topic Re: Stealthwatch new replacement deployment steps in Security Analytics

Stealthwatch new replacement deployment steps

NetworkMonkey101 — Mon, 02 Oct 2023 09:53:00 GMT

Hi,#

I am looking to complete a new replacement stealthwatch deployment. The aim is to use a higher version 7.4 instead of 7.0 but essentially be configured exactly the same way.

Am I able to setup the new stealthwatch on version on 7.4 and configure from a backup?

Are there any detailed steps to complete this and is there anything that would need to be manually configured before the restore?

Re: Stealthwatch new replacement deployment steps

balaji.bandi — Mon, 02 Oct 2023 11:55:05 GMT

as per the document that should work follow admin guide :

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/system_installation_configuration/7_4_1_System_Configuration_Guide_DV_1_7.pdf

Re: Stealthwatch new replacement deployment steps

jamegill — Mon, 02 Oct 2023 15:02:40 GMT

Hi there -

Secure Network Analytics / Stealthwatch can only be upgraded by a single minor version at a time (7.0 —> 7.1 —> 7.2 —> 7.3 —> 7.4) and backups are only going to be supported to work on the same version as they were taken from.

I have done what you’re describing here and my process was to take a backup, download and install the source version into a virtual machine(s), restore the backup, upgrade, upgrade, […], upgrade to the target version, take a new backup, and restore it to the new prod deployment. This can be done with the 90-day trial license. In most cases you should only need to do this on the Manager node, and skip the flow collectors, sensors, databases, etc as when those will deploy you will configure basic IP info and the policies, etc will get pushed down from the Manager.

Re: Stealthwatch new replacement deployment steps

oevranos — Mon, 02 Oct 2023 17:08:17 GMT

Hi,

If rest of deployment on 7.4 and you are replacing one component, you can consider reinstalling as well. Please note, you wont be able to use backup from a different version as mentioned above, so this is only feasible if you don't need to deploy from backup.

https://www.cisco.com/c/en/us/support/docs/security/stealthwatch-enterprise/218049-reinstall-secure-network-analytics-opera.html