Configuring controlled live mode using the CLI

You configure controlled live mode by using several

analysis live

CLI commands.

Prerequisites

Controlled live mode is disabled.
If the live ether2 data interface is required, verify that the ether2 data interface is cabled for connectivity to the Internet, either directly to an Internet-facing firewall device or through a proxy server.
You have the following network settings for the live ether1 or ether2 interface:
- Data Interface—The live ether1 or ether2 data interface.
- External IP—External IPv4 address of the live ether1 or ether2 data interface
  Important
  To prevent the exposure of IP addresses and other information about your network, Trellix recommends that you configure the live ether1 or ether2 interface on a different domain from the main network traffic.
- Mask—Mask length for the live ether1 or ether2 interface address.
- Default gateway—IPv4 address of the node used by the live ether1 or ether2 interface to access the Internet default gateway. If the live ether2 data interface is required, Trellix recommends that you keep the ether2 interface logically separate from the main network traffic so that the ether1 management interface resides on a different subnet from the ether2 interface.
- Name server—IPv4 address of the DNS (Domain Name System) server for the live ether1 or ether2 interface.
If your local network accesses the Internet through a proxy server, you know the following additional settings:
- FQDN/IP address—Fully qualified domain name or IPv4 address of the node acting as the proxy server for the live ether1 or ether2 interface.
- Port—Port number that the proxy server uses for client connections.
- Username—(If the proxy server enforces password-based client authentication) Username for authenticating at the proxy server.
- Password—(If the proxy server enforces password-based client authentication) Password for authenticating at the proxy server.
You are logged in to the appliance CLI as an Admin or Operator.

To configure controlled live mode:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Configure the live ether1 or ether2 interface.
hostname (config) # analysis live live-interface <interfaceName>
where <interfaceName> is the name of the live ether1 or ether2 data interface.
Configure the IPv4 address for the live ether1 or ether2 interface. Include either the subnet mask (such as 255.240.0.0) or the mask length (such as /12). (In a NAT environment, use the IP address assigned to the interface, not the external-facing NAT IP address.)
```
hostname (config) # analysis live external ip 172.16.0.0 /12
```

Configure the IPv4 address of the default gateway and DNS name server for the live ether1 or ether2 interface.

hostname (config) # analysis live default-gateway 172.16.1.1
hostname (config) # analysis live nameserver 172.16.2.1

If your network accesses the Internet through a proxy server, specify the proxy server fully qualified domain name or IP address and the port number that the proxy server uses for client connections.
```
hostname (config) # analysis live http-proxy 10.10.10.5 8080
```
To stop using a proxy server, clear the address and port number:
```
hostname (config) # no analysis live http-proxy
```
If proxy authentication is required, specify the proxy authentication credentials,
```
hostname (config) # analysis live proxy-authentication root ********
```
To stop using proxy authentication, clear the credentials:
```
hostname (config) # no analysis live proxy-authentiction
```
Save your changes.
```
hostname (config) # write memory
```
Check end-to-end connectivity between the live ether1 or ether2 interface and the Internet. If a proxy server is configured for the live ether1 or ether2 interface, the operation checks for connectivity through the proxy server.
```
hostname (config) # analysis live check-connection
```
- If the test verifies end-to-end connectivity, the command output is as follows:
```
Data Interface configured correctly.
```
- If the test fails, the command output displays one of the following messages. Correct the configuration, save your changes, and then retest the connection before you continue.
```
Data Interface not configured correctly. Download failed. Err: Couldn't resolve host name
```
```
Data Interface not configured correctly. Download failed. Err: Timeout was reached
```