It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus
Barracuda XDR
Overview Documentation Materials

Setting up a Hyper-V Virtual Sensor

  • Last updated on

Setting up a Hyper-V virtual sensor requires several steps. Follow the procedures below:

  • To download the Hyper-V ZIP
  • To create a new Hyper-V virtual switch for mirroring

After you have followed these procedures, contact your Barracuda XDR representative to complete the setup.

The virtual sensor files are large and can take over 100GB of memory when unzipped. 

To work properly, the host must have 2 Network Interface Cards.

To download the Hyper-V ZIP
  1. In Barracuda XDR Dashboard, click Downloads > Virtual Sensors.
  2. In the Step 2 box, select Hyper-V.
  3. Click one of the following buttons: 
    • Hyper-V ZIP
    • Hyper-V ZIP (Large)

    The ZIP file downloads.

  4. Unzip the file.
To create a new Hyper-V virtual switch for mirroring
Before you begin, identify an open physical NIC on the Hyper-V host and make a physical connection to a mirrored pot on the core switch or firewall.
  1. In Hyper-V manager, in the right navigation panel, click Virtual Switch Manager.
  2. Click External, then click Create New Virtual Switch.
  3. Type an appropriate name for the switch. For example, Virtual_Switch_Name.
  4. Select the physical NIC you identified and designate it as the external NIC to connect.
  5. Click OK.
  6. On the Hyper-V host, as an Administrator, open a PowerShell session.
  7. Execute the following commands, which enable the virtual switch to receive packets from the physical mirror port:
    $a = Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28- 951f524251b5
    $a.SettingData.MonitorMode = 2
    add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <virtual_switch_name> - VMSwitchExtensionFeature $a, where  <virtual_switch_name> is the name of the virtual switch you identified in Step 4.
  8. In the right navigation panel, click Virtual Switch Manager.
  9. Click the + button next to the virtual switch you identified in Step 4.
  10. Click Extensions.
  11. Ensure Microsoft NDIS Capture is selected.
  12. Click OK.
To import the Hyper-V virtual machine

Complete the To download the Hyper-V Zip procedure above before continuing with this procedure.

  1. In Hyper-V manager, in the right navigation panel, click Import Virtual Machine.

    1.jpg
  2. In the Import Virtual Machine dialog, click Next.
  3. On the Locate Folder page, click Browse and navigate to the folder where you extracted the Hyper-V image.
    2.jpg
  4. Click Next.
  5. On the Import Virtual Machine page, enable Copy the virtual machine (create a new unique ID).
    4.jpg
  6. Click Next.
  7. On the Connect Network page, select the v.switch you want to use.

    5.jpg
  8. Click Next.
  9. On the Choose Folders for Virtual Machine Files page, select the following paths:
    • Virtual machine configuration folder
    • Checkpoint store
    • Smart Paging folder
      6.jpg
  10. Click Next.
  11. On the Choose Folders to Store Virtual Hard Disks page, click Browse and navigate to the folder where you want to store the hard disks for the virtual machine.
    7.jpg
  12. On the Completing Import Wizard page, click Next.
    8.jpg
  13. Click Finish.
To set up port mirroring
  1. In Hyper-V manager, right-click the Hyper-V SKOUT Sensor.
  2. Click Settings.
  3. Click the second Network Adapter, and in Virtual Switch, select the v.switch created above. Click Apply.
  4. Click + button next to Advanced Features.
  5. In the Port mirroring section, in Mirroring mode, select Destination.
    9.jpg
  6. Click Apply.
  7. In the same Network Adapter (the second), in the Hardware Acceleration section, clear the Enable check box.

  8. Click Apply, then click OK.

Additional Port Mirroring Setup from VLAN Traffic Configurations

If your environment uses a VLAN to route traffic, you have to configure Microsoft Hyper-V to accept packets from the designated VLAN identifier range.

To set up VLAN port mirroring
  1. In Hyper-V Guest, create a NIC designated as management using the following Powershell command:
    Add-VMNetworkAdapter -VMName <VirtualMachineName> -Name "Management", where  <VirtualMachineName> is the name of the virtual machine.
  2. Add the port to use as a mirror, for example:
    Add-VMNetworkAdapter -Vmname <VirtualMachineName> -name "Mirror", where  <VirtualMachineName>  is the name of the virtual machine.
  3. Repeat Steps 1 and 2 for each NIC.
  4. Add the VLAN ID ranges you want to mirror, for example:
    Set-VMNetworkAdapterVlan -VMName <VirtualMachineName> -VMNetworkAdapterName "mirror" -trunk allowedvlanidlist <VLANIDRange> -nativevlanid <VLANIDRange> , where  <VirtualMachineName>  is the name of the virtual machine and  <VLANIDRange> is the range of the VLAN ID.