Implementation Checklist

👍
Checklist for implementation

Enterprise Firewall and EdgeConnect Team request

Orchestrator, Portal, and IPSLA rules.

❗️
Advanced stats collectors add "-sc-xxxxx" in the ORCH URL to talk to the collectors, please note stats collection traffic might be blocked if you do not update your firewall rules, to avoid this allowing traffic too *.silverpeak.cloud is best practice.

🚧
Security Scanning Information

EC's have a FLOW count limit, scanners can quickly overwhelm these limits while scanning, each port for each endpoint will be 1 flow - scanning all TCP and UDP ports would be ~130,000 Flows. 10108 and smaller ECs have 256,000 flow limits and EC Medium and larger have 2 million flow limit. Please refer to the chart below for recommendations.

Assumptions:

Scans must be during business hours

All on network devices are scanned

Only scans that traverse the SDWAN apply.

Use Firewall Protection Profiles (FPP) to protect EC from high number of scans, preventing outages, if FPP interferes with scans use the below table for further integrations.

Preferred Methods
Prioritize the assets to be scanned and Limit the number of flows created
Adjust and control scan rate and speed of the Scanner.
Prioritize scanning "moving user devices" like computer vlans, schedule other vlans for phones and printers after hours, devices that are normally not disconnected like user devices are
For very large sites considered a local scanners on site. This will allow fast scanning without affecting the WAN
Offset the scans instead of doing one bulky scan
Scan 20% of multiple sites rather than one entire site at one time.

For further information, please refer to the detailed documentation provided in the scan-guidance section.scan-guidance

Preferred Methods
Prioritize the assets to be scanned and Limit the number of flows created
Adjust and control scan rate and speed of the Scanner.
Prioritize scanning "moving user devices" like computer vlans, schedule other vlans for phones and printers after hours, devices that are normally not disconnected like user devices are
For very large sites considered a local scanners on site. This will allow fast scanning without affecting the WAN
Offset the scans instead of doing one bulky scan Scan 20% of multiple sites rather than one entire site at one time.

Network Team

Server Team

On PREM-Orchestrator Only
- Deploy Orch per guide Deployment Guides
- Deploy Stats Collector server(s) Distributed Stats Collector
- Backup location

Cloud team

Persimmission to Network team to deploy EC-V
- > 🚀 Best Practice:
  - Google, AWS, AZURE - deploy Via Orchestor "Deploy hubs in cloud" Feature.
  - Other Cloud services follow Cloud Deployment
Deploy Self hosted Cloud Orchestrator only
- Orchestrator Follow Orch Cloud deployment