How profiles work¶
As a Plixer Replicator appliance receives packets/flows, it compares a packet stream’s source exporter and the UDP port it was received on against those defined in all configured profiles. If a matching profile (or profiles) exists, the stream is replicated and forwarded to the collector(s) assigned to that profile.
A profile must be configured with the following details to be considered valid:
Exporters: Source network devices, such as routers, switches, or servers, whose packets/flows should be managed by the profile
Collectors: Flow collectors, such as NPM, SIEM, or NDR systems, where packets associated with the profile should be sent
Policies: Exporter inclusion/exclusion rules based on subnet/CIDR (can be used in place of or to complement adding individual exporters to the profile)
In port: The in/listening port a packet must be received on (i.e., packets received from the same exporter but on a different port will not be managed by the profile)
Out Port: The out/sending port to use to send packets to the collector(s) assigned to the profile
As part of the web interface’s first login wizard, the user is walked through the process of creating a new profile. This profile can later be edited to add exporters, assign collectors, and define policies. Additional profiles can also be created/configured at any time.
Note
To send the same stream(s) to more than one collector, assign the destination collectors to a profile with the corresponding exporters.
When a Plixer Replicator appliance is deployed as part of a Plixer Scrutinizer environment, a special seed profile with no collector defined must be created to allow Plixer Scrutinizer to automatically manage load balancing across its collectors. To learn more about the Auto Replicate feature, see this section of the Plixer Scrutinizer documentation.