# Cisco AnyConnect Network Visibility Module (NVM) App for Splunk

## Installation Guide

Getting Started
Collector Install
Configuration Options
Docker Installation

## Getting started

Cisco AnyConnect Network Visibility Module (NVM) App for Splunk is comprised of three components:

- The Splunk App with pre-designed Dashboards to visualize and view the data.
- The Splunk Add-on which provides data indexing and formatting inside Splunk Enterprise.
- The NVM Collector Component which is responsible for collecting and translating all IPFIX (nvzFlow) data from the endpoints and forwarding it to the Splunk Add-on.This is a manually installed component that runs on 64-bit Linux.

## Collector Install

The collector runs on 64-bit Linux. For compatibility with other platforms, please see Docker Installation section below. CentOS and Ubuntu configuration scripts are included. The CentOS install scripts and configuration files can also be used in Fedora and Redhat distributions as well.
The collector should be run on either a standalone 64-bit Linux system or on a 64-bit Splunk Forwarder.

In order to install the collector you will need to copy the application in the acnvmcollector.zip file, located in the $APP_DIR$/appserver/addon/ directory to the system you plan to install it on.
Extract the tar file on the system where you plan to install the collector on and execute the install.sh script with super user privileges. It is recommended to read the $PLATFORM$_README file in the .zip bundle before executing the install.sh script. The $PLATFORM$_README file provides information on the relevant configuration settings that need to be verified and modified (if necessary) before the install.sh script is executed. Failing to do so can cause the collector to not function accordingly.

A collector can handle a minimum of 5000 flows per second on a properly sized system.

## Configuration Options

The collector needs to be configured and running before the Splunk App can be used. By default, the collector receives flows from AnyConnect NVM endpoints on UDP port 2055.
Additionally, the collector produces three data feeds for Splunk, Per Flow Data, Endpoint Identity Data and Endpoint Interface Data, on UDP ports 20519, 20520 and 20521 respectively.

Both the receive and data feed ports can be changed by altering the acnvm.conf file and restarting the collector instance.
Make sure that any network firewalls between endpoints and the collector or between the collector and Splunk system(s) are open for the configured UDP ports.
Also ensure that your AnyConnect NVM configuration matches your collector configuration. Refer to the AnyConnect Administration Guide for more information.

The Splunk App is configured by default to receive three data feeds, Per Flow Data, Endpoint Identity Data and Endpoint Interface Data, on UDP ports 20519, 20520 and 20521 respectively.
This can be changed in the Application Input settings in Splunk if for some reason you needed to change the collector configuration as described above.

## Docker Installation

CiscoNVMCollector_TA.zip includes a Dockerfile that can be used to build a Docker image for the collector. Before building, first make any configuration adjustments (as needed) to acnvm.conf.

Build docker image from the directory containing Dockerfile:
docker build -t nvmcollector .

Parameters for running the docker image depends on your acnvm.conf file. For the default config where collector listens on port 2055 and the syslog server is on the same host:
docker run -t -p 2055:2055/udp --net="host" nvmcollector