Configure the Azure vTAP

After you provision the Network Sensor host and enable virtual network peering (if applicable), create the vTAP.

The vTAP is created with the Virtual network terminal access points service in Azure, which you can find by searching for vTAP or Virtual network TAP in the Azure portal search bar.

Create the vTAP

1. In the Virtual network terminal access points menu, click Create.
2. In the vTAP configuration menu, set a descriptive name such as Network Sensor vTAP.
3. Click Select destination resource. The destination resource can be either a Network Interface or a Load Balancer. This article uses a Network Interface as an example.
4. Select the Network Interface previously created for the Network Sensor host.

5. Save the destination, then click Next. Do not add traffic sources yet.
6. Review the vTAP configuration and create the vTAP.

Restart the Traffic Source VMs

After you create the vTAP, stop (deallocate) and then start each VM whose traffic you want to monitor. You must restart the source VMs before you add their Network Interfaces to the vTAP. Otherwise, Azure may report that the Network Interface is not on fastpath, and the traffic is not mirrored.

Add the Traffic Sources

1. Open the vTAP you created and go to its Sources menu.
2. Click Add and select all relevant Network Interfaces to be monitored.

3. Save the traffic sources.

Confirm the vTAP Configuration

Capture traffic on the Network Sensor host to verify that the vTAP sends VXLAN traffic to it.

To confirm the vTAP configuration:

1. Connect to the Network Sensor host VM using SSH.
2. Run ip addr on the VM and find the IP address associated with the vTAP destination network interface. The interface is often listed as eth1 or similar.
3. In Azure, go to the Network Settings for the VM and compare the IP address of the interface to the IP address from the previous step.
4. Run tcpdump on the vTAP destination network interface.
5. Review the tcpdump output.

Once tcpdump is running, you should see VXLAN traffic in the output if everything is working as expected. If there was an issue with the configuration, little or no traffic will be seen in the output.

Install the Network Sensor

After you confirm that the Network Sensor host receives traffic, download and install the Network Sensor.