Stealthwatch Proxy Ingestion License

[Aileron88]

Hi all,

Does the proxy ingestion license still exist in Stealthwatch or are the following licenses the only ones available now:

- Flow rate license

- Endpoint license

- PNM

- PCM

Thanks

[brford · Accepted solution]

What was the proxy ingest license is now included in the Stealthwatch license.  

A Flow rate License is still needed.  

An 'Endpoint License' is needed to process IPFIX from Stealthwatch Endpoint Concentrators.  Those Endpoint Concentrators take in nzFlow from the Cisco AnyConnect NVM (Network Visibility Module) Agent (which is included with the AnyConnect Plus license).  Note that nzFlow needs to be stitched into a connection for which NetFlow or IPFIX is available from a router, switch, or Flow Sensor and adds detail about connections that originate on that AnyConnect equipped client.

PNM (Private Network Monitoring) is a Stealthwatch Cloud license that is based on the number of devices being reported by a Stealthwatch Cloud Sensor. 

PCM (Public Cloud Monitoring) is a. Stealthwatch Cloud license that is counted based on EMF (Effective Mega Flow); a measure of the data being reported by one or more public cloud (Azure, AWS, GCP) accounts to a Stealthwatch Cloud portal.

[deanilenko]

---

@brford wrote:

What was the proxy ingest license is now included in the Stealthwatch license.  

A Flow rate License is still needed.  

An 'Endpoint License' is needed to process IPFIX from Stealthwatch Endpoint Concentrators.  Those Endpoint Concentrators take in nzFlow from the Cisco AnyConnect NVM (Network Visibility Module) Agent (which is included with the AnyConnect Plus license).  Note that nzFlow needs to be stitched into a connection for which NetFlow or IPFIX is available from a router, switch, or Flow Sensor and adds detail about connections that originate on that AnyConnect equipped client.

PNM (Private Network Monitoring) is a Stealthwatch Cloud license that is based on the number of devices being reported by a Stealthwatch Cloud Sensor. 

PCM (Public Cloud Monitoring) is a. Stealthwatch Cloud license that is counted based on EMF (Effective Mega Flow); a measure of the data being reported by one or more public cloud (Azure, AWS, GCP) accounts to a Stealthwatch Cloud portal.

---

Hi Brford,

I am using SWE 7.1.2 and I do have  base+flow rate licenses, but when I am trying to integrate my WSA with Flow Collector I am unable to do it, because of lack of license.

Are you sure about proxy license?

[sammausing]

Recently I enabled ProxyWatch feature license on my SMC with TACs assistance. It appears under SMC>>Configuration>>licensing page after activation. Further configured my proxy servers on all Flow Collectors >>Configuration>>Proxy ingest. 

[deanilenko]

---

@sammausing wrote:

Recently I enabled ProxyWatch feature license on my SMC with TACs assistance. It appears under SMC>>Configuration>>licensing page after activation. Further configured my proxy servers on all Flow Collectors >>Configuration>>Proxy ingest. 

---

Thank you for the info.

So, the TAC engineer activate ProxyWatch feature for you, but you did not purchase this feature additionally, correct?

[sammausing]

Right! We did not purchased it.

[deanilenko]

---

@sammausing wrote:
Right! We did not purchased it.

---

Thanks you for your help with this! You have pointed me into the right direction.

Indeed this feature is FREE now and anyone can use it, but you still have to have license for it. So, first of all you should go to the licensing team and ask them to issue a license for you and apply it in SMC. After that, you will be able to use this feature and do integrations with proxy.

This is how it works :)

[PeterCoffin41588]

Simply go to SMC>>Configuration>>licensing page. Make sure that you have activated it. Then after all go to Flow Collectors >>Configuration>>Proxy ingest. Hope your problem will be resolved.