Migration to a multi-tenant environment

Enabling multi-tenancy

If you have not used multi-tenancy yet and would like to start, go to Flowmon Configuration Center → System → User Settings → Tenants and follow the steps described in the Tenants section of the Flowmon User Guide (under Configuration Center > System > User Settings). After you create your desired tenants, do not forget to create new roles and users in each tenant. For further details, refer to the following sections in the Flowmon User Guide (under Configuration Center > System > User Settings):

• Roles
• Users

After creating new roles and users in each tenant, you can switch to the Anomaly Detection System (version 12.3 or newer) and configure individual tenants according to your needs without affecting other tenants.

If you want to migrate an existing Flowmon ADS configuration to a multitenant environment, we recommend you to check the Migration of existing Flowmon ADS configuration section before upgrading to version 12.3.

Upgrade from older versions

The upgrade process automatically assesses the current configuration of the Anomaly Detection System and migrates all data and configuration to the default Base tenant, if possible. After the upgrade, the Flowmon ADS continues to operate as usual, without noticing the multi-tenancy support. In some cases, upgrading to version 12.3 and above may require special attention based on the current configuration. Below, we describe individual cases and how to upgrade to the multi-tenant version.

Flowmon appliance without tenants

When no additional tenants were defined before the upgrade (in the Flowmon Configuration Center), there is no need to perform any manual action. All data and configuration will be automatically assigned to the default Base tenant. After the upgrade, the Flowmon ADS continues to operate as usual.

Flowmon appliance with tenants

Upgrading to the version of the Anomaly Detection System that officially supports multi-tenancy (version 12.3 and above) requires that there are no Perspectives or Filters assigned to a user that belongs to a different tenant than the Base tenant. Perspectives and Filters can be assigned to users in Settings → System Settings → User permissions. At the same time, an owner in Settings → Processing → Email notification/Traffic recording/Custom scripts must not be set to a user from a different tenant than the Base tenant. If the conditions above are not met, the update process will be blocked. Because all data is migrated to the Base tenant, users from other tenants cannot see any events after the upgrade to version 12.3. This is expected behavior. Other tenants are isolated from the Base tenant and must be configured to start detecting their own events.

Migration of existing Flowmon ADS configuration

In Flowmon ADS 12.2 and older versions, multi-tenancy could have been achieved (to some extent) by specific user permissions configuration. The user's data visibility can be limited by assigning perspectives and filters to individual users. If you would like to migrate the current configuration into individual tenants, you can do so by importing the whole Flowmon ADS configuration to each tenant and deleting irrelevant parts of the configuration. Migration steps need to start before upgrading to 12.3 because a Flowmon ADS configuration without assigned tenants is required. To do the migration properly, follow these steps:

1. Check you have installed Flowmon ADS 12.2.x.
2. Disable Data Feeds to avoid unwanted flow processing and to be able to delete irrelevant Data Feeds after the import.
3. Export the entire XML configuration by clicking Download in Flowmon Configuration Center → System → System Settings → Maintenance → Configuration file.
4. Change the configuration of the ADS in the web user interface so Flowmon ADS 12.3 can be installed (as described in the paragraph above - Perspectives and Filters must not be assigned to users that belong to a different tenant than the Base tenant. Also, an owner for all Email notifications, Traffic recording, or Custom scripts must be a user from the Base tenant).
5. Install Flowmon ADS 12.3.
6. Import the XML configuration for each tenant separately:

• Switch to the desired tenant by clicking your user name in the top-right corner and choosing the tenant in the drop-down menu.
• Go to the Flowmon Configuration Center → System → System Settings → Maintenance.
• Click Upload in the Configuration file section and upload the XML configuration.
• Repeat these steps for each tenant in which you want to import the configuration.

7. In each tenant, manually remove the configuration parts that are not relevant to the tenant (ideally in the following order: False positives, Report Chapters, Blacklists, Data Feeds, Perspectives, Filters, and so on).
8. Enable Data Feeds.