After successfully deploying vDefend Security Services Platform (SSP) 5.2 in my VCF 9.1.1 environment, I came to learn that SSP requires at least 1,000 unique flows before it can generate a security assessment of your environment.
Similarly, SSP also requires a minimum of three days of collected flow data before it can generate a flow capacity assessment.
If you have a small lab environment like myself, generating 1,000 unique flows can be difficult, and having to wait several days to demonstrate certain SSP capabilities may not be ideal, especially for proof-of-concept deployments. Here is how you can work around these default requirements when deploying SSP in a lab environment.
Disclaimer: This is not officially supported by Broadcom, please use only in a non-production environment for lab and learning purposes.
SSH to to your SSP Installer using sysadmin username and credentials that you had configured as part of the deploymennt.
Minimum Unique Flows
To reduce the minimum unique flows from 1000 to your desired value, we need to edit the following ConfigMap and look for the minFlowCount property
k -n nsxi-platform edit cm security-pov-application-config
Once you have saved your changes, we need to restart security-pov deploymennt by running the following command:
k -n nsxi-platform rollout restart deployment security-pov
After a minute or so, you can refresh the SSP UI and now you should be able to generate a security assessment and for my setup, I ended up using value of 200 since I had 234 unique flows.
Minimum Metric Collection Period
To reduce the minimum metric collection period (3 days) to your desired value, we need to edit the following ConfigMap and look for the minimumRequiredMetricsDays property
k -n nsxi-platform edit cm pubsub-app
Once you have saved your changes, we need to restart pubsub deploymennt by running the following command:
k -n nsxi-platform rollout restart deployment pubsub
After a minute or so, you can refresh the SSP UI and now you should be able to calculate the observed flow rate.
Thanks for the comment!