > Virtual Network Sensor.
2. Check whether there is an entry in the Identifier column with the VNS IP
address you recorded.
3. If the VNS does NOT appear after deployment, verify:
- Firewall settings
- Proxy settings (if using a proxy)
- Review the Virtual Network Sensor FAQ to verify and test the connection
-------------------------------------------------------------------------------4.6 CREATE A VNIC FOR THE DATA PORT
-------------------------------------------------------------------------------Back in the OCI console:
NOTE: The number of VNICs you can create for the data port depends on the
number of OCPUs selected for the VM.Standard3.Flex shape.
1. Click the Networking tab on the instance details screen.
2. Click Create VNIC in the Attached VNICs section.
3. Specify a name for the data port.
4. Specify the compartment and VCN for the data port (keep the same as the
management port).
5. Specify the subnet compartment and subnet for the data port. Trend Micro
recommends a different subnet than the management port.
6. Enable "Use network security groups to control traffic".
7. Select the compartment and the data-port NSG (Section 3).
8. Enable "Skip source/destination check".
9. Retain "Automatically assign private IPv4 address".
10. Click Submit and wait for the attach to complete. The status tag changes
to Attached.
11. On the instance details screen, choose Actions > Reboot (upper right) to
restart the instance.
-------------------------------------------------------------------------------4.7 CHANGE THE MTU FOR THE DATA PORT
-------------------------------------------------------------------------------1. Sign in to the VNS directly or through SSH:
- Default user name: admin
- Password: the admin password created in the Vision One console
(if it does not work, try the default password: Trend@I)
- IP address: the VNS IP address you recorded
2. Run: enable
3. Run: configure interface eth1
4. Run: mtu 9000
5. Run: exit
6. Run: show interface (confirm MTU is now 9000)
=============================================================================
===
5. CONFIGURE TRAFFIC MIRRORING ON ORACLE CLOUD INFRASTRUCTURE
=============================================================================
===
Due to current OCI restrictions, mirrored traffic can only be sent from a
Network Load Balancer (NLB) to the Virtual Network Sensor. You will create an
NLB as the VTAP target, create a VTAP with a capture filter, start the VTAP,
and then add the NLB health-check rule to the management-port NSG.
-------------------------------------------------------------------------------5.1 CREATE A NETWORK LOAD BALANCER (VTAP TARGET)
-------------------------------------------------------------------------------1. Go to https://www.oracle.com/cloud/sign-in.html and sign in to OCI.
2. Click the navigation menu icon (top left) and go to:
Networking > Network load balancer.
3. Click Create network load balancer.
4. Specify a name for the NLB.
5. Select a compartment (keep it the same as the VNS instance for simplicity).
6. Select Private for the visibility type.
7. Under Header preservation, enable:
"Source/destination header (IP, port) preservation (network load
balancer)".
8. Enable "Enable symmetric hashing".
9. Under Choose networking, select the VCN and the compartment where the NLB
resides (keep the same compartment and VCN as the VNS instance).
10. Select the subnet (and its compartment) where the NLB resides. Select the
subnet used by the VNS data port.
11. Enable "Use network security groups to control traffic" and select the
compartment and the data-port NSG.
12. Add security attributes and tags as needed and click Next.
13. Specify a name for your listener.
14. Select UDP/TCP/ICMP for the type of traffic your listener handles and
click Next.
15. ADD BACKENDS:
a. Specify a name for the backend set.
b. Click Add backends.
c. Select Compute instances for the backend type.
d. Select the compartment where the VNS instance resides, then select
the VNS instance.
e. Specify the IP address of the VNS instance you recorded.
f. Click Add backends.
g. Under Specify health check policy, select TCP for the protocol and
specify 14789 for the port.
h. Enable "Fail open".
16. Click Next, review the settings, and click Create network load balancer.
NOTE: The VNS instance does not answer the NLB health checks, so the backend
set status appears as "Critical". This can be safely ignored - the NLB
still moves traffic to the VNS as long as "Fail open" is enabled.
17. On the Details tab, record the IP Address of the NLB (needed for the VTAP
and for the management-port NSG health-check rule).
-------------------------------------------------------------------------------5.2 CREATE A VTAP (VIRTUAL TEST ACCESS POINT)
-------------------------------------------------------------------------------1. Click the navigation menu icon (top left) and go to: Networking > VTAPs.
2. Click Create VTAP.
3. Specify a name for the VTAP.
4. Select a compartment (keep it the same as the VNS instance for simplicity).
5. Select the VCN where the VNS instance resides.
6. In the Source section, select your traffic mirroring source.
NOTE: To avoid packet truncation in VTAP-captured packets, make sure the
source instance interfaces have their MTU set to 8950 or lower for
IPv4, or 8930 or lower for IPv6.
7. In the Target section, select the subnet and the NLB created in Section 5.1
as the traffic mirroring target.
8. Click "Select a capture filter" and select "Create new capture filter".
a. Specify a name for the capture filter.
b. Select a compartment (keep it the same as the VNS instance).
c. Create a rule for INBOUND traffic:
Traffic direction: Ingress
Include/Exclude: Include
Source IPv4 CIDR / IPv6 prefix:
0.0.0.0/0
Destination IPv4 CIDR / IPv6 prefix: 0.0.0.0/0
IP protocol:
All
d. Click "+Another rule" and create a rule for OUTBOUND traffic:
Traffic direction: Egress
Include/Exclude: Include
Source IPv4 CIDR / IPv6 prefix:
0.0.0.0/0
Destination IPv4 CIDR / IPv6 prefix: 0.0.0.0/0
IP protocol:
All
e. Click Create capture filter.
9. Click Create VTAP. The VTAP details screen is displayed.
10. Click Start to start the VTAP.
-------------------------------------------------------------------------------5.3 ALLOW NLB HEALTH-CHECK TRAFFIC ON THE MANAGEMENT-PORT NSG
-------------------------------------------------------------------------------1. Click the navigation menu icon (top left) and go to:
Networking > Virtual cloud networks.
2. Click the VCN where the VNS instance is deployed.
3. On the details page, do one of the following:
- On the Security tab, go to the Network Security Groups section; or
- Under Resources, select Network Security Groups.
4. Click the NSG you created for the VNS management port.
5. Click the Security rules tab, then click Add Rules, and add:
Direction:
Ingress
Source Type:
CIDR
Source CIDR:
<IP of the NLB created in Section 5.1, in CIDR>
IP Protocols:
TCP
Source Port Range: All
Destination Port: 14789
Purpose:
Answering NLB health check
-------------------------------------------------------------------------------5.4 VERIFY TRAFFIC RECEPTION
-------------------------------------------------------------------------------Access the VNS console and run "show traffic" to confirm the VNS is receiving
mirrored traffic on the data port. (See Section 6 for connection tests.)
=============================================================================
===
6. VERIFY DEPLOYMENT AND TEST THE CONNECTION (FAQ)
=============================================================================
===
VERIFY SUCCESSFUL DEPLOYMENT
1. Sign in to the VNS CLISH console with an admin account (user name: admin).
2. Run: enable
3. Run: connect
If the VNS has deployed successfully, results show "good" for TrendAI
Vision One, Virtual Network Sensor, and Network Analytics.
4. Run: troubleshoot
5. Run: network-services
6. Run: test all
The "test all" command tests both the connection and the status of the
VNS services.
If deployment is unsuccessful, first check the VNS firewall exceptions for
your region (see "Firewall exception requirements for TrendAI Vision One").
You can also troubleshoot with:
show network management (IP settings)
ping
(network connectivity)
CHANGE NETWORK IP SETTINGS (STATIC <-> DHCP)
1. Sign in to the VNS CLISH console with an admin account.
2. Run: enable
3. To switch to DHCP: configure network primary ipv4.dhcp
4. To set a static IP: configure network primary ipv4.static <ip> <submask>
<gateway> <dns1> [dns2]
FIX A FAILURE TO REGISTER
1. From an endpoint on the same network as the VNS, verify you can reach
Vision One services. Use "curl -v" with the FQDN list from the firewall
requirements. (Americas example: curl -v xlogr-ue1.xdr.trendmicro.com)
If the connection fails, check your firewall settings.
2. Download and redeploy the installer package.
3. If still unresolved, download the debug logs and contact your service
provider.
=============================================================================
===
7. VIRTUAL NETWORK SENSOR CLI COMMANDS (REFERENCE)
=============================================================================
===
ACCESS
- Sign in with user name "admin" and the password set in the Vision One
console. If it does not work, try the default password: Trend@I
- Run "enable" to access administrative commands (prompt changes from > to #).
- Run "show ?" for a list of available show commands.
- Required arguments are shown in < >; optional arguments in [ ].
BASIC COMMANDS
enable
Enable administrative commands
exit
Exit the CLI
help
Display the CLI syntax
show hostname
Show host name information
show interface <interface>
Show NIC interface info (e.g., eth0)
show network management
Show network configuration
show ntp
Show NTP information
show proxy
Show proxy information
show sshd
Show SSH status (enabled or disabled)
show system
Show the Company ID and disk information
show thirdpartylicense
Show 3rd-party license information
show time
Show time and date information
show traffic
Show real-time data traffic
show vision-one
Show the Vision One server address and last
time data was sent
show endpoint-info-enricher Show endpoint information enricher config
show ncie geneve
Show Geneve (Generic Network Virtualization
Encapsulation) settings
ADMINISTRATIVE COMMANDS (run "enable" first)
configure hostname <hostname>
configure network primary ipv4.static <ip> <submask> <gateway> <dns1> [dns2]
configure network primary ipv4.dhcp
configure ntp <ntp_addr>
configure password
configure proxy delete
configure proxy set http <addr>
<ADDRESS>:<PORT> or <USER>:<PASSWORD>@<ADDRESS>:<PORT>
(Proxy is now configured in Network Inventory; see "Configure Virtual
Network Sensor connections".)
configure ssh enable | configure ssh disable
configure time <HH:MI:SS> [YYYY-MM-DD]
configure verify dns [domain] (default domain: www.trendmicro.com)
configure interface <interface_name> (enter interface configuration mode;
used for the MTU change in Section 4.7)
configure endpoint-info-enricher hostname-lookup <1/0>
configure endpoint-info-enricher hostname-lookup dns <1/0>
configure endpoint-info-enricher hostname-lookup netbios <1/0>
configure endpoint-info-enricher session-tracking <1/0>
configure endpoint-info-enricher session-tracking dhcp <1/0>
configure endpoint-info-enricher session-tracking dhcpv6 <1/0>
configure endpoint-info-enricher session-tracking kerberos <1/0>
configure endpoint-info-enricher session-tracking radius <1/0>
configure ncie geneve enable
=============================================================================
===
8. TROUBLESHOOTING SUMMARY
=============================================================================
===
VNS DOES NOT APPEAR IN NETWORK INVENTORY
- Verify firewall settings (region-specific FQDNs/ports allowed outbound).
- Verify proxy settings if a proxy is used.
- On the VNS CLI: run "enable", then "connect" and "test all".
- Run "show network management" to confirm IP configuration.
- Run "ping" to test connectivity; "show system" to confirm the Company ID
(if no Company ID appears, contact your support provider for a token).
NO TRAFFIC DATA VISIBLE
- Confirm the VTAP status is Started (it is stopped by default at creation).
- Confirm the NLB exists, is Private, has header preservation + symmetric
hashing enabled, and uses the data-port NSG.
- Confirm the NLB backend points to the VNS instance/IP and the health check
is TCP/14789 with "Fail open" enabled (backend "Critical" is expected and
can be ignored).
- Confirm "Skip source/destination check" is enabled on the data VNIC.
- Confirm the management-port NSG has the Ingress TCP/14789 rule from the NLB
(Section 5.3).
- Confirm source MTU is 8950 (IPv4) / 8930 (IPv6) or lower, and the VNS data
port (eth1) MTU is 9000 (Section 4.7).
- Run "show traffic" on the VNS CLI to check packets on the data interface.
=============================================================================
===
9. REFERENCES
=============================================================================
===
TREND MICRO / TRENDAI VISION ONE
- Deploy a VNS with OCI (overview):
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-deploy-vns-overview-oci
- Create network security groups for VNS (OCI):
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-create-security-group-vns-oci
- Launch a VNS instance on OCI:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-launch-vns-instance-oci
- Configure traffic mirroring on OCI:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-configure-traffic-mirroring-oci
- Virtual Network Sensor CLI commands:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-network-inspector-cl (VNS
CLI commands)
- Virtual Network Sensor FAQ:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-virtual-network-sensor-faqs
- VNS system requirements:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-network-sensor-sys-reqs
- Ports and firewall exceptions for VNS:
https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-ports-urls-used-network-sensor
ORACLE CLOUD INFRASTRUCTURE
- Virtual Test Access Points (VTAPs):
https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/vtap.htm
- VTAP sources and targets / Networking documentation:
https://docs.oracle.com/en-us/iaas/Content/Network/
- Network Load Balancer:
https://docs.oracle.com/en-us/iaas/Content/NetworkLoadBalancer/home.htm
=============================================================================
===
END OF DOCUMENT
=============================================================================
===