diff --git a/source/third_party_plugins.rst b/source/third_party_plugins.rst index fe564e4..30f91b2 100644 --- a/source/third_party_plugins.rst +++ b/source/third_party_plugins.rst @@ -33,5 +33,4 @@ Sunnyvalley vendor/sunnyvalley/sensei vendor/sunnyvalley/sensei_hardwarerequirements - vendor/sunnyvalley/sensei_prepareyourfirewall vendor/sunnyvalley/sensei_install diff --git a/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png b/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png deleted file mode 100644 index a4a6f2b..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/opnsense-direct-system-access.png b/source/vendor/sunnyvalley/images/opnsense-direct-system-access.png new file mode 100644 index 0000000..f467c9b Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-direct-system-access.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-ssh-login.png b/source/vendor/sunnyvalley/images/opnsense-ssh-login.png new file mode 100644 index 0000000..41e6486 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-ssh-login.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-1.png b/source/vendor/sunnyvalley/images/opnsense-terminal-1.png deleted file mode 100644 index 1cbaeca..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-terminal-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png b/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png deleted file mode 100644 index f4a68ce..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png deleted file mode 100644 index b4ecd2f..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png deleted file mode 100644 index e8c571d..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png deleted file mode 100644 index b32ac8f..0000000 Binary files a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png deleted file mode 100644 index bc72ec2..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png deleted file mode 100644 index d5e9194..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png deleted file mode 100644 index 5ca9d10..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png deleted file mode 100644 index 61e49ad..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png deleted file mode 100644 index afc60fb..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png deleted file mode 100644 index 6ae0058..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png deleted file mode 100644 index 6435b0b..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png deleted file mode 100644 index 4d04280..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png deleted file mode 100644 index f64e76f..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png deleted file mode 100644 index 0bb569b..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png deleted file mode 100644 index 4f840b0..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png deleted file mode 100644 index 6122371..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png deleted file mode 100644 index 733aaa9..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png deleted file mode 100644 index 4e63ee9..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png deleted file mode 100644 index c1b2f3e..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-cli-install.png b/source/vendor/sunnyvalley/images/sensei-cli-install.png new file mode 100644 index 0000000..15a2b1f Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-cli-install.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-forum.png b/source/vendor/sunnyvalley/images/sensei-forum.png deleted file mode 100644 index b76f81f..0000000 Binary files a/source/vendor/sunnyvalley/images/sensei-forum.png and /dev/null differ diff --git a/source/vendor/sunnyvalley/images/sensei-install-complete.png b/source/vendor/sunnyvalley/images/sensei-install-complete.png new file mode 100644 index 0000000..3718589 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-install-complete.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-plugin.png b/source/vendor/sunnyvalley/images/sensei-plugin.png new file mode 100644 index 0000000..18386e5 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-plugin.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-vendor-plugin.png b/source/vendor/sunnyvalley/images/sensei-vendor-plugin.png new file mode 100644 index 0000000..197a53f Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-vendor-plugin.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-cloud-reputation.png b/source/vendor/sunnyvalley/images/sensei-wizard-cloud-reputation.png new file mode 100644 index 0000000..8dc62e3 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-cloud-reputation.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-deployment-size.png b/source/vendor/sunnyvalley/images/sensei-wizard-deployment-size.png new file mode 100644 index 0000000..b4384f3 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-deployment-size.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-finish.png b/source/vendor/sunnyvalley/images/sensei-wizard-finish.png new file mode 100644 index 0000000..69d51df Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-finish.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-hardware-high-end.png b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-high-end.png new file mode 100644 index 0000000..9d1d3ad Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-high-end.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-hardware-incompatible.png b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-incompatible.png new file mode 100644 index 0000000..f7296ef Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-incompatible.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-hardware-low-end.png b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-low-end.png new file mode 100644 index 0000000..eef560f Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-hardware-low-end.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-available.png b/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-available.png new file mode 100644 index 0000000..1a0ae68 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-available.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-protected.png b/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-protected.png new file mode 100644 index 0000000..dac5a20 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-interface-selection-protected.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-high-end.png b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-high-end.png new file mode 100644 index 0000000..317972c Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-high-end.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-low-end.png b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-low-end.png new file mode 100644 index 0000000..67386a1 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-low-end.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-remote.png b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-remote.png new file mode 100644 index 0000000..3e5cbfc Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-reporting-database-remote.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-sensei-cli.png b/source/vendor/sunnyvalley/images/sensei-wizard-sensei-cli.png new file mode 100644 index 0000000..973709f Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-sensei-cli.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-updates-health-check.png b/source/vendor/sunnyvalley/images/sensei-wizard-updates-health-check.png new file mode 100644 index 0000000..9d20994 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-updates-health-check.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-wizard-welcome.png b/source/vendor/sunnyvalley/images/sensei-wizard-welcome.png new file mode 100644 index 0000000..635abb9 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-wizard-welcome.png differ diff --git a/source/vendor/sunnyvalley/sensei.rst b/source/vendor/sunnyvalley/sensei.rst index ce1340c..528fa7c 100644 --- a/source/vendor/sunnyvalley/sensei.rst +++ b/source/vendor/sunnyvalley/sensei.rst @@ -1,41 +1,39 @@ =================== Sensei: Overview =================== - +---------------------------- About ---------------------------- -Sensei is a plugin for firewalls complementing them with state of the art next generation features. If you are running a L4 firewall (all open source firewalls fall into this category) and looking for features like Application Control, Network Analytics and TLS Inspection, Sensei is the product you're looking for. + +Sensei is a plugin for the OPNsense firewall which provides state-of-the-art next generation features. If you are running a L4 firewall (all open source firewalls fall into this category) and looking for features like Application Control, Network Analytics and TLS Inspection, Sensei is the product you're looking for. .. raw:: html ---------------------------- - Features ---------------------------- -Sensei empowers your firewall with the following next generation features + +Sensei empowers your firewall with the following next generation features: 1. Application Control 2. Cloud Application Control \(Web 2.0 Controls\) 3. Advanced Network Analytics 4. All-ports full TLS Inspection \(for every TCP port, not just HTTPS\) 5. Cloud Threat Intelligence -6. Encypted Threats Prevention +6. Encrypted Threats Prevention 7. Web Filtering & Security 8. Active Directory Integration ---------------------------- - Getting Started ---------------------------- - :doc:`sensei_hardwarerequirements` -- :doc:`sensei_prepareyourfirewall` - :doc:`sensei_install` ---------------------------- - User Manual ---------------------------- @@ -50,14 +48,12 @@ You can get detailed *How to* documents from Sensei's Documentation Site located * `Configuration `_ ---------------------------- - Getting Support ---------------------------- +**Support for Free Edition** -**Support for Freemium Edition** - -If you need help for anything; there is an active discussion about Sensei on OPNsense forum. Feel free to `click here `_ and join the conversation. +If you need help for anything, there is an active discussion about Sensei on OPNsense forum. Feel free to `click here `_ and join the conversation. You can also issue bug reports from `Gitlab `_ @@ -69,18 +65,15 @@ With its in-depth coverage, `Sensei Documentation **Premium Subscription Support** -When you buy a Sensei Premium Subscription, you are entitled to Sensei Basic Support. -Additional support plans are available on demand. +When you buy a Sensei Premium Subscription, you are entitled to Sensei Basic Support. Additional support plans are available on demand. * `Compare Support Plans `_ * `Access Support Center `_ - **Support Options for Channel Partners** Sunny Valley Networks provides Tier 3 Support Options for Sensei Channel Partners. To learn more about them, please contact **sensei-partnership -at- sunnyvalley.io** . - **Connect via Social Media** * **Twitter**: `@sunnyvalley `_ diff --git a/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst b/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst index 09f43b3..2d1b1e9 100644 --- a/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst +++ b/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst @@ -2,46 +2,56 @@ Sensei: Hardware Requirements ======================================== -Due to the nature of packet analysis and granular drill-down reporting features, Sensei require more horsepower than a standard L3-L4 firewall. +Due to the nature of deep packet analysis and detailed drill-down reporting functionality, Sensei requires more hardware resources than a standard L3-L4 firewall. .. Note:: - Sensei requires at least 4 GB of memory. Installer will not continue if you have less than 4 GB of RAM. + With the Sensei 1.5 release, you can offload your reporting database to an external system. This allows you to be able to run Sensei on systems with a constrained amount of RAM. -.. Note:: +It is recommended that you check if your Ethernet adapter functions well with netmap. - A roadmap feature - Cloud reporting - will enable you to install Sensei to devices which have limited amount of memory. E.g. you'll be able to install Sensei to a Raspberry Pi. +------------- +CPU & Memory +------------- ------------------------------ +Because the analytics module relies on Elasticsearch to process large amounts of data, the amount of the memory available in the system is crucial for the overall performance of Sensei. -CPU & Memory ------------- +.. Tip:: -Because the analytics module relies on Elastic Search to do Big Data processing, amount of the memory available in the system is crucial for the performance of the whole product. + If the number of active devices are more than 250 and the sustained WAN bandwidth is higher than 100 Mbps, we do not recommend deploying Sensei as a virtual guest since resources in virtual environments are generally shared between guest systems.  -At least dual-core *(i5 or equivalent)* or preferably quad-core modern CPU *(i7 or equivalent)* would be advisable. +Below is the recommended minimum hardware requirements for Sensei based on the number of devices and the amount of sustained bandwidth: -Recommended minimum hardware requirements for Sensei based on the number of users and the bandwidth: +===================== ========================= ================== ====================================================================== + **# Active Devices** **Maximum WAN Bandwidth** **Minimum Memory** **Minimum CPU** + 0-25 50 Mbps 4 GB A Dual-Core CPU (x86_64 compatible, single core PassMark score of 200) + 25-50 150 Mbps - 10 Kpps 4 GB Intel Dual-Core i5 2.0 GHz (2 Cores, 4 Threads) or equivalent + 50-100 200 Mbps - 20 Kpps 8 GB Intel Dual-Core i5 2.2 GHz (2 Cores, 4 Threads) or equivalent + 100-250 300 Mbps - 40 Kpps 16 GB Intel Dual-Core i5 3.2 GHz (2 Cores, 4 Threads) or equivalent + 250-1000 500 Mbps - 100 Kpps 32 GB Intel Quad-Core i7 3.4 GHz (4 Cores, 8 Threads) or equivalent +===================== ========================= ================== ====================================================================== -======================= ===================== ==================== ==================================================================== - **Number of Users** **WAN Bandwith** **Min. Memory** **Min. CPU** - <25 20 Mbps 8 GB Intel Dual-Core i3 2.0 GHz (2 Cores, 4 Threads) or equivalent - 25-50 50 Mbps - 10 Kpps 8 GB Intel Dual-Core i5 2.0 GHz (2 Cores, 4 Threads) or equivalent - 50-100 100 Mbps - 20 Kpps 16 GB Intel Dual-Core i5 2.2 GHz (2 Cores, 4 Threads) or equivalent - 100-250 200 Mbps - 40 Kpps 16 GB Intel Dual-Core i7 2.0 GHz (2 Cores, 4 Threads) or equivalent - 250-1000 500 Mbps - 100 Kpps 32 GB Intel Quad-Core i7 3.40 GHz (4 Cores, 8 Threads) or equivalent -======================= ===================== ==================== ==================================================================== +.. Note:: ------------------------------ + Sensei requires at least 2 GB of memory. The installer will not continue if you have less than 2 GB of RAM. We recommend 4 GB memory to have an improved experience. -Disk Space ------------- +----------------- +Ethernet Adapter +----------------- -.. Note:: +Sensei uses a FreeBSD subsystem called `netmap(4) `_ to access raw Ethernet frames. With FreeBSD 11 (OPNsense version <= 20.1) this software can be very particular in terms of proper driver compatibility. - Sensei uses `Elastic Search Engine `_ as its backend to process the Big Data. Please spare at least 5 MB of disk space per hour per megabit/second throughput. +Intel based adapters, particularly em(4) and igb(4), are observed to perform well in terms of stability and performance. -If you're running a 100 Mbps link \(about 100 users\) which is quite active during the daytime and idle rest of the day, you can calculate the space needed as follows: +Sunny Valley Networks is sponsoring developments on this project so you can expect netmap(4) will better support a wide range of Ethernet drivers. + +----------- +Disk Space +----------- + +Sensei uses `Elasticsearch `_ or `MongoDB `_ as its backend to store large data sets. Please allow at least 5 MB of disk space per hour per megabit/second throughput. + +If you're running a 100 Mbps link \(about 100 users\) which is quite active during the daytime and idle rest of the day, you may calculate the space needed as follows: .. code-block:: none @@ -49,7 +59,4 @@ If you're running a 100 Mbps link \(about 100 users\) which is quite active duri 6 GB x 7 days a week = 42 GB per week. 42 x 4 weeks a month = 164 GB per month. - -.. Note:: - - As of 0.7.0 ::italic::(`changelog `_) , Sensei retires reports data to open up space for the new coming data. After the configured timespan, existing reports data is automatically purged to save space for fresh data. +As of `version 0.7.0 `_, Sensei expires old report data to free up disk space for the most recent data based on the configured number of days of history to keep. diff --git a/source/vendor/sunnyvalley/sensei_install.rst b/source/vendor/sunnyvalley/sensei_install.rst index 06922cc..239e15f 100644 --- a/source/vendor/sunnyvalley/sensei_install.rst +++ b/source/vendor/sunnyvalley/sensei_install.rst @@ -4,155 +4,250 @@ Sensei: Installing .. Note:: - Sensei Freemium Edition is **forever free-of-charge**. We strongly recommend you register to keep in touch with updates and new features. You can register at `https://www.sunnyvalley.io/sensei `_ + Sensei Free Edition is **forever free-of-charge**. We strongly recommend you register to keep in touch with updates and new features. You can register at `https://www.sunnyvalley.io/sensei `_ ------------------------------ +Sensei may be installed using the web interface in OPNsense or using the command line interface via SSH or direct system access. The preferred method is the web interface. Once Sensei is installed, you will need to complete the initial configuration in the web interface so it is convenient to also complete the installation using the web interface. +To install plugins in OPNsense, you must use an account with administrative access. -Connect to Your Firewall ------------------------------ +.. Note:: -.. code-block:: bash + Before installing Sensei, you should ensure you meet the minimum system requirements in order to run Sensei or to have the best user experience. See :doc:`sensei_hardwarerequirements` for more information. - $ ssh root@your-firewall-ip +--------------------------------------------- +Web Interface Installation (Preferred Method) +--------------------------------------------- -After a successful login, enter "8" as the option to drop to the shell +To install Sensei, you must first install the Sunny Valley Networks vendor repository plugin. Go to the :menuselection:`System --> Firmware --> Plugins` page. Click on the “+” icon next to os-sunnyvalley to install the plugin. -.. image:: images/opnsense-terminal-1.png +.. image:: images/sensei-vendor-plugin.png :width: 100% ------------------------------ +Once the vendor plugin is installed, you should see the Sensei plugin available in the list of plugins as os-sensei. If you do not see the plugin, you may need to refresh the Plugins page. Click the “+” icon next to os-sensei to install the plugin. -Download & Run Sensei Installer --------------------------------- -Run the following one-liner command to download and invoke the installer script. +.. image:: images/sensei-plugin.png + :width: 100% -.. code-block:: bash +After installing Sensei, you should see the Sensei menu in the left sidebar of the OPNsense web interface. If you do not see the new, top-level menu, you may need to refresh your page. + +.. image:: images/sensei-install-complete.png + :width: 100% + +----------------------------------------------- +Command Line Installation (Alternative Method) +----------------------------------------------- - root@fw:~ # curl https://updates.sunnyvalley.io/getsensei | sh +The command line installation method was the primary means for installing Sensei before it was available on the “Plugins” page in the OPNsense web interface. This option is still available for users who have direct access to the OPNsense system yet prefer using command line tools or who may only have remote shell access via SSH to administrate their OPNsense installations. However, the web interface will need utilized after installation to complete the initial configuration of Sensei. +.. Tip:: -.. image:: images/opnsense-terminal-3-getsensei-1.png + If you plan to leave the SSH service active, the best practice recommendations are to create a user with administrative access rather than using the “root” user and to make use of stronger authentication methods such as using keys rather than passwords. + +.................... +Direct System Access +.................... + +When you have direct access to OPNsense, you may simply log into OPNsense using the “root” user or another administrator account. You should see a list of OPNsense menu options. + +.. image:: images/opnsense-direct-system-access.png :width: 100% -Hence we passed the downloaded script to ``sh``, it will automatically run the installer script. +.................... +SSH Access +.................... + +If you only have shell access to OPNsense, you may install Sensei remotely by logging into OPNsense using a SSH client using the following command where “root” is the administrator account and “your-firewall-ip” is the IP address or hostname of the OPNsense system. You should see the same list of menu options as directly accessing the system. .. code-block:: bash - Installing via OPNsense installer - Do you wish to install Sensei? y + $ ssh root@your-firewall-ip -Install script will copy the installation files onto the filesystem and will add a menu item within the Firewall Web User Interface. -Depending on your computer setup and your internet connection speed, it might take 1-4 minutes to complete. +.. image:: images/opnsense-ssh-login.png + :width: 100% -.. Note:: +................................ +Download & Run Sensei Installer +................................ - You can get detailed info about suggested hardware on :doc:`sensei_hardwarerequirements` +Once you are successfully logged into OPNsense either by direct system access or SSH access, enter option “8” to open the shell. Run the following command to download and execute the installation script. -.. image:: images/opnsense-terminal-3-getsensei-2.png +.. code-block:: bash + + # curl https://updates.sunnyvalley.io/getsensei | sh + +.. image:: images/sensei-cli-install.png :width: 100% -Once the install is completed, you can disconnect from your terminal, and disable your firewall's ssh service by unchecking the checkboxes mentioned above. +The script will copy the installation files onto the filesystem and will add a top-level menu item within the OPNsense web interface. Depending on the speed of your hardware and Internet connection, the installation may take several minutes to complete. ------------------------------ +Once the installation has been completed, you may disconnect from your terminal session. You may also disable your firewall’s SSH service by unchecking the checkboxes mentioned above if you no longer wish to use the SSH service. +----------------------------- Initial Configuration Wizard ------------------------------ +Regardless of your installation method, you will need to go through the initial configuration wizard before you may start using Sensei. -.. Note:: +To start the "Initial Configuration Wizard": + +* Log in to your OPNsense web interface +* Click Sensei from the left menu +* Click on the Dashboard sub-menu to open the configuration wizard + +.................... +1- EULA +.................... - To start using Sensei, first, you need to go through the Wizard which will guide you to start with the best initial configuration. +* Accept the End User License Agreement *(scroll and read the terms to get to the next button)*. -To start your "Initial Configuration Wizard"; +.. image:: images/sensei-wizard-welcome.png + :width: 100% -* Log in to your OPNsense Web UI, -* Click Sensei from the left menu, -* Click on the Dashboard sub-menu. It will open up the Wizard. +* Click the :menuselection:`I Agree` button to continue to the :menuselection:`Interface Selection` section. ------------- -**1- EULA** ------------- +.................... +2- Hardware Check +.................... -* Accept the End User License Agreement *(Scroll & read the terms to get to the next button)*. -* Click :menuselection:`Next` and get to the :menuselection:`Interface Selection` section. +Your hardware will be analyzed to ensure it meets the minimum requirements. You will receive one of following responses: compatible hardware, low-end hardware, incompatible hardware. The setup will not continue if you have incompatible hardware. -.. image:: images/sensei-0-wizard-tab1-welcome-1.png +.. image:: images/sensei-wizard-hardware-high-end.png :width: 100% ------------------------------ -**2- Interface Selection** ------------------------------ +Compatible + +.. image:: images/sensei-wizard-hardware-low-end.png + :width: 100% + +Low-end + +.. image:: images/sensei-wizard-hardware-incompatible.png + :width: 100% + +Incompatible + +* Click :menuselection:`Next` to continue to the :menuselection:`Reporting Database` section. + +...................... +3- Reporting Database +...................... + +* Select the database you wish to use for reporting. High end systems will have 3 options, while low end systems only have 2 options. + +.. Warning:: + + If you wish to use a remote ElasticSearch database, you must choose it now since you cannot change this after the initial configuration wizard has been completed. + +.. image:: images/sensei-wizard-reporting-database-high-end.png + :width: 100% + +High-end + +.. image:: images/sensei-wizard-reporting-database-low-end.png + :width: 100% + +Low-end -* Select the Ethernet Interfaces to protect. To do that, click on an interface and use the right/left arrow buttons to move it to protected/unprotected interfaces combo box. -* Click :menuselection:`Next` and get to the :menuselection:`Cloud Reputation` section. +* If you select “Use a Remote Elasticsearch Database”, you will be prompted to enter the URL, username, and password. -.. image:: images/sensei-0-wizard-tab2-interface-selection-2.png +.. Note:: + + If you have SOHO or higher Sensei paid subscription, we recommend that you install your license key before proceeding with the initial configuration wizard since this will activate a feature that will enable you to have central reporting for many firewalls from a single Elasticsearch instance. Otherwise, only a single remote ES instance can be used with a single firewall. + +.. image:: images/sensei-wizard-reporting-database-remote.png + :width: 100% + +* Click the :menuselection:`Install Database & Proceed` button to install the local database if one is chosen and continue to the :menuselection:`Interface Selection` section. + +....................... +4- Interface Selection +....................... + +* Select the Ethernet Interface(s) to protect. To do so, click on an interface and use the right/left arrow buttons to move it to protected/unprotected interfaces combo box. + +.. image:: images/sensei-wizard-interface-selection-available.png :width: 100% --------------------------- -**3- Cloud Reputation** --------------------------- +.. image:: images/sensei-wizard-interface-selection-protected.png + :width: 100% + +* Click :menuselection:`Next` to continue to the :menuselection:`Cloud Reputation`section. -The Cloud Threat Intelligence data is queried real time when anyone makes a connection through your network. It enables us to respond to malware and wireless outbreaks in real time and very fast. +.................... +5- Cloud Reputation +.................... -The engine processes the request, queries to **SVN Cloud** in real-time and decides whether it will be blocked or allowed. We check against 140+ Million Websites, under 120+ categories in milliseconds. +The Cloud Threat Intelligence data is queried in real-time when any connections are made through your network. This capability enables Sensei to respond to malware and wireless outbreaks in real-time and very quickly. -Cloud Threat Intel settings let you; +The engine processes the request, queries the **“Sunny Valley Network (SVN) Cloud”** in real-time, and decides whether it will be blocked or allowed. Sensei checks against 140+ million websites under 120+ categories in milliseconds. -* Enable/Disable the cloud reputation & web categorization engine -* Set local domain settings to be excluded from cloud queries +Cloud Threat Intel settings let you: -.. image:: images/sensei-0-wizard-tab3-cloud-reputation-2.png +* Enable/Disable the “Cloud Reputation & Web Categorization” engine +* Set local domain name you wish to be excluded from cloud queries +* Select the fastest Cloud Reputation Servers which are used for queries + +.. image:: images/sensei-wizard-cloud-reputation.png :width: 100% --------------------------------- -**4- Sensei CLI (Security)** --------------------------------- +* Click :menuselection:`Next` to continue to the :menuselection:`Sensei CLI` section. + +......................... +6- Sensei CLI (Security) +......................... -* Set your TCP Service password. This password protects the command line based CLI access to the packet engine. It is highly recommended to set this with a secure one. -* Click "Next" and get to the "Updates" . +* Set your TCP Service password. This password protects the command line access to the packet engine. It is highly recommended to use a very secure password. The default password is “Sensei1234” so be sure to change it. -.. image:: images/sensei-0-wizard-tab4-sensei-cli.png +.. image:: images/sensei-wizard-sensei-cli.png :width: 100% -------------------------------- -**5- Updates & Health Check** -------------------------------- +* Click :menuselection:`Next` to continue to the :menuselection:`Updates & Health Check` section. + +.......................... +7- Updates & Health Check +.......................... .. Note:: - Sensei uses OPNsense package system to deliver its updates. Configure the way you receive your Sensei updates as you feel convenient. + Sensei uses the OPNsense package system to deliver its updates. You may configure how you prefer to receive your Sensei updates. -* **Self Health Check:** If enabled, "Self Health Check" monitors the system's memory, CPU, disk usage and core services if they're working correctly, and raises alerts if anything goes wrong. Self Health Check also stops the relevant services if they're consuming excessive system resources. -* **Check for Updates Automatically:** Checks automatically for the updates and creates a notification on the status page. -* **Update Databases and Threat Intelligence Data Automatically:** Checks automatically for the updates and creates a notification on the status page . -* **Enable Generation of Support Data:** If enabled, Sensei collects supporting data during unusual events and crashes. You can share this data while opening a ticket with us. +* **Check for Updates Automatically:** Checks automatically for the updates and creates a notification on the Sensei “Status” page. +* **Automatically Update Databases and Threat Intelligence Data:** Checks automatically for the updates and creates a notification on the Sensei “Status” page. +* **Enable Generation of Support Data:** If enabled, Sensei collects supporting data during unusual events and crashes. You can share this data when opening a ticket with us. +* **Max Swap Utilization:** You may specify how much swap space Sensei may utilize when the system is low on memory. It is recommended that you do not set this value too high. Otherwise, system performance may suffer. +* **Health Check:** If enabled, "Health Check" monitors the system's memory, CPU, disk usage and core services if they're working correctly, and raises alerts if anything goes wrong. "Health Check" also stops the appropriate services if they're consuming excessive system resources. +* **Help Sunny Valley Improve Its Products and Services:** If enabled, general system information is submitted to Sunny Valley to help improve the future development of Sensei. -.. image:: images/sensei-0-wizard-tab5-updates-health-check.png +.. image:: images/sensei-wizard-updates-health-check.png :width: 100% --------------------------- -**6- Deployment Size** --------------------------- +* Click :menuselection:`Next` to continue to the :menuselection:`Deployment Size` section. -Sensei supports up to 1,000 concurrent users on an everyday PC. You can set your Sensei installation's capacity here. +.................... +8- Deployment Size +.................... +Sensei may support up to 1,000 concurrent users on an average PC. You can set your Sensei installation’s capacity in this section. .. Note:: - You can get detailed info about suggested hardware on [Getting Started > Hardware Requirements​](getting-ready.md) -.. image:: images/sensei-0-wizard-tab6-deployment-size-1.png + You may see detailed information about suggested hardware at :doc:`sensei_hardwarerequirements` + +.. image:: images/sensei-wizard-deployment-size.png :width: 100% ---------------- -**7- Finish** ---------------- +* Click :menuselection:`Next` to continue to the :menuselection:`Finish` section. -Click the Finish button to save your initial configuration data and start using Sensei. +.................... +9- Finish +.................... -.. image:: images/sensei-0-wizard-tab7-finish-1.png +* You may enter your email address if you wish to subscribe to the Sunny Valley email list to stay up to date on the latest news. + +.. image:: images/sensei-wizard-finish.png :width: 100% +* Click the :menuselection:`Finish` button to save your initial configuration data and start using Sensei. + ------------------- **Hands-on Video** ------------------- diff --git a/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst b/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst deleted file mode 100644 index 262c67a..0000000 --- a/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst +++ /dev/null @@ -1,24 +0,0 @@ -=============================== -Sensei: Prepare Your Firewall -=============================== - -.. Note:: - - To install Sensei on your OPNsense firewall, you need to connect to it via ``ssh`` with ``root`` privileges. - ------------------------------ - ---------------------- -Enable Secure Shell ---------------------- - -1. Login to your OPNsense firewall's dashboard -2. Head to the :menuselection:`System > Settings > Administrations` menu -3. Enable all three checkboxes - - 1. Enable Secure Shell - 2. Permit root user login - 3. Permit password login - -.. image:: images/opnsense-admin-secure-shell-settings.png - :width: 100%