Trend Micro TippingPoint
TM

TM

Virtual Threat Protection System (vTPS)
User Guide

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com/en-us/tippingpoint/threat-protectionsystem.aspx
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2024. Trend Micro Incorporated. All rights reserved.
Document Part No.: TPEM69847/230927
Release Date: January 2024
Protected by U.S. Patent No.: PendingThis documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that TippingPoint ThreatProtection System collects and provides detailed instructions on how todisable the specific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: vTPS User Guide
Chapter 2: vTPS Functional Differences Addendum
Deployment and licensing ................................................... 2-3
Specifications ..................................................................... 2-4
Unsupported features ......................................................... 2-7
Commands ......................................................................... 2-8

Chapter 3: Install and configure the vTPS virtual appliance
General requirements ......................................................... 3-2
Install and deploy a vTPS virtual appliance by using VMware
ESXi ................................................................................... 3-2
VMware ESXi requirements ........................................... 3-3
Configure the vTPS virtual appliance on VMware ........... 3-3
Start your vTPS virtual appliance ................................. 3-12
Upgrade to Standard Mode .......................................... 3-13
Install and deploy a vTPS virtual appliance by using KVM ... 3-13
KVM requirements ...................................................... 3-13
Obtain software licensing and certificates .................... 3-15
Deploy a vTPS virtual appliance on KVM ...................... 3-15
Automating vTPS installation on KVM .......................... 3-18
Upgrade to Standard Mode .......................................... 3-21
Install and deploy by using OpenStack HEAT template for vTPS......................................................................................... 3-21
vTPS emulation requirements ...................................... 3-22
vTPS functional requirements ..................................... 3-22
Deploy the TippingPoint vTPS on OpenStack using the CLI................................................................................... 3-23
Deploy the TippingPoint vTPS on OpenStack using the GUI................................................................................... 3-30
i

vTPS User Guide

Template sample ......................................................... 3-43

Chapter 4: Upgrade from vTPS Trial to vTPS Standard
Install your license entitlement package .............................. 4-2
Create and download vTPS virtual appliance license certificates.......................................................................................... 4-2
Install the vTPS license certificate using the SMS client .. 4 -4
Install a Digital Vaccine package .......................................... 4-4

Chapter 5: Troubleshooting tips

ii

iii

Chapter 1

Deployment overview
Use the configuration steps in these topics to deploy a TippingPoint VirtualThreat Protection System (vTPS) virtual appliance in either a VMware or
kernel-based virtual machine (KVM) environment. The vTPS virtual
appliance is a software appliance designed to give you the same level offunctionality available in the TippingPoint Threat Protection System (TPS),
but virtually rather than physically. Just as with a TPS device, the vTPS
virtual appliance protects your network with the Threat Suppression Engine(TSE) by scanning, detecting, and responding to network traffic according to
the filters, action sets, and global settings you maintain on the vTPS virtual
appliance. You can share the same policies across virtual and physicaldeployments, and you can centralize the management of your deploymentswith a Security Management System (SMS) or a virtual SMS (vSMS).
Learn more on page 2-1 about the few differences between vTPS and TPS
functionality—for example, command line interface (CLI) operations that
control hardware LEDs, and other functions specific to a physical device.
Refer to the following illustration for an example of a basic hypothetical
deployment. You must configure your vTPS virtual appliance between L2
broadcast domains (VLANs or switches).

1-1

vTPS User Guide

After you deploy the vTPS virtual appliance, access the appliance by using
the SMS client. Learn more about these interfaces from the TPS productdocumentation.

1-2

Chapter 2

vTPS functionality
The Virtual Threat Protection System (vTPS) virtual appliance is a softwarebased security appliance that can inspect traffic in a virtual network between
Layer 2 broadcast domains. With few exceptions, the vTPS platform isdesigned to be functionally identical to a physical TPS device.
The vTPS virtual appliance has most of the same features as the TPS device,including:• In-line, real-time threat protection for inbound IPv4 traffic that is SSL
encrypted• HTTP response processing to decode URL encodings and numericcharacter references• DNS reputation remediation for enabling NXDOMAIN (name does notexist) responses to clients that make DNS requests for hosts that areblocked• Layer 2 Fallback (Intrinsic High Availability)• Enhanced SNMP support• The ability to collect a client's true IP address.
• The ability to identify the HTTP URI and hostname information
associated with an event.

2-1

vTPS User Guide• Flexibility to upgrade inspection throughput from 500 Mbps to 2 Gbps.
For successful TPS functionality in a virtual environment, the vTPS virtual
appliance:• Supports Layer 2 IPS deployments—The vTPS virtual appliance connects
the virtual switches. Traffic between the virtual switches is bridged onthese connections using promiscuous mode.
• Provides full protection of North-South traffic.
• Provides limited protection of East-West traffic (according to existing
network policy constructs).
For optimal deployment of your vTPS virtual appliance, you should note thespecific areas in which your virtual appliance functionality differs from aphysical TPS device.
Note
Any unsupported features will not be displayed in the three vTPS interfaces—
Local Security Manager (LSM), Command Line Interface (CLI), and Security
Management System (SMS).

The following topics highlight the areas where a vTPS virtual appliancediverges functionally from a physical TPS device:• Deployment and licensing on page 2-3• Specifications on page 2-4• Unsupported features on page 2-7• Commands on page 2-8

2-2

vTPS Functional Differences Addendum

Deployment and licensing
Because the vTPS virtual appliance is a virtual product, the out-of-box
experience (OBE) for vTPS users is described in an email from Trend Micro
TippingPoint. This email contains licensing and activation information anddirects you to use the license manager on the Threat Management Center(TMC) to create and download vTPS certificate packages.
When setting up your vTPS virtual appliance, note the following:• The vTPS virtual appliance initially starts up in vTPS Trial Mode. Trial
Mode is primarily exploratory and comes with a limited number of
security filters in the Digital Vaccine package. In this mode, an SMS canmanage only one vTPS virtual appliance at a time. Because Trial Mode
has a fixed serial number and entitlement, you cannot use Trial Mode toperform TippingPoint Operating System (TOS) upgrades or distribute
Digital Vaccines.
• The vTPS virtual appliance remains in Trial Mode until you install avalid certificate for vTPS Standard Mode. Learn more on page 4-1 about
upgrading to vTPS Standard Mode.
• The vTPS virtual appliance does not support a hitless reboot or hitless
upgrade. Traffic flow is interrupted until the boot sequence completes
because, unlike on a TPS device, the network ports on a vTPS virtual
appliance are virtual.
The following table highlights the ways in which getting set up on a TPS
device and vTPS virtual appliance are different:
Deployment
OBE

TPS device

vTPS virtual appliance

After you install thedevice in a rack, a setup
wizard guides you
through system checks,
initializations, andconfigurations.

Obtain the license entitlement and certificate using
the license manager on the TMC. Initial deployment
defaults to a Trial Mode. You cannot perform any
updates.

2-3

vTPS User Guide

Deployment
Digital
Vaccine

TPS device

vTPS virtual appliance

All TPS devices running
TOS v6.0 or later use
the v4.0.0.x Digital
Vaccine package. Allother TPS devices use
the v3.2.0.x Digital
Vaccine package.

Uses a version of the v4.0.0.x Digital Vaccine
package that does not include Zero Day Initiative(ZDI) filters.

Specifications
Both the TPS device and the vTPS Standard virtual appliance share thefollowing specifications.
Description

Specification

Average IPS latency

Less than 100 microseconds

Security contexts

750,000

For the various licensed throughput options available for physical TPS
devices and the vTPS, refer to the SMS User Guide.
The specifications of the physical TPS device and the vTPS Standard virtual
appliance differ in the following areas.
Description
Concurrent sessions

TPS device
440T: 7,500,000
2200T: 10,000,000
1100TX: 15,000,000
5500TX: 30,000,000
8200TX/8400TX: 120,000,000
9200TXE: 300,000,000

2-4

vTPS virtual appliance
1,000,000

vTPS Functional Differences Addendum

Description
New connections per second

TPS device

vTPS virtual appliance

440T: 70,000

VMware: Up to 120,000

2200T: 115,000

KVM: Up to 60,000

1100TX: 122,000
5500TX: 397,000
8200TX/8400TX: 650,000
9200TXE: 1,000,000
Ethernet maximum
transmission units (MTU)

9050

1500

Note
All virtual machines (VMs) on a shared host compete for resources. To achieve
optimal performance numbers for the vTPS virtual appliance, ensure that thehypervisor provides adequate CPU and RAM for the VM. Performance
numbers will vary depending on hypervisor configuration and hardware
resources available.

The SSL performance of the physical TPS device and the vTPS Standard
virtual appliance (must have Performance mode deployed) differ in thefollowing areas.
Note
The TPS 440T, and 1100TX devices do not support SSL inspection.
TPS device

Description

vTPS virtual appliance

Profiles

8096

756

Policies

8096

756

Policy IP Exceptions

1024

128

2-5

vTPS User Guide

Description

TPS device

vTPS virtual appliance

Servers1024

128

Server IPs

8

8Server Ports

8

8

Certificates

2200T: 256

32

5500TX: 256
8200TX/8400TX: 256
9200TXE: 1,000

The following functionality is different in the vTPS Standard virtual
appliance.
Specification
Port configuration

User disk

TPS device

vTPS Standard virtual
appliance

Eight data ports. You canconfigure physicalcharacteristics of ports (suchas speed and duplex).

Two virtual data ports. You
cannot configure physicalcharacteristics of ports (such as
speed and duplex).

Ports are fixed.

You can remove and replace a
port.

External 8 GB CFast (440T/
2200T or SSD (1100TX) card.

No separate user disk. The vTPS
Standard virtual appliance has asingle-disk architecture with an
8-GB user disk partition.

External 32 GB SSD (5500TX,
8200TX/8400TX)
External 240 GB SSD(9200TXE)
Environmental
requirements

2-6

For operating, storage, andenvironmental
requirements, refer to theThreat Protection System
Hardware Specification andInstallation Guide.

Not applicable.

vTPS Functional Differences AddendumSpecification
External HA interfaces

vTPS Standard virtual
appliance

TPS device
1 HA port

No HA ports supported.

1 ZPHA port

Unsupported features
You can configure all available features using the vTPS interfaces (LSM, CLI,
SMS). Any unsupported features will not be displayed in these interfaces.
The following features supported in the physical TPS devices are notsupported in the vTPS Standard virtual appliance:• Physical characteristics of ports (such as speed and duplex). Ports are
virtual instead of copper or fiber.
• Data security (encrypting the removable disk that stores logs)• Link setting updates when you configure a port
• Transparent High Availability (TRHA) deployments• Zero Power High Availability (ZPHA) deployments
NoteThis means that the vTPS virtual appliance does not pass traffic at all
during a software upgrade or during a reboot of the device.

• VLAN Translation• Inspection bypass• sFlow® sampling• Jumbo frames• Reputation Enforcement Options (SMS-managed vTPS virtual appliancedeployed in Normal Mode only)• East-West protocol (such as VXLAN)
2-7

vTPS User Guide• Direct-attach network interface controller (NIC)

Commands
The following commands that a physical TPS device supports are notavailable for the vTPS virtual appliance:• Data security• log-storage• Health• reports (reset|enable|disable) fan• reports (reset|enable|disable) temperature• Port settings• interface <port_identifier> physical-media• interface mgmt physical-media• High availability – You can use the following high-availability
commands, but only for Layer 2 Fallback settings:• high-availability• high-availability force (normal | fallback)• show high-availability• sFlow sampling• sflow• show sflow• Inspection bypass• running-inspection-bypass context commands• show inspection-bypass• VLAN translation

2-8

vTPS Functional Differences Addendum• running-vlan-translations context commands• show vlan-translations• SSL inspection – You can use the running-sslinsp context commands,
but only if you deploy in Performance mode.

2-9Chapter 3

Install and configure the vTPS virtual
appliance
Use the following topics to configure your vTPS virtual appliance:• General requirements on page 3-2• Install and deploy a vTPS virtual appliance by using VMware ESXi on page
3-2
• Install and deploy a vTPS virtual appliance by using KVM on page 3-13
Note
All virtual machines (VMs) on a shared host compete for resources. When ahypervisor becomes overloaded with too many VMs or with VMs that are
resource-intensive, a system boot can potentially slow down to the point of
failure. To prevent delays or timeout errors in the boot process, watch for
deviations in system performance and reallocate the appropriate resources asnecessary.

Learn more about configuring security policy for your virtual appliance fromyour SMS and LSM documentation.

3-1

vTPS User Guide

General requirements
IPS performance can vary according to the hypervisor setting and use ofresources on the host VM. To deploy a vTPS virtual appliance in any softwareenvironment, follow these specifications:• Memory (RAM) – 16 GB• Number of CPU cores: 6• Disk space – 16.2 GB
Note
Although the vTPS virtual appliance supports both thin and thickprovisioning, use thick provisioning for optimum performance.

• CPU – Host CPU must support the AVX2 instruction set. These CPU
configurations were tested:• Intel Xeon CPU E5-2630v4• Intel Xeon CPU E5-2670v3• Intel Xeon CPU E5-2695v3• Intel Xeon CPU E5-2695v4• Intel Xeon CPU E5-2698v3• Intel Xeon CPU Silver 4316

Install and deploy a vTPS virtual appliance byusing VMware ESXi
Use the information in these topics to configure the vTPS virtual appliancefor startup by using the vCenter application:• VMware ESXi requirements on page 3-3• Configure the vTPS virtual appliance on VMware on page 3-3• Start your vTPS virtual appliance on page 3-12
3-2

Install and configure the vTPS virtual appliance• Upgrade to Standard Mode on page 3-13

VMware ESXi requirements
The vTPS virtual appliance supports the following system and softwareenvironment for a VMware ESXi deployment.
Important
Before upgrading to the current TOS version, check the ESXi user interface toensure that these requirements are met. If necessary, log in to vCenter tomake the updates.

• ESXi Hypervisor version:• Versions 7.0 or 8.0 (only paid versions supported)
Note
Install all updates on your hypervisor hosts before deploying virtual
devices in your ESXi environment.

• Virtual Hardware version: 11• Networking requirements:• Three vNICs — one for management and two for data. The vTPS
supports both vSwitches and distributed vSwitches (dvSwitches).
• You must configure the two data vNICs in promiscuous mode forLayer 2 routing. To avoid ARP request flooding, configure the twodata ports on separate networks. Ensure that you set any Forged
Transmits and MAC Address Changes to ACCEPT so that network
packets get forwarded.
• Layer 3 virtual segments do not require promiscuous mode.

Configure the vTPS virtual appliance on VMware
To configure vTPS virtual appliance on VMware:

3-3

vTPS User Guide

Procedure
1.

Create three virtual switches on the ESXi host—one for the management
port and two for the data ports, and ensure that you connect the threevNICs to the correct virtual switches.
Learn more about VMware.
Note
Consider the following when configuring your network ports.
• In order for the vTPS to function properly for Layer 2 routing, create
the ports, map them to their correct interfaces, and enable them inpromiscuous mode. (Promiscuous mode is not required for Layer 3
virtual segments.)• By default, ESXi attempts to attach all the adapters to the virtual
switch that was created first.
• Make sure that you set any Forged Transmits and MAC Address
Changes to ACCEPT for network packets to get forwarded.
• If you deploy two vTPS devices using the same two networks, traffic
loops through both devices.
• You must configure the VLAN ID field to All(4095) for data portvirtual switches if you intend to use VLANs for data ports.
• If your configuration requires traffic to cross multiple VLANs before
reaching the vTPS, make sure that your remove the VLAN tags fromthe ports to prevent the traffic from going through the same networkon its way back.

3-4

2.

Copy the vTPS OVA package to your system. Use VMware ovftool build
4.6.

3.

From vSphere, open the package and launch the Deploy OVF Template
wizard.

Install and configure the vTPS virtual appliance

After you have verified that the publisher information and accepted the
End User License Agreement (EULA), specify the OVF template to use
from a URL or your local system.

4.

On the Select a name and folder screen, you can rename and choose a
specific install location for the VM instance, or you can accept thedefault name and location.

3-5

vTPS User Guide

3-6

5.

Select the destination resource that you want on the Select a computeresource screen.

6.

Review the template details and click Next to verify or Back to makechanges.

7.

Accept the License Agreement and click Next.

Install and configure the vTPS virtual appliance

8.

Select a deployment configuration on the Configuration screen.

9.

Select where to store the configuration and the format in which to store
the virtual disks on the Select storage screen.

3-7

vTPS User Guide

Note
The vTPS virtual appliance supports both thin and thick provisioning.
For optimum performance, use thick provisioning.

10. On the Select networks screen, map your three source network options
to a destination network.

Note
Accepting the default values configures the management port and thedata ports on the same network, which can flood the environment with
ARP requests. To avoid this, ensure that you configure the two data ports
on different networks.

The first interface you provide is your management port. Ensure thatyour management network can access this port. Then select networks
for the two data ports according to your virtual switch/port
configuration.

3-8

Install and configure the vTPS virtual appliance

Important
Ensure that you correctly map your network adapters so that you canaccess your vTPS virtual appliance by using the CLI and SMS client.

11. If you use a vSphere client to deploy directly on a host, you canconfigure the vTPS parameters only after the vTPS boots using the outof-box experience (OBE) interface on the console. If you use a vCenter
server to deploy, the Customize template screen prompts you to
configure the parameter values:• IP address• Netmask value• Default Gateway• IPv6 Address (optional)• IPv6 Prefix Length (optional)• IPv6 Default Gateway (optional)• IPv6 Autoconfiguration (optional)• Hostname (required)• Host location (optional)• IP address of DNS servers (optional)—You can add up to two
addresses
Note
The VMware deployment screen supports setting up only an IPv4 IP
address. If you want to set up an IPv6 address, first install the vTPS
virtual appliance with IPv4 by using the OBE interface on the
console. Configure an IPv6 address after you boot the device.

• DNS Domain Name (optional)• Security Level

3-9

vTPS User Guide• Username—The SuperUser user name• Password for the SuperUser• Console—Default and recommended value is vga; if you specify
serial as the console, Learn more on page 5-5 about how to
configure it
Note
The vTPS virtual appliance supports only one console type. Afteryou initially select the console type, you would have to redeploy thevTPS virtual appliance to change the console type.

• SSH Public Key for the superuser account (this field is optional)• Certificate URL (optional)—Your vTPS virtual appliance attempts to
get the file from the URL and install the device certificate to convert
from Trial Mode to Standard Mode; you can complete this task
another time, if needed, by using the SMS client.
When you have entered values for all the properties, click Next.
Note
Any properties that you do not assign a value to remain unassigned.

12. Verify that all the properties have been correctly set for yourdeployment in the Ready to Complete screen.

3-10Install and configure the vTPS virtual appliance

13. Click Finish.
The initial boot displays your deployment progress and any messages
with the VGA console, even if you previously selected serial as theconsole. The interface prompts you to provide values for any
deployment questions you previously skipped.
After the OBE boot completes:• If you provided a certificate URL during the deployment, the vTPS
virtual appliance automatically downloads the certificate and reboots toactivate it.
• If you selected to use the serial console, the vTPS virtual appliance
automatically reboots. The serial console displays all messages from thisnext boot.
Note
The vTPS virtual appliance does not support a hitless reboot or hitless
upgrade. Traffic flow is interrupted until the boot sequence completes
because, unlike on a TPS device, the network ports on a vTPS virtual
appliance are virtual.

3-11

vTPS User Guide• If neither of the preceding bullets apply, a login prompt is displayed. You
can now access the device using the console, SSH or SMS client.

Start your vTPS virtual applianceFollow these steps to complete the initial deployment:
Procedure
1.

In vCenter, right-click your new VM and select Power > Power on fromthe menu.

2.

If you did not use vCenter to provide network settings, you can accessthe vCenter VGA console for the vTPS virtual appliance to configure
those settings.

What to do next
If you did not use vCenter to provide license key information in thepreceding step, the vTPS virtual appliance boots in Trial Mode by default.
The following display from the CLI indicates that you are in Trial Mode.
docvtps{}show version
Serial: D-VTPS-TRIAL-0001
Software: 6.2.0.4803i Build Date: “dep 13 2023 16:09:27”
Production [9ac20f021]
Digital Vaccine: 4.0.0.1000
Reputation DV: N/A
Model: vTPS Standard Trial
HW Serial: TMTPVT1ABC
HW Revision: VSA
Failsafe: 1.3.0.4801
Throughput: 100 Mbps
System Boot Time: Fri Sep 15 20:56:55 2023
Uptime: 00:02:06

3-12

Install and configure the vTPS virtual appliance

Upgrade to Standard ModeIf you did not provide a certificate URL during deployment, upgrade toStandard Mode. Learn More on page 4-1 about upgrading to Standard Mode.
If you did provide a certificate URL during deployment, activation of thecertificate occurs automatically.

Install and deploy a vTPS virtual appliance byusing KVM
Use the information in these topics to configure the vTPS virtual appliancefor startup by using a kernel-based virtual machine (KVM):• KVM requirements on page 3-13
• Obtain software licensing and certificates on page 3-15
• Deploy a vTPS virtual appliance on KVM on page 3-15
• Automating vTPS installation on KVM on page 3-18
• Upgrade to Standard Mode on page 3-13

KVM requirements
A KVM deployment of the vTPS virtual appliance that uses the following
specifications has been verified:• Software environments – Ensure you have the following minimum
requirements:

3-13

vTPS User Guide

Note
vTPS installation has been verified with RHEL version 8.0 or 9.0 KVM
hosts. A six-core configuration requires the following minimum software
package versions:• libvirt version 1.1.0• Quick Emulator (QEMU) version 8.0.3• virt-install version 1.1.0• Networking environments – Ensure you have three bridge interfaces:
one for management and two for data. Each data bridge should be
associated with a KVM network.
# nmcli connection add type bridge con-name mgmt ifname mgmt
# nmcli connection add type bridge con-name data-A ifname
data-A bridge.ageing-time 0 bridge.stp no ipv4.method
disabled ipv6.method disabled mtu 9000
# nmcli connection add type bridge con-name data-B ifname
data-B bridge.ageing-time 0 bridge.stp no ipv4.method
disabled ipv6.method disabled mtu 9000
Note
Disabling address learning using bridge.ageing-time 0 ensures thatbridges properly forward all Layer 2 frames to the vTPS. Otherwise,
especially in cases where a single data port sees both sides of the
network connection (such as in IDS mode), the bridge is prevented fromsending the frames to the vTPS appliance by the default address learningmode.

Create KVM networks around the data bridges by defining theirproperties in XML files, and then importing that XML file into libvirt:# cat data-A.xml<network>

3-14

Install and configure the vTPS virtual appliance<name>data-A</name><forward mode="bridge"/><bridge name="data-A"/></network># cat data-B.xml<network><name>data-B</name><forward mode="bridge"/><bridge name="data-B"/></network># virsh net-define data-A.xml# virsh net-define data-B.xml• Console access – Default and recommended console is a graphical UI,
such as virt-manager, virt-viewer, vncviewer, or other VNC client. Learn
more on page 5-5 about configuring the serial console.
Note
The vTPS virtual appliance supports only one console type. After you
initially select the console type, you cannot change it later.

Obtain software licensing and certificates
For information, see Upgrade from vTPS Trial to vTPS Standard on page 4-1.

Deploy a vTPS virtual appliance on KVM
To install a vTPS on KVM:
Procedure
1.

Copy the vTPS tar package to your system.

2.

Extract the package with the tar --sparse -zxvf
vTPS_performance_kvm_x.x.x_xxxxx.tar.gz command.

3.

Use the chmod command to change permissions so that the QEMU user
can access the file:
3-15

vTPS User Guide

chmod a+rwx system_disk.raw

4.

Use the virt-install command to deploy the vTPS package according
to your RHEL version.
To deploy a vTPS virtual appliance in the libvirt 1.1.0 environment, use
the virt-install command as follows.
virt-install \--name=<name of your VM> --ram=16384 \--vcpus sockets=1,cores=6 \--boot hd --disk path=<path of your system_disk.raw file> \--network bridge=mgmt,model=e1000 \--network network=data-A,model=virtio,driver_queues=6 \--network network=data-B,model=virtio,driver_queues=6 \--graphics vnc,port=59<xy>,listen=<ip_of_kvm_host> \--virt-type=kvm --cpu Haswell,+ssse3,+sse4.1,+sse4.2,-svm,+aes,+pclmuldq,-hle,-rtm,optional=rdrand \--force --wait -1

Important:
In order for the VM to incorporate the CPU features, additional
configuration might be necessary. Learn more on page 3-2 about
configuring CPU features.
After running the preceding virt-install command, shut down the
VM. Use virt-manager to adjust the CPU parameter to host, Haswell,or newer:a. Select Processor from the list of hardware.
b. Toggle the Configuration triangle and select the appropriate
processor model.
c. Either pick a CPU type manually from the list or click Copy Host
CPU Configuration for the best CPU to match with this host.
d. Click Apply.

3-16

Install and configure the vTPS virtual appliance

You can also accomplish this task by using virsh edit VM-NAME to edit
the VM XML file. Learn more about this option.
Note
The --wait option keeps your program running on the shell. After you
have installed the vTPS Software License Key and the vTPS virtual
appliance is running, you can type Control-C to return to the prompt.

3-17

vTPS User Guide

The preceding commands create a vTPS VM with the name <name ofyour VM>. To manage or access the VM, use the virsh CLI.
To access the open console of the VM, use vncviwer or virt-viewer
after setting the DISPLAY environment variable as follows:
vncviewer <ip_of_kvm_host>:59<xy> (the <port value> you
supplied for the graphics field of the virt-install command)orvirt-viewer --connect qemu+ssh://root@ip_of_kvm_host/system$VM_NAME

This completes the vTPS deployment.

Automating vTPS installation on KVM
Procedure1.

Use the yum install genisoimage command to install genisoimage
on an RHEL system.

2.

Copy the vTPS tar package to your system.

3.

Use the tar --sparse -zxvf vTPS_kvm_x.x.x_xxxxx.tar.gz
command to extract the package.

4.

To configure the vTPS parameters from the KVM command line, create atext file named vtps-env.txt (Note: the file must be named this) withthis format:
com_tippingpoint_IP = <Management IP address of vTPS>
com_tippingpoint_Netmask = <Subnet Mask>
com_tippingpoint_Gateway = <IP Address of Gateway>
com_tippingpoint_Username = <username>com_tippingpoint_Password = <Password>
com_tippingpoint_DNS = <IP Address of DNS>
com_tippingpoint_DNS2 = <IP Address of DNS2> (optional)
com_tippingpoint_Security_Level = <none/low/medium/high>

3-18Install and configure the vTPS virtual appliance

com_tippingpoint_VSSH_Public_Key = SSH KEY (optional)
com_tippingpoint_Cert_URL = <Device Certificate URL> (optional)
com_tippingpoint_Console = serial (optional; for serial consoles
only)

For example, your file might look like the following sample:
com_tippingpoint_IP = 10.11.12.134
com_tippingpoint_Netmask = 255.255.255.0
com_tippingpoint_Gateway = 10.11.12.1
com_tippingpoint_Username = superuser
com_tippingpoint_Password = password
com_tippingpoint_DNS = 15.16.17.18
com_tippingpoint_DNS2 = 0.0.0.0
com_tippingpoint_Security_Level = None
com_tippingpoint_VSSH_Public_Key = SSH KEY
com_tippingpoint_Cert_URL = http://15.16.17.18/certificate.txt

5.

From the KVM command line, generate an ISO image of the vtpsenv.txt file with the genisoimage -r -o vtps_test_metadata.iso
vtps-env.txt command.
This command generates the following output:
root@vtps-kvm06:/# genisoimage -r -o vtps_test_metadata.iso
vtps-env.txt
I: -input-charset not specified, using utf-8 (detected inlocale settings)
Total translation table size: 0
Total rockridge attributes bytes: 252
Total directory bytes: 0
Path table size(bytes): 10
Max brk space used 0
176 extents written (0 MB)
root@vtps-kvm06:/#

3-19

vTPS User Guide

Note
The exact output varies depending on the input to the vtps-env.txt file.

6.

Use the chmod command to change permissions so that the QEMU user
can access the file:chmod a+rwx system_disk.raw
chmod a+rwx vtps_test_metadata.iso7.

Set the following environment variables to the displayed values:• VM_NAME=$VM_NAME• RAM_SIZE=16384 #8388608 #8GB : 1GB = 1048576• SYSTEM_DISK_PATH=<location of the image files>/system_disk.raw• CDROM_IMAGE=<location of the iso file>/
vtps_test_metadata.iso8.

Use the virt-install command to deploy the vTPS package according
to your RHEL version.
Attach the generated ISO image (as if it were a CD-ROM) and thebootloader, and deploy the vTPS package in the libvirt 1.1.0 environment
with the virt-install command.
virt-install \--name=$VM_NAME --ram=16384 --vcpus sockets=1,cores=6 \--boot hd --disk path=$SYSTEM_DISK_PATH--cdrom=$CDROM_IMAGE \--network bridge=<management bridge>,model=e1000 \--network network=<ingress network name>,model=virtio,
driver_queues=6 \--network network=<ingress network name>,model=virtio,
driver_queues=6 \--graphics vnc,port=59<xy>,listen=<ip_of_kvm_host> \--virt-type=kvm --cpu Haswell,+ssse3,+sse4.1,+sse4.2,

3-20

Install and configure the vTPS virtual appliance-svm,+aes,+pclmuldq,-hle,-rtm,optional=rdrand \--force --wait -1
Note
The --wait option keeps your program running on the shell. After you
have installed the vTPS Software License Key and the vTPS virtual
appliance is running, you can type Control-C to return to the prompt.

The preceding commands create a vTPS VM with the name <name ofyour VM>. To manage or access the VM, use the virsh CLI.
To access the open console of the VM, use vncviwer or virt-viewer
after setting the DISPLAY environment variable as follows:
vncviewer <ip_of_kvm_host>:59<xy> (the <port value> you
supplied for the graphics field of the virt-install command)orvirt-viewer --connect qemu+ssh://root@ip_of_kvm_host/system$VM_NAME

This completes the automated KVM vTPS deployment.

Upgrade to Standard ModeIf you did not provide a certificate URL during deployment, upgrade toStandard Mode. Learn More on page 4-1 about upgrading to Standard Mode.
If you did provide a certificate URL during deployment, activation of thecertificate occurs automatically.

Install and deploy by using OpenStack HEAT
template for vTPSA HEAT template can be used to describe the vTPS infrastructure.

3-21

vTPS User Guide

Note
The instructions in this section describe both a GUI deployment and a CLI
deployment of a TippingPoint vTPS that uses the OpenStack Liberty release. If
you use a different release or customization of OpenStack components, you
might see small variations in the procedures.

• vTPS emulation requirements on page 3-22
• vTPS functional requirements on page 3-22
• Deploy the TippingPoint vTPS on OpenStack using the CLI on page 3-23
• Deploy the TippingPoint vTPS on OpenStack using the GUI on page 3-30

vTPS emulation requirements
The OpenStack HEAT template requires the following emulation
configuration:
1. Processor emulator – ssse3 eabled
2. Disk driver – ide
3. Support for virtio on all three interfaces (management port and two data
ports)vTPS functional requirements
The OpenStack HEAT template requires the following functional
configuration:
1. Hypervisor – kvm
2. Virtual processors – 6
3. RAM – 16 GB
4. Disk image – 1 (system disk required, 16 GB total size)
5. Configuration drive – optional

3-22

Install and configure the vTPS virtual applianceDeploy the TippingPoint vTPS on OpenStack using the CLI
Before you begin
Create a Linux virtual environment and text file with the following
authorization credentials:
export OS_USERNAME=**********
export OS_PASSWORD=********
export OS_TENANT_ID=*******
export OS_AUTH_URL=https://<keystone-url>:5000/v3

Source this text file so that you credentials can be loaded as environment
variables:source <auth_file>

Procedure
1.

Install the OpenStack client:sudo apt install python3-openstackclient
Note
A different command is required if you are not running Ubuntu.

2.

Import the image:sudo tar --sparse -zxvf <file_name>openstack image create --private --disk-format raw--container-format bare --file <file_name> <image_name>3.

Specify the metadata:
openstack image set <image_name> --property hypervisor_type=kvm
openstack image set <image_name> --property
hw_disk_bus=ide

3-23

vTPS User Guide

openstack image set <image_name> --property
hw_vif_model=virtio
openstack image set <image_name> --property
hw_vif_multiqueue_enabled=true

4.

Install the Heat client:sudo apt install python3-heatclient
Note
A different command is required if you are not running Ubuntu.

5.

(Optional) Set the parameters as defaults within the HEAT orchestration
Template (HOT):
heat_template_version: 2015-10-15
description: Simple vTPS instance with 1 mgmt port and 2
data ports. It will use 4/3 VCPU and 8 GB memory. The
template will require the user to use the fixed IP address
for the management port. The flavor should be based on thecompute host capability.
parameters:
vtps_image_id:
type: stringlabel: vTPS Image
description: Image to be used for vTPS instanceconstraints:- custom_constraint: glance.image
description: Select the Glance image
vtps_instance_type:
type: stringlabel: vTPS Instance Flavor

3-24Install and configure the vTPS virtual appliancedescription: Type of instance (flavor) to be used for vTPS
constraints:- custom_constraint: nova.flavor
description: Select the Nova flavor
private_net_vtps_mgmt:
type: stringlabel: Management Network
description: ID of network into which vTPS is deployed
constraints:- custom_constraint: neutron.network
description: Select the Management network
private_net_vtps_untrust:
type: stringlabel: Untrusted Network
description: ID of network into which vtps data port 1A
is deployed
constraints:- custom_constraint: neutron.network
description: Select the untrusted network
private_net_vtps_trust:
type: stringlabel: Trusted Network
description: ID of network into which vtps data port 1B
is deployed
constraints:- custom_constraint: neutron.network
description: Select the trusted network
admin_username:type: stringlabel: Admin Username

3-25

vTPS User Guide

description: default admin user name.
admin_password_security_level:
type: stringlabel: Admin Password Security Leveldescription: the security level for the password for theadmin user
default: Noneconstraints:- allowed_values:- None- Low- Medium- Highadmin_password:
type: stringlabel: Admin Password
description: Password for the admin user
hidden: true
admin_ssh_key:
type: string
description: SSH key pair for admin accountconstraints:- custom_constraint: nova.keypair
description: Must name a public key (pair) known to Nova

instance_license:
type: stringlabel: License String
description: vTPS instance license certificate
default:

3-26

Install and configure the vTPS virtual applianceresources:
vtps_mgmt_port:
type: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_mgmt }vtps_data_port_A:
type: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_untrust }vtps_data_port_B:
type: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_trust }vtps_instance:
type: OS::Nova::Server
depends_on: [ vtps_mgmt_port, vtps_data_port_A,
vtps_data_port_B ]properties:
key_name: { get_param: admin_ssh_key }image: { get_param: vtps_image_id }flavor: { get_param: vtps_instance_type }networks:- port: { get_resource: vtps_mgmt_port }- port: { get_resource: vtps_data_port_A }- port: { get_resource: vtps_data_port_B }config_drive: "true"
user_data_format: RAW
user_data:
str_replace:
template: |3-27

vTPS User Guide

com_tippingpoint_EULA_accept = true
com_tippingpoint_IP = __instance_mgmt_IP__
com_tippingpoint_Gateway = __instance_Gateway__com_tippingpoint_Security_Level = __admin_level__
com_tippingpoint_Username = __admin_username__
com_tippingpoint_Password = __admin_password__
com_tippingpoint_VSSH_Public_Key = __admin_ssh_key__
com_tippingpoint_Cert_License = __instance_license__
params:__instance_mgmt_IP__:
list_join:- ''- - {get_attr: [vtps_mgmt_port, fixed_ips,
0, ip_address]}- '/'- {str_split: ['/', {get_attr:[vtps_mgmt_port, subnets, 0, cidr]},1]}__instance_Gateway__: { get_attr: [vtps_mgmt_port,
subnets, 0, gateway_ip] }__admin_level__: { get_param:admin_password_security_level }__admin_username__: { get_param: admin_username }__admin_password__: { get_param: admin_password }__admin_ssh_key__: { get_param: admin_ssh_key }__instance_license__: { get_param:
instance_license }outputs:
vtps_instance_name:description: Name of the instancevalue: { get_attr: [vtps_instance, name] }vtps_instance_id:
description: ID of the instance

3-28

Install and configure the vTPS virtual appliancevalue: { get_resource: vtps_instance }mgmt_ip:
description: IP with CIDR for the vtps mgmt network.
value:
list_join:- ''- - {get_attr: [vtps_mgmt_port, fixed_ips, 0,
ip_address]}- '/'- {str_split: ['/', {get_attr: [vtps_mgmt_port,
subnets, 0, cidr]}, 1]}
Note
To access the vTPS using a serial connection, add
com_tippingpoint_Console = serial below the
com_tippingpoint_EULA_accept = true setting.

6.

Create the stack:openstack stack create -t /file/path/<heat_template><Stack_Name> \--parameter vtps_image_id=<image_id> \--parameter vtps_instance_type=<flavor_id> \--parameter private_net_vtps_mgmt=<network_id> \--parameter private_net_vtps_trust=<network_id> \--parameter private_net_vtps_untrust=<network_id> \--parameter admin_username=<admin_username> \--parameter admin_password_security_level=<None,Low,
Medium,High> \--parameter admin_password=<admin_password> \--parameter admin_ssh_key=<admin_keypair> \--parameter instance_license=<license_string>

3-29

vTPS User Guide

To get the parameters, use the following commands:
image_id = openstack image list
flavor_id = openstack flavor list
network_id = openstack network list

Deploy the TippingPoint vTPS on OpenStack using the GUI
Before you begin
To prepare for deployment:• Ensure the Qemu processor type has the ssse3 flag enabled. To enable
the flag in compute mode, edit the nova.conf file.
• Add the following lines to the [libvirt] section of the /etc/nova/
nova.conf or /etc/nova/nova-compute.conf file:[libvirt]
virt_type = kvm
cpu_mode = passthroughdisk_prefix = hd

• After saving your modifications, restart any of the following available
nova services that run on your server:• openstack-nova-api• openstack-nova-cert• openstack-nova-consoleauth• openstack-nova-scheduler• openstack-nova-conductor• openstack-nova-novncproxyEnter the context of your task here (optional).

3-30

Install and configure the vTPS virtual appliance

Procedure1.

Log in to the OpenStack GUI (Horizon).

2.

Add vTPS images to Horizon.
a.

To place raw system and user vTPS images in an accessible location,
upload them by selecting Compute > Images and then clicking theCreate Image button.
3-31

vTPS User Guideb.

In the Create Image screen, fill in the details for the system disk andselect the vTPS system disk image.

c.

Click the Create Image button.

d.

Click Metadata to update the image metadata.
To update the Existing Metadata for the system disk, type
hw_disk_bus in the Custom field of the Available Metadata column
and then click on the + button to add the value to the Existing
Metadata column. Repeat this step to add virtio as the

3-32Install and configure the vTPS virtual appliancehw_vif_model value and true for the hw_vif_multiqueue_enabledvalue (required for images of CPUs with three or more cores). Click
Create Image.

e.

As the image uploads, you can monitor the status.

3-33

vTPS User Guide

After the images are added, you can view them by selecting
Compute > Images.

3.

Select Network > Networks and click Create Network to create two data
networks for data traffic.
Note
The public subnet for the management network should already exist.

3-34

Install and configure the vTPS virtual appliancea.

In the Create Network dialog, provide the details for the first
network data port and click Next.

Provide details of the first network data port's subnet and click
Create.

3-35

vTPS User Guide

4.

b.

Repeat the preceding substeps accordingly to specify details for thesecond data port and subnet.

c.

You can view the created networks by clicking Network > Networks.

Select Admin > System > Flavors to create a vTPS flavor.
a.

3-36

In the Flavor Information tab of the Create Flavor dialog, specify
the details for the flavor.

Install and configure the vTPS virtual applianceb.

In the Flavor Access tab of the Create Flavor dialog, specify theaccess privileges for the flavor according to the needs of yourproject.
For example, the following configuration provides the admin
project access to the flavor.

3-37

vTPS User Guide

3-38

c.

After you specify all details of the flavor, click Create Flavor.

d.

You can view the flavor by clicking System > Flavors.

e.

Click the down arrow next to Edit Flavor to set thehw:vif_multiqueue_enabled metadata as True for the flavor. Thisupdate is necessary for images of CPUs with three or more cores.

Install and configure the vTPS virtual appliancef.

Click Save.

5.

Before creating the stack, ensure your vTPS yml template file is in anaccessible location on your system.

6.

Select Orchestration > Stacks and click Launch Stack to launch thevTPS stack.
a.

In the Select Template dialog, specify the yml template file and click
Next.

3-39

vTPS User Guide

b.

3-40

Specify the details for the stack, including appropriate values for the
network, image, and flavor, and click Launch.

Install and configure the vTPS virtual appliance

3-41

vTPS User Guide

c.

3-42

Confirm the creation status of the stack by selecting Orchestration> Stacks.

7.

Select Compute > Instances and select the vTPS instance so you canconnect to it.

8.

Click on the Console tab to access the vTPS console and begin the OBE
configuration.

Install and configure the vTPS virtual appliance

Based on how you configured your yml file, the OBE wizard runs
automatically, including a reboot to retrieve the OBE parameters andanother reboot to install the device certificate.
Note
The vTPS virtual appliance does not support a hitless reboot or hitless
upgrade. Traffic flow is interrupted until the boot sequence completes
because, unlike on a TPS device, the network ports on a vTPS virtual
appliance are virtual.

Template sample
To access a sample HEAT template file, untar the vTPS Tar package and open
the basic_port_vtps.yaml template file. The following template shows
values for a sample Normal image environment only. In an actual
deployment, values will vary according to each environment.

3-43

vTPS User Guide

heat_template_version: 2015-10-15
description: Simple vTPS instance with 1 mgmt port and 2 data
ports. It will use 4/3 VCPU and 8 GB memory. The template will
require the user to use the fixed IP address for the
management port. The flavor should be based on the compute
host capability.
parameters:
vtps_image_id:
type: stringlabel: vTPS Image
description: Image to be used for vTPS instanceconstraints:- custom_constraint: glance.image
description: Select the Glance image
vtps_instance_type:
type: stringlabel: vTPS Instance Flavor
description: Type of instance (flavor) to be used for vTPS
constraints:- custom_constraint: nova.flavor
description: Select the Nova flavor
private_net_vtps_mgmt:
type: stringlabel: Management Network
description: ID of network into which vTPS is deployed
constraints:- custom_constraint: neutron.network
description: Select the Management network

3-44

Install and configure the vTPS virtual applianceprivate_net_vtps_untrust:
type: stringlabel: Untrusted Network
description: ID of network into which vtps data port 1A is
deployed
constraints:- custom_constraint: neutron.network
description: Select the untrusted network
private_net_vtps_trust:
type: stringlabel: Trusted Network
description: ID of network into which vtps data port 1B is
deployed
constraints:- custom_constraint: neutron.network
description: Select the trusted network
admin_username:type: stringlabel: Admin Username
description: default admin user name.
admin_password_security_level:
type: stringlabel: Admin Password Security Leveldescription: the security level for the password for theadmin user
default: Noneconstraints:- allowed_values:- None- Low- Medium

3-45

vTPS User Guide- Highadmin_password:
type: stringlabel: Admin Password
description: Password for the admin user
hidden: true
admin_ssh_key:
type: string
description: SSH key pair for admin accountconstraints:- custom_constraint: nova.keypair
description: Must name a public key (pair) known to Nova

instance_license:
type: stringlabel: License String
description: vTPS instance license certificate
default:
resources:
vtps_mgmt_port:
type: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_mgmt }vtps_data_port_A:
type: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_untrust }vtps_data_port_B:

3-46

Install and configure the vTPS virtual appliancetype: OS::Neutron::Port
properties:
network: { get_param: private_net_vtps_trust }vtps_instance:
type: OS::Nova::Server
depends_on: [ vtps_mgmt_port, vtps_data_port_A,
vtps_data_port_B ]properties:
key_name: { get_param: admin_ssh_key }image: { get_param: vtps_image_id }flavor: { get_param: vtps_instance_type }networks:- port: { get_resource: vtps_mgmt_port }- port: { get_resource: vtps_data_port_A }- port: { get_resource: vtps_data_port_B }config_drive: "true"
user_data_format: RAW
user_data:
str_replace:
template: |com_tippingpoint_EULA_accept = true
com_tippingpoint_IP = __instance_mgmt_IP__
com_tippingpoint_Gateway = __instance_Gateway__com_tippingpoint_Security_Level = __admin_level__
com_tippingpoint_Username = __admin_username__
com_tippingpoint_Password = __admin_password__
com_tippingpoint_VSSH_Public_Key = __admin_ssh_key__
com_tippingpoint_Cert_License = __instance_license__
params:__instance_mgmt_IP__:
list_join:- ''- - {get_attr: [vtps_mgmt_port, fixed_ips, 0,

3-47

vTPS User Guide

ip_address]}- '/'- {str_split: ['/', {get_attr:[vtps_mgmt_port, subnets, 0, cidr]}, 1]}__instance_Gateway__: { get_attr: [vtps_mgmt_port,
subnets, 0, gateway_ip] }__admin_level__: { get_param:admin_password_security_level }__admin_username__: { get_param: admin_username }__admin_password__: { get_param: admin_password }__admin_ssh_key__: { get_param: admin_ssh_key }__instance_license__: { get_param: instance_license }outputs:
vtps_instance_name:description: Name of the instancevalue: { get_attr: [vtps_instance, name] }vtps_instance_id:
description: ID of the instancevalue: { get_resource: vtps_instance }mgmt_ip:
description: IP with CIDR for the vtps mgmt network.
value:
list_join:- ''- - {get_attr: [vtps_mgmt_port, fixed_ips, 0,
ip_address]}- '/'- {str_split: ['/', {get_attr:[vtps_mgmt_port, subnets, 0, cidr]}, 1]}

3-48

Chapter 4

Upgrade from vTPS Trial to vTPS
Standard
To upgrade your vTPS virtual appliance from Trial Mode to vTPS Standard
Mode, install the license entitlement package and the license certificate
package. You can purchase a license through your regular sales channel.
The vTPS virtual appliance remains in Trial Mode until you install a valid
certificate. The Trial Mode vTPS comes with limited feature capabilities.
After you install a certificate, the vTPS virtual appliance deploys in Standard
Mode, and the capabilities purchased with the license package are activated.
When the vTPS virtual appliance upgrades to Standard Mode, you can installyour Digital Vaccine package.
Learn more about how to install the license entitlement package, create,
download, and install the license certificate package, and install your Digital
Vaccine package:• Install your license entitlement package on page 4-2• Create and download vTPS virtual appliance license certificates on page 4-2• Install the vTPS license certificate using the SMS client on page 4-4• Install a Digital Vaccine package on page 4-4

4-1

vTPS User Guide

Install your license entitlement package
Note
If your vTPS virtual appliance is managed by an SMS, you can configure the
SMS to automatically retrieve and distribute the most current license
entitlement package. Learn more from the SMS User Guide.

You can retrieve your license entitlement package from the TMC (MyAccount > TippingPoint License Package).
For information on installing your license entitlement package, refer to yourLSM and SMS documentation.

Create and download vTPS virtual appliancelicense certificates
Use the following information to create a vTPS license certificate using thelicense manager. The license certificate package assigns a purchased
inspection throughput license to a vTPS virtual appliance. After you create avTPS license certificate, install the certificate on the vTPS virtual appliance.
To create a vTPS device license certificate
Procedure
1.

Open the license manager.
To access the license manager, navigate to My Account > LicenseManager on the TMC.

2.

From the License Management page of the license manager, click Create
vTPS Licenses.

3.

(Optional) If you want to add SSL inspection to a vTPS device, but SSL isdisabled, apply for SSL compliance.
There are four states of SSL compliancy; Unknown, Pending, Compliant,and Non-Compliant. Before you enable SSL, the SSL compliancy state is
set at Unknown.

4-2

Upgrade from vTPS Trial to vTPS Standard

Complete the following steps to apply for SSL compliance:a.

Next to Your SSL is disabled, click Apply Now.

b.

Fill out the Apply for SSL Compliance page.

c.

Click Apply.
After you click Apply, the SSL compliance state changes to Pending.
When the application process is completed, the state changes toeither Compliant if SSL is approved or Non-Compliant if SSL is not
approved.
If you are SSL Compliant, SSL inspection is enabled on all of yourvTPS virtual appliances.

4.

Under Action, select the number of vTPS certificates that you want tocreate.

5.

Click Create.

After the vTPS certificate is created, use the SMS client to install thecertificate to a vTPS virtual appliance.

Important
If you do not use an SMS or if your SMS is not connected to the TMC, you must
manually download and install the vTPS certificate package. After you
download the vTPS certificate package, you can manually install the package
from the SMS client.

To download the vTPS certificate package
Procedure1.

In the license manager, click Download Cert.

2.

Select vTPS Cert from the drop down options.
The vTPS Certificate Package page is displayed on the TMC.
4-3

vTPS User Guide

3.

Click Download.

4.

Accept the EULA Agreement.

5.

Save the vTPS certificate file to a local folder.

Install the vTPS license certificate using the SMS client
To install a license entitlement package for a managed vTPS appliance using
the SMS client, consult the "To manually import a device license entitlement
package" topic in the SMS User Guide.

Install a Digital Vaccine package
Note
If you use an SMS to manage your vTPS virtual appliance, you can configure
the SMS to automatically retrieve and distribute the most current Digital
Vaccine package each week. Learn more about how to configure this from the
SMS User Guide.

While in Trial Mode, your vTPS virtual appliance has a base Digital Vaccine
installed with a limited number of security filters that cannot be changed.
After you upgrade your device to Standard Mode, you can then install a full
Digital Vaccine package.
Learn more about installing your Digital Vaccine package from your SMS
documentation.

4-4

Chapter 5

Troubleshooting tips
Before contacting support, check to see if the following troubleshooting tips
address your issues.
Configuring a distributed switch environment in promiscuous mode
Resolution: You must configure a vTPS virtual appliance in promiscuous(port-mirroring) mode for Layer 2 routing. If a vTPS virtual appliance isconnected to a distributed switch, ensure that any Forged Transmits and
MAC Address Changes are set to ACCEPT so that network packets can be
forwarded to each host in the port group.
Resolution: Although the vTPS virtual appliance does not support VMware
vMotion, you can emulate a vMotion configuration by connecting two or
more different hosts with two or more vTPS virtual appliances that are
actively connected to the distributed vSwitch. The vTPS virtual appliancethat is connected to the active VM acts as an IPS, and the vTPS virtual
appliance that is not connected to the VM acts as an IDS. If you connect your
SMS to both vTPS instances, the SMS will also receive any blocks and alerts.
KVM deployment does not bootResolution: Ensure that you have all of the Ethernet ports configured. If you
install your VM without the correct number of inspection ports, you must
either delete the VM and reinstall it or perform a debug factory-reset. If
you delete and reinstall the VM, you must be sure to also delete the
5-1

vTPS User Guidesystem_disk.raw file. You can then re-extract the file from the KVM tar.gz

image file.

CPU usage always displays as 100% in hypervisor
Resolution: To see the actual CPU usage, enter the show health cpu
command for the device.
Resolution: To manage the CPU usage, create a resource pool in the vSphere
Web Client. Learn more about resource pools.
Errors after Suspend and Resume operation
Resolution: Ignore HEALTH-ALERT errors generated after a Suspend andResume operation.
Examining OpenStack HEAT template events
Resolution: Use the heat event-list <name of stack> command to see alist of events.
Resetting OBE parameters after a factory reset
Resolution: A factory reset does not reset the initial deployment parametervalues—including IP address, username, and password. To change thesevalues, you must redeploy the vTPS virtual appliance.
Snapshot cannot be restored
Resolution: Only vTPS to vTPS snapshots are supported. Restoring snapshotsfrom other TippingPoint devices is not supported. Attempts will fail with thefollowing error.

5-2

Troubleshooting tips

Time synchronization issues in KVM environment
Resolution: If, after an extended Suspend and Resume operation, the device
time does not sync with the server time, shut down and restart the system.
Verifying OpenStack HEAT template properties
Resolution: Use the virsh utility to dump the template xml file and examine
your property settings, including the cpu count, the disk adapter type, andthe network adapters:
localuser@vTPS-Helion1:~/heat_templates$ virsh
Welcome to virsh, the virtualization interactive terminal.
Type:'help' for help with commands'quit' to quit

virsh #
virsh # list --all
Id
Name
State
---------------------------------------------------3
instance-00000002
running
virsh # dumpxml instance-00000002<cpu mode='custom' match='exact'><model fallback='allow'>Conroe</model><topology sockets='3' cores='1' threads='1'/></cpu><emulator>/usr/bin/kvm-spice</emulator><disk type='file' device='disk'><driver name='qemu' type='qcow2' cache='none'/><source file='/opt/stack/data/nova/instances/
56a5d809-5df5-435d-a665-24885891fff6/disk'/><target dev='hda' bus='ide'/><alias name='ide0-0-0'/>

5-3

vTPS User Guide<address type='drive' controller='0' bus='0'
target='0' unit='0'/></disk><interface type='bridge'><mac address='fa:16:3e:c0:b9:8a'/><source bridge='qbr4edb826d-6d'/><target dev='tap4edb826d-6d'/><model type='virtio'/><alias name='net0'/><address type='pci' domain='0x0000' bus='0x00'
slot='0x03' function='0x0'/></interface><interface type='bridge'><mac address='fa:16:3e:d8:1e:be'/><source bridge='qbr37a85eb2-d0'/><target dev='tap37a85eb2-d0'/><model type='virtio'/><alias name='net1'/><address type='pci' domain='0x0000' bus='0x00'
slot='0x04' function='0x0'/></interface><interface type='bridge'><mac address='fa:16:3e:7a:1f:90'/><source bridge='qbre8d767e5-f9'/><target dev='tape8d767e5-f9'/><model type='virtio'/><alias name='net2'/><address type='pci' domain='0x0000' bus='0x00'
slot='0x05' function='0x0'/></interface>

5-4

Troubleshooting tips

vTPS virtual appliance experiencing data port performance problems
Example: ID HEALTHCHECKD Device is still experiencing
performance problems (loss=<xx>%, threshold=<x>%). 0 alerts notlogged.
Resolution: Make sure that you properly configure three standard vSwitches
or distributed vSwitches on the ESXi or vCenter with multiple port groups fordata and vTPS management traffic.
Resolution: Avoid large iptable entries. Larger iptable entries can reduce
vTPS virtual appliance performance as much as 20 percent in a KVM
deployment.
Resolution: Make sure you enable port groups in promiscuous mode forLayer 2 routing. Ensure that you set any Forged Transmits and MAC Address
Changes to ACCEPT so that network packets can get forwarded.
Resolution: Confirm that you have configured each vTPS device with its own
data port group. Using the same vSwitches across multiple vTPS virtual
appliances can cause performance issues.
Configuring a serial console
ESXi Resolution: If you specified a serial console for your VM, add a serial
port by editing the properties of the VM:
1. Right-click your new VM and click Add.
2. Select Serial port and click then Next.
3. Select Connect via Network and click then Next.
4. Select Server and provide a port for the Port URI (for example,
telnet://:1239).
5. Click Next, and then click Finish.
6. Reboot the vTPS virtual appliance. Before the console completes thechange from VGA to Serial, the appliance reboots a second time
automatically.

5-5

vTPS User Guide

Note
The vTPS virtual appliance does not support a hitless reboot or hitless
upgrade. Traffic flow is interrupted until the boot sequence completes
because, unlike on a TPS device, the network ports on a vTPS virtual
appliance are virtual.

7. Enter the following command from a Linux shell to access the serial
console:telnet <esxi host> <port number>

For example:
telnet esxi01 1239

KVM Resolution: Follow the procedure in Automating vTPS installation on
KVM on page 3-18. Specify the com_tippingpoint_Console = serial option
in the vtps-env.txt file.
After you specify the serial console, enter the following to access the console
from the KVM host:virsh console <VM_NAME>

KVM also supports several alternative serial console modes, including TCP,
UDP, and UNIX. For these options, use virt-manager to delete the existing
serial device and add a different type. Learn more from the virtualization
administrative guides for KVM or RedHat.

5-6

Item Code: TPEM69847/230927