Pick a flow, fill in your details, and run it against your own AWS account. The diagram wires itself up from real state, the narration explains each step as it happens, and the console shows the raw truth underneath.
Each path runs the exact automation an SE runs from the CLI — wrapped so you can watch it, explain it, and hand it to a customer. Run any of them above; the detail for each is below.
One CloudFormation deploy (or Terraform) brings up the VPC and all three appliances from the AWS Marketplace, across twelve regions. It fails fast on Elastic-IP quota so you never burn instance-hours on a doomed run.
The simplest model — no KVO. Ansible pushes the sensor to every tagged host and each one self-registers. One tag (cloudlens=yes) drives the whole fleet.
Insecure registry pull, then docker run …/sensor --ssl_verify no. Registers with HTTP 200.
RHEL 9 ships Podman, not Docker — podman pull --tls-verify=false, and the run drops the docker.sock mount.
Silent install of cloudlens-win-sensor.exe via SSM; the service is named CloudLens (not CloudLensAgent).
KVO becomes the single pane. Every UI "button" is scripted: accept the EULA, activate licenses, create the KVO user on the CLMS, adopt it, and provision the working project key through a Cloud Config.
createCloudLensManager, commit the change request, wait for CONNECTED.The vPB self-announces to KVO, is auto-licensed on adoption, and comes up Online — then KVO builds its Device Config and you bind the traffic path: ingress → filter → egress → tool.
No sensor in the guest. KVO deploys collector Service VMs and drives AWS VPC Traffic Mirroring — AWS copies traffic from every selected Nitro source ENI to the collectors, which forward it to your tool. Real AWS resources: mirror targets, filters, and one session per source ENI.
KVO matches Nitro instances tagged cloudlens=yes. Non-Nitro hosts can't be tapped — put sensors on those.
An auto-scaling group of collector Service VMs comes up per zone, from the Keysight Marketplace image, resolved per region.
KVO creates a Traffic Mirror target + filter, then one session per source ENI — visible in VPC → Traffic Mirroring.
Nothing is "done" until it shows up where it matters. The console holds this bar too — every step maps to a real state, and it says waiting rather than faking progress.
Each host returns HTTP 200 at agent/register; the project's sensor count climbs as they check in.
Inventory → Devices shows the vPB Online, auto-licensed, with its Device Config and bound ingress/egress ports.
describe-traffic-mirror-sessions lists one session per Nitro source ENI pointing at the collector target.
| Item | Value | Notes |
|---|---|---|
| vController web UI | admin / Cl0udLens@dm!n | Web login only. The console/CLI login is a different passphrase — change on first use. |
| KVO web UI | admin / admin | Accept the EULA and activate licenses before any write. |
| vPB SSH (AWS) | ssh -p 9022 admin@… | Then the kvo context: ip / port 443 / enable — not flat commands. |
| Source selection | tag cloudlens=yes | Same tag drives the sensor and the agentless mirror paths. |
| AWS mirroring | Nitro instances only | t3 / m5 / c5 / r5 and newer are Nitro; describe-instance-types … Hypervisor confirms. |
| Key network ports | 443 · 9022 · 8443 | 443 CLMS/KVO API · 9022 vPB SSH · 8443 KVO↔collector (open in the SG). |
Elastic-IP quota (default 5/region). Release orphaned EIPs from console-terminated instances, or raise the limit — the stack's pre-check catches it in seconds.
Run the kvo commands inside the context (not flat kvo ip), and confirm the mgmt network reaches KVO on 443. It self-announces from there.
Sources must be Nitro, KVO needs the Zone-Tapping IAM, and 8443 must be open KVO↔collector. Confirm the collector registered before expecting sessions.