Lumu Virtual Appliance - Deploy on Azure

Deploy on Azure

You have the option to deploy Lumu Virtual Appliances as cloud collectors in cloud solutions such as AWS, Azure, and Google Cloud.

A Lumu Virtual Appliance (VA) is a virtualized machine that provides all the elements required to collect network metadata to provide you with maximum visibility when it comes to identifying compromised network endpoints within your infrastructure.

This guide contains the necessary steps to deploy a Lumu Virtual Appliance as a cloud collector on Microsoft Azure.

Requirements

To ensure the successful deployment of a Lumu VA on Azure, you must meet the following minimum requirements:

  1. Azure management rights.
  2. Azure PowerShell ISE installed.
  3. Virtualization support turned on in the BIOS or UEFI (Hyper-V).
Note: For installing Azure PowerShell and its prerequisites, consult the Microsoft documentation. And for full requirements, consult this document.

Azure Setup

In order to create a cloud collector, you need to download and import a Virtual Appliance into Microsoft Azure and create a Virtual Machine. This section walks you through using PowerShell to set up a Lumu VA on Azure.

1. Access the Lumu Portal and navigate to the Virtual Appliance menu and select ‘Hyper V’ from the ‘Download for’ drop-down list. Unzip the file that contains the appliance image.

Virtual Appliance management on Lumu PortalFigure 1 - Virtual Appliance management.

2. Download AzCopy 10 utility from the Microsoft website, unzip and place the files on the directory: C:\Windows\System32

Microsoft’s AzCopy helps to move large amounts of data from external sources into Microsoft Azure Storage.

3. Open a PowerShell console as an administrator and run the following command to install Azure prerequisites:

Install-Module -Name Az -AllowClobber -Scope AllUsers
Install-Module -Name Az -RequiredVersion 3.4.0

4. Run the following command on the PowerShell console to authenticate your Azure Account:

Connect-AzAccount
Note : If you receive a message similar to: “The 'Connect-AzAccount' command was found in the module 'Az.Accounts', but the module could not be…” please execute the following command temporarily:
Set-ExecutionPolicy RemoteSigned

At the end of the setup process, you can rollback the policy using the command:

Set-ExecutionPolicy Restricted

Sign in on your Azure accountFigure 2 - Sign in on your Azure account.

5. Azure does not support VHDX file system, you must convert the VHDX file you downloaded on Lumu Portal to VHD. Use the following commands on PowerShell to convert the file: Convert-VHD -Path '<local_path>'  -DestinationPath '<destination_path>'. Example:
Convert-VHD -Path 'C:\LumuVA\Lumu Virtual Appliance.vhdx'  -DestinationPath  'C:\LumuVA\Lumu Virtual Appliance.vhd' -VHDType Fixed

Resize-VHD -Path 'C:\LumuVA\Lumu Virtual Appliance.vhd' -SizeBytes 10485760000

6. Upload the appliance image to Azure. You can upload the VHD file to Azure using the PowerShell or via Azure Portal.

Upload process via Azure Portal

To upload the VHD file, access to the Azure Portal and open the Storage explorer dashboard.

Open the Storage explorer on AzureFigure 3 - Open the Storage explorer.

In the Storage Explorer, go to the Blob containers option and create a new one providing a name of your preference.

Create a Blob container on AzureFigure 4 - Create a Blob container.

The next step is to upload the VHD file.

Upload the VHD file to AzureFigure 5 - Upload the VHD file.

Finally, navigate to the Disks area of the Azure Portal and click to add a managed disk:

Add a managed disk on AzureFigure 6 - Add a managed disk.

In the Create managed disk area, select your subscription, a resource group, enter a name, and select a region for the disk and adjust the other settings as necessary. When you're done, select Create.

Create a managed disk on AzureFigure 7 - Create a managed disk.
Upload process via PowerShell

To upload the VHD file using the PowerShell, prepare the Azure environment to host the Lumu Virtual Appliance using the following commands:

  1. Set the resource group that you find inside the Azure subscription where you want to create the appliance.
$resourceGroup = '<resource_group>'
  1. Set the location zone that is defined in your Azure resource group.
$locationZone = '<location_zone>'
  1. Set the virtual appliance’s name.
$vaName = '<appliance_name>'
  1. Set the path where you converted the appliance image on the previous step.
$vaLocalPath = '<local_path_of_lumu_appliance>'
  1. Configure Azure disk running the following commands in sequence:
$vhdSizeBytes = (Get-Item $vaLocalPath).length
$diskconfig = New-AzDiskConfig -SkuName 'StandardSSD_LRS' -OsType 'Linux' -UploadSizeInBytes $vhdSizeBytes -Location $locationZone -CreateOption 'Upload'
New-AzDisk -ResourceGroupName $resourceGroup -DiskName $vaName -Disk $diskconfig
$diskSas = Grant-AzDiskAccess -ResourceGroupName $resourceGroup -DiskName $vaName -DurationInSecond 86400 -Access 'Write'
$disk = Get-AzDisk -ResourceGroupName $resourceGroup -DiskName $vaName

Command outputs for preparing AzureFigure 8 - Command outputs for preparing Azure.
The next step is to upload the appliance image to Azure:
  1. Run the following command to copy the Lumu VA file (.vhd) to the managed disk in Azure using the AzCopy tool:
AzCopy.exe copy $vaLocalPath $diskSas.AccessSAS --blob-type PageBlob
Uploading the VHD may take a while depending on your internet connection.
  1. Unlock the disk in Azure
Revoke-AzDiskAccess -ResourceGroupName $resourceGroup -DiskName $vaName

7. Create an Ubuntu server in Azure following Microsoft documentation. The virtual machine must be created in the same zone where the Lumu virtual appliance was uploaded.

Review our sizing guidelines to evaluate the virtual hardware considerations.
Example of an Ubuntu Virtual Machine on AzureFigure 9 - Example of an Ubuntu Virtual Machine on Azure.
8. After creating a Virtual Machine, go to the “Disks” configuration and swap the OS disk, selecting the disk where you uploaded the Lumu virtual appliance on step 6, and finally start the machine.
Swapping OS disk on AzureFigure 10 - Swapping OS disk on Azure.

Virtual Appliance Activation and Setup

Once you have configured Azure and uploaded the Lumu Virtual Appliance, you are ready to activate and explore the VA general settings.

9. Consult our General Configuration guide for instructions on VA activation and set up.

Azure Virtual Network Setup

Once you have the appliance activated and configured, set the Lumu VA as default DNS Server for name resolution.

10.  Apply the new DNS servers to the current machines. Access your Azure Virtual Network settings and the list of virtual networks, select the virtual network for which you want to change DNS servers for, in this example “LUMUvnet935”.

Azure virtual network settings.Figure 11 - Azure virtual network settings.

11. Select “DNS servers” under “Settings” and add the internal IP Addresses of the Lumu Virtual Appliances you deployed on Azure as “Custom”.

Setting Lumu VA as DNS on Azure.Figure 12 - Setting Lumu VA as DNS on Azure.
New servers will be deployed with the most updated configuration.

Flush the DNS cache

If you change the DNS settings for a virtual network or virtual machine that is already deployed, the DHCP lease time may be longer than you expected. The DHCP is responsible for allocating IP addresses and other information to requesting clients.

For the new DNS settings to take effect immediately on existing servers, you must perform a DHCP lease renewal on all affected VMs in the virtual network. See Flushing DNS Cache for guidance.

Validate your settings

The final step is to verify that your DNS connections are correctly routed through Lumu. See Validate your DNS Settings for more information.

        • Related Articles

        • Lumu Virtual Appliance

          The Lumu Virtual Appliance (VA) is a pre-configured lightweight virtual machine solution provided by Lumu Technologies to enable the collection of network metadata of your entire enterprise and forward it to the Lumu cloud with the lowest impact on ...
        • Configure Virtual Appliance

          Once the Virtual Appliance (VA) has been added to the Lumu Portal and imported into a hypervisor it is time to configure the Lumu VA to collect network metadata to illuminate threats, attacks, and adversaries coming from your network. If you are ...
        • Virtual Appliance Collectors

          The Lumu Virtual Appliance (VA) offers the option to create VA collectors, a seamless way to integrate network metadata, as well as send your DNS logs through the VA instead of using the VA built-in DNS resolver. In this quick guide, we show you how ...
        • Manage Virtual Appliances

          You have the option to manage Virtual Appliances (VA) directly from the Lumu Portal. The virtual appliance allows for full visibility into the compromises inside your network and is available for the main hypervisors. If you are interested in getting ...
        • Configure VA Collectors

          Once the Virtual Appliance Collector has been added to the Lumu Portal, it is time to configure the VA Collector to send data to Lumu. If you are interested in getting started with Virtual Appliance Collector, access our documentation. Refresh the VA ...