Deploy a VM for running the secure device connector and secure event connector

Before you begin

• Security Cloud Control requires strict certificate checking and does not support Web or Content Proxy inspection between the Secure Device Connector (SDC) and the internet. If using a proxy server, disable inspection for traffic between the SDC and Security Cloud Control.

• The SDC must have full outbound access to the internet on TCP port 443, or the port you have configured for device management.

• The devices that are managed by Security Cloud Control must allow inbound traffic from the SDC VM's IP address.

• Review Connect Allow inbound access for direct cloud connectivity to the Secure Device Connector to ensure proper network access.

• If you are using a proxy on your network, ensure that you have all the required details before running the host setup command. Most of the issues are related to incorrect proxy configurations. Important details are:

  • The IP/hostname of your proxy.

  • Whether or not your proxy intercepts traffic and reencrypts it using its own cert. This detail is the cause of most of the complications with the SDC VM setup.

    • If your proxy does intercept traffic, have the root certificate ready when configuring the VM. You can paste it in when prompted so that the host and the SDC know to trust the certificates generated by your proxy.

    • If your proxy does not intercept traffic, then nothing else is required here.

  • The items that are most likely the same for proxied HTTP and HTTPS connections. However, if you use a different proxy for each protocol, you would need all of these for each:

    • The IP address of your proxy

    • The port your proxy uses

    • Whether your proxy requires that the connection to the proxy itself be over HTTPS (typically not the case). For example, if the address of your proxy is listed as https://proxy.corp.com:80 then you would answer yes. If the listed address is http://proxy.corp.com:80 then you would answer no. Note that both URLs use port 80, but the protocol is different.

    • The authentication details of your proxy including:

      • Whether your proxy requires auth (most do not)

      • If yes, then you'll need the username and password available when you configure the host.

• Supported installations:

  • Security Cloud Control supports installing its SDC VM OVF image using the vSphere web client or the ESXi web client.

  • Security Cloud Control does not support installing the SDC VM OVF image using the vSphere desktop client.

  • Security Cloud Control supports installing the SDC on your own Ubuntu instance. Versions 20LTS - 24LTS are currently supported.

  • ESXi 5.1 hypervisor.

• System requirements for a VM with one SDC:

  • 2 vCPUs

  • 2 GB of memory

  • 64 GB of disk space

• Each SDC you add to your host requires an additional 1 vCPU and 1 GB of RAM.

• System requirements for a VM with one SEC (a component that is used in Cisco Security Analytics and Logging):

  • 4 vCPUs minimum

  • 8 GB of memory

• Each SEC you add to the host requires doubling its resources, therefore, these are the requirements for a VMware ESXi host with one SDC and one SEC:

  • 6 vCPUs

  • 10 GB memory

  • 64 GB of disk space

• To configure networking manually on the host, gather this information:

  • The static IP address that you want to use for your VM

  • The passwords to use for the CDOuser (or whichever user has sudo access) and the SDC user (the user under which Docker runs)

  • The IP address of the DNS server your organization uses

  • The gateway IP address of the network the SDC address is on

  • The FQDN or IP address of your time/NTP server

• The SDC virtual machine is configured to install security patches regularly and to do this, opening port 80 outbound is required.

  If your network is using allow/deny lists for outbound connections, you need to allow connections to ubuntu.com so those security updates can be applied.

  Note	Ubuntu secures its updates with checksums and only uses HTTP, not HTTPS. To pull security updates, you must allow HTTP connections to ubuntu.com.