Knowledge Base

Upgrade to 8.5 (step by step tutorial)

Thu, 05 Jun 2025 00:00:00 +0100

To upgrade Wanguard (/software/wanguard) and Wansight (/software/wansight) to version 8.5, please follow these steps in the given order: Upgrade unsupported operating systems ▪ If you're running CentOS 8, upgrade to Rocky 8 or AlmaLinux 8. CentOS 8 has reached End Of Life and is no longer supported. ▪ Debian 8, Debian 9 and Ubuntu 16 have also reached End Of Life. Upgrade to at least Debian 10 or Ubuntu 18. ▪ If upgrading the distribution is no longer possible, follow the Console transfer steps (https://docs.andrisoft.com/wanguard/8.5/Configuration__Servers.html#transferring-console) to copy the data to a new system. Log in to the web interface ▪ Go to Configuration » Components and stop all components. Log out of the web interface ▪ Select your user menu from the top-right corner and choose Log Out. Stop the WANsupervisor service on all servers: [root@localhost:~]# systemctl stop WANsupervisor Update the Capture Engine (if applicable) ▪ If you’re using PF_RING, update it to PF_RING 9.0. ▪ If you're using Netmap, update it to a Git version from around December 2024. ▪ If you're using DPDK, update it to version 24.11. Upgrade the software packages, starting with the Console server ▪ Do not upgrade the Linux distribution at this point (e.g., from Ubuntu 18 to 20). ▪ The upgrade might take tens of minutes if the database is very large (due to Unlimited values in Data Retention (https://docs.andrisoft.com/wanguard/8.5/Configuration__General_Settings__Data_Retention.html)). Do not reboot the server. On RHEL/Rocky/AlmaLinux 8, run: [root@localhost:~]# rpm -Uvh https://packages.andrisoft.com/rhel8/wanrepo-8.5-0.noarch.rpm[root@localhost:~]# yum upgrade On RHEL/Rocky/AlmaLinux 9, run: [root@localhost:~]# rpm -Uvh https://packages.andrisoft.com/rhel9/wanrepo-8.5-0.noarch.rpm[root@localhost:~]# yum upgrade On Debian 10, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com buster main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Debian 11, run: [root@localhost:~]# echo "deb [signed-by=/usr/share/keyrings/andrisoft-keyring.gpg] https://packages.andrisoft.com bullseye main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Debian 12, run: [root@localhost:~]# echo "deb [signed-by=/usr/share/keyrings/andrisoft-keyring.gpg] https://packages.andrisoft.com bookworm main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 18, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com bionic main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 20, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com focal main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 22, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com jammy main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 24, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com noble main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade • Ensure you upgrade the software on all servers, not just the Console server. It’s crucial to run the same software version everywhere. Start the WANsupervisor service on all servers [root@localhost:~]# systemctl start WANsupervisor Log in to the web interface again ▪ Go to Configuration » Components and start all components. Review the relevant release note(s) (https://www.andrisoft.com/blog/news) ▪ Check for additional details or changes introduced in this release. Your feedback is highly appreciated! If you encounter any issues, please contact support@andrisoft.com.

Upgrade to 8.4 (step by step tutorial)

Wed, 04 Jun 2025 00:00:00 +0100

To upgrade Wanguard (/software/wanguard) and Wansight (/software/wansight) to version 8.4, please follow these steps in the given order: Upgrade unsupported operating systems ▪ If you're running CentOS 8, upgrade to Rocky 8 or AlmaLinux 8. CentOS 8 has reached End Of Life and is no longer supported. ▪ Debian 8, Debian 9 and Ubuntu 16 have also reached End Of Life. Upgrade to at least Debian 10 or Ubuntu 18. ▪ If upgrading the distribution is no longer possible, follow the Console transfer steps (https://docs.andrisoft.com/wanguard/8.4/Configuration__Servers.html#transferring-console) to copy the data to a new system. Log in to the web interface ▪ Go to Configuration » Components and stop all components. Log out of the web interface ▪ Select your user menu from the top-right corner and choose Log Out. Stop the WANsupervisor service on all servers: [root@localhost:~]# systemctl stop WANsupervisor Update the Capture Engine (if applicable) ▪ If you’re using PF_RING, update it to PF_RING 8.8. ▪ If you're using Netmap, update it to a Git version from around December 2024. ▪ If you're using DPDK, update it to version 24.11. Upgrade the software packages, starting with the Console server ▪ Do not upgrade the Linux distribution at this point (e.g., from Ubuntu 18 to 20). ▪ The upgrade might take tens of minutes if the database is very large (due to Unlimited values in Data Retention (https://docs.andrisoft.com/wanguard/8.4/Configuration__General_Settings__Data_Retention.html)). Do not reboot the server. On RHEL/Rocky/AlmaLinux 8, run: [root@localhost:~]# rpm -Uvh https://packages.andrisoft.com/rhel8/wanrepo-8.4-0.noarch.rpm[root@localhost:~]# yum upgrade On RHEL/Rocky/AlmaLinux 9, run: [root@localhost:~]# rpm -Uvh https://packages.andrisoft.com/rhel9/wanrepo-8.4-0.noarch.rpm[root@localhost:~]# yum upgrade On Debian 10, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com buster main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Debian 11, run: [root@localhost:~]# echo "deb [signed-by=/usr/share/keyrings/andrisoft-keyring.gpg] https://packages.andrisoft.com bullseye main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Debian 12, run: [root@localhost:~]# echo "deb [signed-by=/usr/share/keyrings/andrisoft-keyring.gpg] https://packages.andrisoft.com bookworm main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 18, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com bionic main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 20, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com focal main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 22, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com jammy main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade On Ubuntu 24, run: [root@localhost:~]# echo "deb https://packages.andrisoft.com noble main" > /etc/apt/sources.list.d/andrisoft.list[root@localhost:~]# apt update[root@localhost:~]# apt dist-upgrade • Ensure you upgrade the software on all servers, not just the Console server. It’s crucial to run the same software version everywhere. Start the WANsupervisor service on all servers [root@localhost:~]# systemctl start WANsupervisor Log in to the web interface again ▪ Go to Configuration » Components and start all components. Review the relevant release note(s) (https://www.andrisoft.com/blog/news) ▪ Check for additional details or changes introduced in this release. Your feedback is highly appreciated! If you encounter any issues, please contact support@andrisoft.com.

Requesting technical support

Mon, 27 Jan 2025 00:00:00 +0100

To speed up the troubleshooting process done by the technical support team, please make sure that you cover the steps listed below. Create a support ticket that describes the problem by either: Sending an email to support andrisoft.com, or Opening a ticket here (/support/portal/ticket/create) Send us the URL of your Console (/software/wanguard/web-console) and either: Activate the Console "support" account (see how (/images/enable_support_account.jpeg)), or Send us securely the Console "admin" password In some cases we may need you to provide us with SSH access to your server/s. You can do that by either: Installing this (https://www.andrisoft.com/andrisoft_rsa.pub) public key with the following commands: wget https://www.andrisoft.com/andrisoft_rsa.pub ; mkdir /root/.ssh ; cat andrisoft_rsa.pub >> /root/.ssh/authorized_keys Sending us the "root" password securely via the ticketing system As a precaution, we highly recommended allowing only our IPs to connect to your Console over the Internet. Please configure your firewall to permit access to your server(s) on port 22 (ssh), 80 (http) and 443 (https) from 84.242.12.180 and 2a02:1b8:10:245:a24f::1 (for IPv6-only networks). The old IPs 85.17.76.69 and 2001:1af8:4040:a00a:2::1 are not used anymore.

Software EOL

Wed, 10 Apr 2024 00:00:00 +0100

Each major version of Wanguard typically has a lifespan of 1 to 1.5 years. We release a major update annually along with numerous patches throughout the year. When a new version of Wanguard is introduced, we discontinue updates for the previous version, with the exception of critical security patches. Updating our software is generally simple, however, it is important to consider the end-of-life (EOL) of the Linux distribution you are using. We only launch new major versions of Wanguard for Linux distributions that have not yet reached their EOL at the time of release. For instance, we are still issuing patches for Wanguard 8.3 on CentOS 7, which has an EOL in June 2024, but we have ceased support for CentOS 8 since its EOL passed in 2021.

NFS configuration for remote servers

Mon, 25 Mar 2024 00:00:00 +0100

This article is obsolete and the most up-to-date information can be found in the User Guide (https://www.andrisoft.com/docs/wanguard/latest/Configuration__Servers.html#accessing-remote-data-via-nfs)! If you have deployed Packet Sensor (/software/wanguard/packet-sniffing-mirroring), Flow Sensor (/software/wanguard/netflow-sflow-collector-analyzer) or Wanguard Filter (/software/wanguard/ddos-mitigation-protection) on a different server than the Console (/software/wanguard/web-console), you must configure NFS (Network File System) to export the Flow Collector and Packet Trace data to the Console's server. If you do not, the user interface will not be able to access packet traces or flows saved on remote servers. Install the necessary packages on the Console server. On Red Hat or CentOS execute: [root@console ~]# yum install nfs-utils nfs-utils-lib On Debian or Ubuntu execute: [root@console ~]# apt-get install nfs-common Install the necessary packages on the remote server. On Red Hat or CentOS execute: [root@remote ~]# yum install nfs-utils nfs-utils-lib On Debian or Ubuntu execute: [root@remote ~]# apt-get install nfs-kernel-server nfs-common Log in to Console and go to Configuration » Servers » [Remote Server] to look for the Server ID. You will have to replace [server_id] in the next steps with this number. On the Console server find the UID and GID of the "andrisoft" user account by executing: [root@console ~]# id andrisoft uid=4097(andrisoft) gid=4097(andrisoft) groups=4097(andrisoft) In this particular case, in the next step you should replace [andrisoft_uid] with 4097 and [andrisoft_gid] with 4097. On the remote server add the following lines to the /etc/exports file: /opt/andrisoft/dumps/[server_id] [console_ip](no_subtree_check,rw,anonuid=[andrisoft_uid],anongid=[andrisoft_gid]) /opt/andrisoft/flows/[server_id] [console_ip](no_subtree_check,rw,anonuid=[andrisoft_uid],anongid=[andrisoft_gid]) Execute on the remote server: [root@remote ~]# mkdir -p /opt/andrisoft/dumps/[server_id] [root@remote ~]# chown -R andrisoft:andrisoft /opt/andrisoft/dumps/[server_id] [root@remote ~]# mkdir -p /opt/andrisoft/flows/[server_id] [root@remote ~]# chown -R andrisoft:andrisoft /opt/andrisoft/flows/[server_id] On the Console server add the following lines to the /etc/fstab file: [sensor_ip]:/opt/andrisoft/dumps/[server_id] /opt/andrisoft/dumps/[server_id] nfs intr,soft,_netdev [sensor_ip]:/opt/andrisoft/flows/[server_id] /opt/andrisoft/flows/[server_id] nfs intr,soft,_netdev Execute on the Console server: [root@console ~]# mkdir -p /opt/andrisoft/dumps/[server_id] [root@console ~]# chown andrisoft:andrisoft /opt/andrisoft/dumps/[server_id] [root@console ~]# mkdir -p /opt/andrisoft/flows/[server_id] [root@console ~]# chown andrisoft:andrisoft /opt/andrisoft/flows/[server_id] Make sure the TCP and UDP port 2049 (NFS) and 111 (RPC) are opened in your remote server's firewall. Consult your Linux distribution's documentation to see how to open up the two ports. You can check the status of your firewall by executing: [root@remote ~]# iptables -L INPUT -n -v Restart the NFS service on the remote server. On Red Hat or CentOS execute: [root@remote ~]# service nfs restart [root@remote ~]# chkconfig --level 345 nfs on On Debian or Ubuntu execute: [root@remote ~]# service nfs-kernel-server restart [root@remote ~]# update-rc.d nfs-kernel-server defaults 99 # for System V distributions [root@remote ~]# systemctl enable nfs-kernel-server # for Systemd distributions Restart the NFS service on the Console server if you run Red Hat or CentOS: [root@console ~]# service nfs restart [root@console ~]# chkconfig --level 345 nfs on Mount on the Console server the directories exported by the remote server: [root@console ~]# mount /opt/andrisoft/dumps/[server_id] [root@console ~]# mount /opt/andrisoft/flows/[server_id] Note: If you plan to remove a NFS-linked directory from your Console server, unmount it first with 'umount -l -f /opt/andrisoft/...' Configure the remote server with the same time-zone as the Console server. To troubleshoot NFS-related issues, use the following commands: showmount -e : Shows the available shares on your local machine showmount -e [server-ip or hostname]: Lists the available shares at the remote server showmount -d : Lists all the sub directories exportfs -v : Displays a list of shares files and options on a server exportfs -a : Exports all shares listed in /etc/exports, or given name exportfs -u : Unexports all shares listed in /etc/exports, or given name exportfs -r : Refresh the server’s list after modifying /etc/exports

Your company logo and other rebranding options

Sat, 27 Jan 2024 00:00:00 +0100

White-labeling is disabled by default. It can only be enabled by applying a special license key, which must be purchased. To obtain a quote for this non-free feature, please make an inquiry at sales andrisoft.com. The Terms of Use (http://www.andrisoft.com/terms-of-use) forbids modifications of the Wanguard / Wansight Console (/software/wanguard/web-console) without Andrisoft's prior approval. Technical requirements: • A Console login logo of 256x150 pixels saved as /opt/andrisoft/webroot/img/rebranding.png • A Console header logo, 35 pixels high, suitable to be displayed on a dark background, saved as /opt/andrisoft/webroot/img/header_rebranding.png • A favicon.ico file saved as /opt/andrisoft/webroot/img/rebranding.ico • An alternate name for the Console (optional)

Pricing scheme

Wed, 10 Jan 2024 00:00:00 +0100

Sensor Licensing You must purchase as many Wanguard Sensor licenses (/store/software/wanguard-sensor) (or the more affordable Wansight Sensor licenses (/store/software/wansight-sensor) if DDoS detection is not needed) as the number of Packet Sensors (/software/wanguard/packet-sniffing-mirroring) and Flow Sensors (/software/wanguard/netflow-sflow-collector-analyzer) configured and activated in the web interface. Each Flow Sensor can monitor a single flow exporter - usually a border or edge router. Flow Sensor does not have a licensing limitation on the number of interfaces it can monitor, or any limitation involving the network's traffic volume. Multiple Packet Sensors listening to the same interface (e.g., multi-queue NIC) consume a single Sensor license. Packet Sensor can monitor multiple interfaces when used with PF_RING or DPDK, and has no limitations involving the network's traffic volume. Sensor Cluster does not require a license to operate, since it works by aggregating the data collected by other Sensors. Filter Licensing You must also purchase as many Wanguard Filter licenses (/store/software/wanguard-filter) as the number of Packet Filters (/software/wanguard/ddos-mitigation-protection) and Flow Filters (/software/wanguard/ddos-mitigation-protection) configured and activated in the web interface. A Wanguard Filter license does not include a Wanguard Sensor license. Each Packet Filter can monitor and apply filtering rules on a single network interface, except when using DPDK (which requires a dedicated license). Flow Filter accepts traffic data from multiple Flow Sensors, so in most cases, a single Flow Filter is enough even for very large networks. When using BGP Flowspec, a single Flow Filter can work with multiple routers. Filter Cluster does not require a license to operate, since it works by aggregating the data collected by other Filters. DPDK Licensing If you are using DPDK (https://www.dpdk.org/) with Packet Sensor or Packet Filter, you will have to purchase a separate DPDK license (/store/software/dpdk-engine) for it. Console Licensing Console (/software/wanguard/web-console) is free and it does not require a license. Server Licensing You can distribute the licensed Sensors and Filters on multiple servers. The registration of each server that runs our software is required, but there is no cost per server. Licensing Period The minimum software licensing period is 12 months. You can purchase licenses for up to 4 years in advance. We sell perpetual licenses only in special cases (e.g. OEM deals). The subscription-based licensing model offers several advantages over the perpetual licensing model: It lowers the initial cost. For the long term, it is also more cost-effective than a perpetual license + the annual technical support costs. It includes standard support for the whole period of the subscription. It is an incentive to keep adding the features that you need. It is an incentive to provide you with the best support. The software does not support separate expiration dates for multiple licenses. To avoid losing licensing days, we merge the expiration dates for the components not purchased on the same date by calculating the average date while considering the number of licenses, in a completely fair manner. Eg. If you have a Sensor license expiring in 6 months and you buy another Sensor license for 12 months, you will not have different expiration dates for the 2 Sensors. Instead, you will have a single license key for 2 Sensors valid for 9 months. This way you will only have to pay the subscription once per year.

Upgrade to 8.3 (step by step tutorial)

Thu, 28 Dec 2023 00:00:00 +0100

To upgrade Wanguard (/software/wanguard) and Wansight (/software/wansight) to version 8.3, please follow the steps listed below, in the presented order: If you're running CentOS 8, upgrade to Rocky 8 or AlmaLinux 8. CentOS 8 has reached End Of Life and it's no longer supported Debian 8 and Debian 9 have also reached End Of Life, so upgrade to at least Debian 10 Login in to the web interface, go to Configuration » Components and stop all components Logout from the web interface by selecting your user menu from the top-right part of the window Stop the WANsupervisor service on all servers: service WANsupervisor stop If you're using PF_RING as Capture Engine, update it to PF_RING 8.6 If you're using Netmap as Capture Engine, update it to a git version from around December 2023 If you're using DPDK as Capture Engine, update it to version 23.11 Upgrade the software packages starting with the Console server. The Linux distribution should not be upgraded at this point (e.g. Ubuntu 18 to 20). On CentOS/RHEL/Rocky/AlmaLinux servers, upgrade the packages with: yum upgrade On Debian/Ubuntu servers, upgrade the packages with: apt-get update; apt-get dist-upgrade Make sure the software is upgraded on all servers, not just on the Console server. It's very important to run the same software version everywhere! Start the WANsupervisor service on all servers: service WANsupervisor start Log in to the web interface and start the components from Configuration » Components Review the relevant release note(s) (https://www.andrisoft.com/blog/news) Your feedback is highly appreciated! Please contact support@andrisoft.com if you encounter errors.

Transferring your Console to a new server

Wed, 11 Oct 2023 00:00:00 +0100

If you want to move your Console to a new server, please follow the following steps. On your OLD machine: Stop all Components (Sensors, Filters, BGP Connectors) from Configuration » Components. Stop WANsupervisor:service WANsupervisor stop Backup the database:/opt/andrisoft/bin/WANmaintenance backup_db On your NEW machine: Install the packages and their dependencies. If you had a running Console on this machine, stop all Components (Sensors, Filters, BGP Connectors) from Configuration » Components Stop WANsupervisor if it's running:service WANsupervisor stop In case you have a Console set up on this machine, make a backup of its configuration: /opt/andrisoft/bin/WANmaintenance backup_db Copy the backup file from your OLD machine to the NEW machine: scp -r user@old_machine://opt/andrisoft/tmp/wanguard_backup_from_xxxx-xx-xx.sql /root Restore the backup on the new machine: mysql -p andrisoft < /root/wanguard_backup_from_xxxx-xx-xx.sql Go to Configuration » Servers and change the IP Address for each server Update the configuration of the Sensors, Filters and BGP Connectors in order to reflect the interfaces and IP addresses of the new machine. Start WANsupervisor: service WANsupervisor start On any remote server that runs Sensors and/or Filters: Update the software packages to the latest version, and execute on each one: /opt/andrisoft/bin/install_supervisor When prompted, provide the new Console IP and database password. Restart the WANsupervisor service: service WANsupervisor restart Restore configurations: In case something went wrong, and you need to restore the configurations on the NEW machine: Stop all Sensors Stop the WANsupervisor service: service WANsupervisor stop Restore the initial database:mysql -p andrisoft

How to change the IP address on a Wanguard server

Thu, 14 Sep 2023 00:00:00 +0100

The steps necessary for changing the IP address of a Wanguard server are: Change the IP in Configuration » Servers Execute /opt/andrisoft/bin/install_supervisor. When prompted, provide the new IP and the MySQL/MariaDB password listed in /opt/andrisoft/etc/dbpass.conf Copy/paste the new Hardware Key from Configuration » General Settings » License Manager » Licensing Requirements to sales@andrisoft.com. A new license key will be provided by email in the shortest time Upload the new license key in Configuration » General Settings » License Manager Please contact support@andrisoft.com if you encounter errors.