ExtraHop Deployment Series (Part 2): Integration of ECA, EXA, and EDA

Introduction#

In Part 1: Installation Guide, we deployed the three core appliances of the ExtraHop platform: the Console (ECA), the Discovery sensor (EDA), and the Explore storage (EXA).

At this stage, your appliances are running and licensed, but they operate as isolated silos. The EDA sees traffic but has nowhere to store it. The ECA has a dashboard but no sensors to manage.

In this article, we will unify these components into a single ecosystem. We will cover:

1. Pairing the EDA to the ECA: Centralizing management.
2. Pairing the EXA to the ECA: Enabling data query capabilities.
3. Connecting EDA to EXA: Configuring the datastore for long-term record retention.

The Integration Logic#

Before we begin the configuration, it is crucial to understand the relationship between these appliances. The integration is not a mesh; it follows a specific hierarchy:

• Management Plane: The ECA acts as the "Central Manager." Both the EDA and EXA must be paired/registered to the ECA.
• Data Plane: The EDA (Sensor) sends processed wire data directly to the EXA (Storage). This connection is managed via the ECA interface after the initial pairing is complete.

Prerequisites#

Before proceeding, ensure your environment meets the following criteria (completed in Part 1):

• All appliances (ECA, EDA, EXA) are powered on.
• All appliances have static IP addresses configured and are reachable via the network.
• All appliances have a Valid License applied.
• (Optional but Recommended) Time synchronization (NTP) is consistent across all nodes to avoid SSL/Token pairing errors.

---

Integration Steps#

Step 1: Pairing the EDA to the ECA

The first step in building our ecosystem is to connect the Discovery Appliance (EDA) to the Management Console (ECA). This establishes a secure, encrypted channel for management and data visualization.

1. Generate Pairing Token on EDA

To authorize the connection, we must first generate a one-time pairing token from the EDA.

1. Log in to the EDA Administration Interface (https://<eda-ip-address>/admin).
2. Scroll down to the Connected Appliance Administration section.
3. Under Console Settings, click on Generate Token.

4. A popup or text field will appear displaying a long alphanumeric string. Copy this token to your clipboard or save it temporarily in a notepad. You will need it immediately for the next step on the ECA.

2. Register the Sensor on the ECA

With the pairing token copied from the EDA, we now switch to the Console (ECA) to complete the handshake.

1. Log in to the ECA Administration Interface (https://<eca-ip-address>/admin).
2. Scroll to the Connected Appliance Administration section. Under ExtraHop Sensor Settings, click on Manage Sensors.

3. You will be directed to the Manage Connected Appliances page. Ensure the ExtraHop Sensor tab is selected, then click the Connect Sensor button on the right.

4. A configuration dialog will appear. Enter the details to finalize the connection:
   • Host: Enter the IP address of your EDA (Sensor).
   • Token from ExtraHop Sensor: Paste the token string you generated in the previous step.
   • Sensor Nickname: Assign a descriptive name (e.g., EDA-135) for easier identification.

Click Connect.

Once the process completes, the EDA will appear in the list with a "Connected" status, confirming that the Management Plane is successfully established.

Step 2: Configuring the Recordstore Cluster

Before integrating the Explore appliances (EXA) with the ECA, we must first unify the three standalone nodes into a single Recordstore Cluster.

Why Cluster? Clustering provides two critical advantages for your NDR deployment:

1. High Availability & Redundancy: If one node fails, the data remains accessible via the others.
2. Unified Querying: It allows the ECA to query the entire dataset as a single entity, rather than requiring separate queries for each node.

In this scenario, we will use Node 1 as the initial cluster leader and join the remaining nodes to it using the following IP scheme:

• Node 1 (Leader): 198.18.134.132
• Node 2: 198.18.134.133
• Node 3: 198.18.134.134

1. Prepare the Leader (Node 1)

First, we need to obtain the unique identification key from our first node.

1. Log in to the Node 1 Administration UI.
2. Navigate to the Status and Diagnostics section and click on Fingerprint.
3. Note down the displayed fingerprint value. You will need to verify this string when connecting the other nodes to ensure you are joining the correct trusted host.

2. Join Nodes to the Cluster (Node 2 & Node 3)

Now, we will point the remaining nodes to Node 1.

1. Log in to Node 2.
2. Navigate to the Recordstore Cluster Settings section and click Join Cluster.
3. In the Host field, enter the IP address of Node 1 (198.18.134.132) and click Continue.
4. Verification: The system will display the fingerprint of the target host. Confirm that this matches the fingerprint you copied from Node 1 in the previous step. If it matches, proceed to join.

Repeat the exact same steps for Node 3.

3. Verify Cluster Membership

Once all nodes have been joined, verify the cluster health.

1. Go to the Cluster Members section on any of the nodes (e.g., Node 2 or Node 3).
2. You should see all three nodes (Node 1, Node 2, and Node 3) listed in the table with a healthy status. This confirms the storage fabric is successfully established.

Step 3: Integrating the Recordstore Cluster (EDA & ECA)

Now that our Recordstore (EXA) nodes are clustered, we need to weave them into the rest of the ecosystem. This involves two distinct connections:

1. Data Path: Telling the Sensor (EDA) where to send transaction records.
2. Management Path: Telling the Console (ECA) where to query data for visualization.

1. Configure the Data Path (EDA to EXA)

First, we configure the Discovery Appliance to offload its processed transaction records to the Recordstore cluster.

1. Log in to the EDA Administration Interface.
2. Navigate to Connected Appliance Administration and click on Connect Recordstores.
3. Enter the IP addresses of your EXA nodes. Since we are using a cluster, inputting the member IPs ensures the sensor can distribute the record load efficiently.

2. Configure the Management Path (ECA to EXA)

Next, we register the Recordstore cluster with the Console so that dashboards can visualize the stored data.

1. Log in to the ECA Administration Interface.
2. Navigate to Connected Appliance Administration and click on Manage Recordstores.
3. Click Connect Recordstore.
4. Enter the IP address of the EXA nodes one by one. You will be prompted to verify the Fingerprint and enter the Setup Password (the admin password of the EXA node) to authorize the connection.

5. Once added, wait a moment for the connection to establish. The status should update to Online, and the License status should show as Valid.

3. Verification

To ensure the integration is bidirectional and healthy, verify the status from the EXA side.

1. Log in to the Administration Interface of each EXA node.
2. Navigate to the Manager or Remote Management section.
3. You should see the IP address of your ECA listed as the managing console, confirming that the integration loop is closed.

Conclusion#

With the completion of these integration steps, the ExtraHop infrastructure is fully operational. The Management Plane (ECA) now has centralized visibility over the sensors, and the Data Plane is established with the EDA successfully offloading records to the EXA cluster.

The platform is now ready for traffic analysis, dashboard customization, and policy configuration.