# Director Deployment Overview

The Logpoint Director setup process requires the installation of the Director components separately and in a specified order, ensuring compatibility between the versions of Logpoint, LPSM, and Director Fabric for proper configuration.

Director components can be deployed using ISO or any of the available Virtual Images. Installation of Director components using ISO is outlined in [Installation Sequence of Director Components using ISO](#installa).

There are three options available for deploying Director components using virtual images:

* Go to [deploy-director-amis](https://docs.logpoint.com/director/deploy-and-configure/deploy-director/deploy-virtual-images/deploy-director-amis "mention") to learn about deploying Director using AMIs.

{% hint style="info" %}
Director OVA and VHD deployment is not supported in Director v2.9.x.
{% endhint %}

* Director OVAs&#x20;
* Director VHDs

#### Installation Sequence of Director Components using ISO <a href="#installa" id="installa"></a>

1. Install Fabric Server(s). Go to [Installation of Fabric Server](https://docs.logpoint.com/director/deploy-and-configure/deploy-director/install-director-components/install-fabric-server) for more details.
2. Install an API Server. Go to [Installation of API Server/Director Console](https://docs.logpoint.com/director/deploy-and-configure/deploy-director/install-director-components/install-api-server-director-console) for more details.
3. Install an LPSM. Go to [Installation of Logpoint Search Master](https://docs.logpoint.com/director/deploy-and-configure/deploy-director/install-director-components/install-lpsm) for more details.
4. Install a Logpoint. Go to [Installation of Logpoint](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/deploy-and-install) for more details.

After individually installing the Fabric Servers, API Server, Logpoint Search Master, and Logpoint, the Director setup is ready.

* During the initial boot of the installation process, you may encounter multiple warning messages pertaining to the setup of the Live DVD environment. These can be safely disregarded, as they do not affect the installation process.
* In case of a failed or incomplete installation, it is crucial to go to the BIOS menu and wipe the disk data before attempting a second installation with the ISO. If you do not do so, the second installation attempt will also fail.
* While upgrading the Director components to newer versions, we recommend you follow the same sequence.

<figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FPlol8lySw8yRyoRYWnqS%2Fimage.png?alt=media&#x26;token=c06ee3dc-bc67-4fc8-9d0d-1c766ba015dd" alt="" width="563"><figcaption><p>Director Installation Sequence</p></figcaption></figure>

#### Version Compatibility for Logpoint Director <a href="#versioncompatibilityforlogpointdirector" id="versioncompatibilityforlogpointdirector"></a>

Go to [Logpoint SIEM and Director](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/a_predeployment/version_compatibility_matrix#logpoint-siem-and-director) to learn about the version compatibility for Director with Logpoint SIEM.

## System Requirements

#### Hardware Requirements

The minimum required hardware specification for the Director setup should be:

For Fabric Servers and API Server/Director Console:

| Component      | Requirement    |
| -------------- | -------------- |
| Number of vCPU | Minimum 4      |
| RAM            | Minimum 8 GB   |
| HDD            | Minimum 100 GB |

For LPSM:

| Component      | Requirement    |
| -------------- | -------------- |
| Number of vCPU | Minimum 2      |
| RAM            | Minimum 8 GB   |
| HDD            | Minimum 100 GB |

For Fabric-enabled LogPoint instances:

| Component      | Requirement    |
| -------------- | -------------- |
| Number of vCPU | Minimum 4      |
| RAM            | Minimum 8 GB   |
| HDD            | Minimum 100 GB |

{% hint style="info" %}

* All components of the Director setup **must** be installed in a Virtual Environment.
* Depending on log volume, hardware requirements are subject to change.
* The ZFS (Zettabyte File System), used in the LogPoint Director, itself provides a software-defined solution for disk-based redundancy (Mirror, RAIDZ). Hence, it is not recommended to use hardware-based RAID. Doing so limits the ZFS to perform self-healing on checksum failures.
* When selecting the RAIDZ mode, the first three disks are used for OS and Application installation. The remaining disks, if any, can be used to extend the disk space or used as L2ARC (Level 2 Adjustable Replacement Cache) or ZIL (ZFS Intent Log) for enhancing the read/write performance of ZFS. This can be done using ZFS commands.
  {% endhint %}

#### Supported Browsers

The following browsers best support LogPoint Director components:

* Safari (latest)
* Google Chrome (latest)
* Firefox (latest)

#### Port information of the Director setup

To establish a connection within or outside the Director setup when using a network firewall:

| Description                                                                                 | Ports required                                                                                                                                                                 |
| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Connection from Director components to other servers (NTP, DNS, and for support connection) | <ul><li>UDP: 123 (NTP), 53 (DNS), 1193 (support connection)</li></ul>                                                                                                          |
| Connection between the Fabric Servers (in a cluster setup)                                  | <ul><li>ICMP: To ping</li><li>TCP: 22, 88, 464, 749, 750, 754, 2181, 2121, 8485, 9000, 10004, 10006, 50020, 50475, 51070, 2888, 3888</li><li>UDP: 88, 464, 750, 1194</li></ul> |
| Connection from the Fabric Server to the API Server, LPSM or LogPoint                       | <ul><li>ICMP: To ping</li></ul>                                                                                                                                                |
| Connection from the API Server to the Fabric Server                                         | <ul><li>ICMP: To ping</li><li>TCP: 22</li><li>UDP: 1194</li></ul>                                                                                                              |
| Connection from the LPSM to the Fabric Server                                               | <ul><li>ICMP: To ping</li><li>UDP: 1194</li></ul>                                                                                                                              |
| Connection from the LogPoint to the Fabric Server                                           | <ul><li>ICMP: To ping</li><li>UDP: 1194</li></ul>                                                                                                                              |
| Access to LPSM UI, Director Console API, and Director Console UI                            | <ul><li>ICMP: To ping</li><li>TCP: 443</li></ul>                                                                                                                               |
| Connection to SNMP                                                                          | <ul><li>ICMP: To ping</li><li>UDP: 161</li></ul>                                                                                                                               |

#### Version specific requirements

**Director v2.6.0**

To install LPSM v2.6.0, your CPU must support Advanced Vector Extensions (AVX). You can check your CPU’s AVX compatibility using the following command:

```
grep avx /proc/cpuinfo
```

If there is no output after running the command, your CPU doesn’t support AVX.

## Establish an SSH Connection

After successfully installing the Director setup, you can access the Fabric Servers and API Server through the console as the **cmdr-admin** user and the LPSM through the console as the **li-admin** user. Go to [SSH Key Pair for li-admin](https://docs.logpoint.com/director/lpsm/configure-lpsm#ssh-key-pair-for-li-admin) to establish an SSH connection for li-admin.

You must establish an SSH connection to upgrade the Director patches.

#### Configuring an SSH pair for cmdr-admin

1. Log into the Fabric Servers or API Server using **cmdr-admin**.
2. Create a directory in the Server using the following command:

   ```
   mkdir ~/.ssh
   ```
3. Create an SSH pair in the Server using the following command:

   ```
   ssh-keygen -t rsa
   ```
4. Copy the public key to **authorized\_keys** using the following command:

   ```
   cp <rsa_filename>.pub ~/.ssh/authorized_keys
   ```
5. Use *addadminip* command to add remote device IP address to the Server. The command will add a firewall rule required to access the Server through the remote device IP.
6. Move the private key to your local machine using the following command:

   ```
   scp <rsa_filename> <user>@<destination_ip>:<path_in_remote_device>
   ```
7. Establish an SSH connection with the API using the following command:

   ```
   ssh -i <id_rsa_path> cmdr-admin@<Server_IP>
   ```

Once you access the system, change the password using the *passwd* command.

## Change SSH Keys

For Director API and Fabric servers v2.5.0 and later, we recommend you change the SSH key pair manually and generate an SSH key pair using the RSA algorithm. To change the SSH key pair manually:

1. Create SSH key pairs using the command:

   ```
   ssh-keygen -t rsa -C "Director" -f director
   ```

   A private key named **director** will be generated.

{% hint style="success" %}
You must repeat the following steps for both API server and Fabric server. If the Director Fabric is a cluster setup, follow these steps for all the cluster nodes.
{% endhint %}

2. Copy the generated private key to both API server and Fabric server. If the Director Fabric is a cluster setup, copy the key to all the cluster nodes using the following command:

   ```
   scp director cmdr-admin@<machine-ip>:~/
   ```

   \<machine-ip> is the IP address of the API or Fabric server where you need to copy the SSH key.

   This copies the **director** key to the home directory of the server with IP address.
3. Access each API server and Fabric server individually via SSH.

   ```
   ssh cmdr-admin@<machine-ip>
   ```
4. Execute the following command:

   ```
   change-server-keys director
   ```

   This will replace the existing SSH key pair with a new SSH key pair.

## Post-installation Setups For New Deployments

After installing Director 2.8.0 or later, you must set and update specific passwords in the exact order listed below. This sequence is critical to maintain secure communication between the Fabric Server, API Server, and LPSM.

{% hint style="warning" %}
Follow the steps listed in their exact order. If you don’t, this may result in Director crashing or a communication failure between the Fabric Server, API Server, and LPSM.
{% endhint %}

#### Prerequisites

* SSH access to all Fabric Servers and the API Server.
* Access to LPSM UI.

#### Fabric Server

1. SSH into the Fabric Server.
2. Run the following command to set the Fabric Network VPN password for the API Server:

   ```
   change-vpn-clientpwd api
   ```
3. Run the following command to set the Fabric Network VPN password for LPSM:

   ```
   change-vpn-clientpwd lpsm
   ```
4. Run the following command to set the Fabric Proxy password:

   ```
   change-fabric-proxyacl
   ```

If you’re running a cluster, repeat steps 1 - 4 on every Fabric Server in the cluster and use the same client password and proxy password on each Fabric Server.

After changing the passwords, create a [backup](https://docs.logpoint.com/director/director-fabric/backup-and-restore#standalone-fabric-server-backup-and-restore) using the `fabric-app-backup-restore` command. We recommend that users store their passwords in a secure password manager.

#### API Server

1. SSH into the API Server.
2. Run the following command to set the Fabric Network VPN password:

   ```
   update-vpn-password
   ```

   Use the same password you used in step 2 above, the password for the Fabric Server for Fabric Network VPN.
3. Run the following command to set the Fabric Proxy password:

   ```
   change-fabric-proxyacl
   ```

   Use the same password you used in step 4, the password for the Fabric Server for Fabric Proxy.
4. Run the following command to set the Fabric Authenticator password:

   ```
   change-fabric-authpwd
   ```

#### LPSM

1. Log in to LPSM and go to **System Settings > Logpoint Director**.
2. In the **Fabric Network** section, enter the Fabric Network VPN password set on the Fabric Server.
3. In the **Fabric Connect** section, enter the Fabric Authenticator password set on the [API Server](#api-server).
4. In the **Sync Pools** section, enter the Fabric Proxy password set on the [Fabric Server](#fabric-server) using the username `zkacl`.

## Pre-installed Integrations

Starting from Logpoint Search Master v2.1.0, LPSM comes with the following pre-installed authentication integrations:

* [Radius Authentication v6.0.0](https://docs.logpoint.com/docs/radiusauthentication-for-lpsm/en/latest/)
* [ADFS Authentication v6.0.0](https://docs.logpoint.com/docs/adfs-authentication-for-lpsm/en/latest/)

## Change Network Information

You can change the network information of the Fabric Server and the API Server using the `change-ip` command exposed to the cmdr-admin user. The command allows you to change the existing network information such as Hostname, IP Address, Netmask, Gateway, PrimaryDNS, SecondaryDNS and Domain name of the Fabric Servers and the API Server.

{% hint style="warning" %}
AWS and Azure environments do not allow changes after launching the instances. For that reason, after setting up network information do not change it for **Fabric Server AMI**, **API Server AMI**, **Fabric Server VHD** and **API Server VHD** on AWS or Azure.
{% endhint %}

#### Changing the Network information of the Fabric Server

1. Execute the `change-ip` command in the Fabric Server and make the necessary changes.
2. If you change the IP address of the Fabric Server, you must:

   2.1. Execute the `com-appinstaller` command in the API Server to update the changes.

   2.2. Update the **Fabric Network** information of the [LogPoint Search Master](https://docs.logpoint.com/director/deploy-and-configure/configure-director/integrate-director-components/configure-logpoint-director-in-lpsm) and the [Fabric-enabled LogPoint instances](https://docs.logpoint.com/director/deploy-and-configure/configure-director/integrate-director-components/connect-logpoint-to-director-setup).
3. If you change the **Hostname** and the **Domain name** of the Fabric Server, you must:

   3.1. Execute the `get-fabrichosts` command in the API Server.

   3.2. Re-configure the **Fabric Storage** settings of the [LogPoint Search Master](https://docs.logpoint.com/director/configure-director/integrate-director-components/configure-logpoint-director-in-lpsm#fabric-storage) and the [Fabric-enabled LogPoint instances](https://docs.logpoint.com/director/configure-director/integrate-director-components/connect-logpoint-to-director-setup#fabric-storage).

   * You can change the **Domain name** of the network only from the master Fabric Server.
   * You must change the **Hostname** and **IP Address** of each server individually.
   * The **Domain name** for each node of the Fabric Server must be the same. However, the **Hostname** and **IP Address** of each Fabric Server node must be unique.

#### Changing the Network information of the API Server

1. Execute the `change-ip` command in the API Server and make the necessary changes. The **Domain name** of API Server and Fabric Server must be the same.
2. Execute the `addfwrule` command in the Fabric Server.

## Configure Public IP for Fabric Server

To configure public IP addresses for Fabric Servers:

1. Execute the `configure-public-ip` command in the Fabric Server.
2. Enter the public IP addresses of the Fabric Nodes in the **Public IP Address Assigment** panel.\
   ![](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Fuk8NNJGYBn2Ni4CL2jeB%2Fimage.png?alt=media\&token=45227d8a-2bf9-451c-9d6d-c86053661318)

   A confirmation window appears summarizing the public IP addresses assigned to the Fabric Servers.\
   ![](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F6IFqlZ0NwvQ1J97pCIQI%2Fimage.png?alt=media\&token=b4298088-71dc-488b-b0f8-0e4a18c7ee77)

{% hint style="info" %}
The public IP addresses assigned to the Fabric Servers can be used in the [LogPoint’s Fabric Network](https://docs.logpoint.com/director/configure-director/integrate-director-components/connect-logpoint-to-director-setup#fabric-network) and the [LPSM’s Fabric Network](https://docs.logpoint.com/director/configure-director/integrate-director-components/configure-logpoint-director-in-lpsm#fabric-network) configurations.
{% endhint %}
