AppGate XDP v2.0 Installation from ISO into Virtual Box Hypervisor

(1)

AppGate XDP v2.0

Installation from ISO into Virtual Box Hypervisor

Last Updated March 24 2016

(2)

AppGate XDP – Installation from ISO Page 2

Installation from ISO on a hypervisor

This document will provide the necessary step to set up a virtual appliance on a hypervisor. Before starting the installation it is recommended to read the Introduction of the administrator manual to understand the key concepts of the product. And also the General Administration, managing appliances.

This will give you a good understanding of the topology and the purpose of each appliance in the product. Once you get the concepts of a controller, gateway and log server, you can start installing the appliances using this installation guide.

1. Prerequisites

We used Oracle Virtual Box in this example, but the installation will be similar on VMware. The first thing we will do is to create a first empty virtual machine.

The minimum settings for a VM should be the following:

Min 1 CPU

8 Gbyte of memory 20 Gbyte Storage Linux (Ubuntu) 64-bit OS

Min 1 Network card Make sure the network card is able to reach your DNS and time server. Our product makes heavy use of X.509 certificates, so proper DNS resolving and time synchronization are mandatory in order to make the product work.

Checklist before starting the actual installation:

Make sure you have the necessary resources on your virtual environment

Make a list of how many gateways you would like to deploy and which sites (subnets) it will protect Create the necessary DNS records for controller and gateways you will be using in the product and assign the correct IP’s to it

Make sure the appliance is able to reach an NTP server to do proper time synchronization

Warning!

The installation ISO is intended to do an automatic installation when being booted from. This means that all data on the disks will be erased automatically if you boot from the installation ISO

(3)

2. Create the first appliance

Once the VM is created, we attach the CZ-appliance ISO to the VM and select to boot from hard disk first and add DVD as second boot option. If the hard disk is still an empty disk, it will be skipped at first boot and the DVD will be chosen instead. Once the hard disk is portioned and the OS is installed, the VM will reboot from hard disk this time, and will be ready to be configured.

Important note!

The system works with an overlay read-only file system. Which means that any files or configuration that has changed manually will be removed after reconfiguring or rebooting the system. Please make sure you use the appliance UI in the controller to make additional changes after the first installation.

You will then see the following screen after the boot and first install process is been completed:

You should now use the interactive menu to configure the Controller details of which are in the manual.

http://help.cryptzone.com/adminguide/configuring-the-first-applianc.html

(4)

Using the Controller UI it is now possible to configure Gateways and LogServers. You can either simply enable one or both of these functions on the existing appliance you have just created or you can create new appliances for these functions. For help to continue using your existing appliance look here:

http://help.cryptzone.com/adminguide/adding-gateway-functionality.html

If you want to use a new appliance for these functions read on.

3. Add a subsequent Gateway (or LogServer) appliance

This process has been automated and is initiated by using a downloaded seed file from the Controller so before this step you MUST HAVE CONFIGURED YOUR CONTROLLER. Please see the AppGate XDP manual for how to do this. http://help.cryptzone.com/adminguide/adding-an-appliance.html. You will need to add an appliance to your collective and configure it. When you follow the instructions correctly you end up exporting a seed.json file which you will need in this step.

In order to install an additional gateway appliance, we create a new appliance similar to the first appliance installation. We create a new VM with the following specs:

Min 1 CPU

Min 4 Gbyte of memory 20 Gbyte Storage Linux (Ubuntu) 64-bit OS Min 1 Network card

We attach the DVD drive with the installation again, which does install the base appliance. This is exactly the same procedure as installing the first appliance.

(5)

But instead of provisioning a password and going to the interactive menu, we shutdown the appliance. You should have the seed file for this appliance that you exported to your local machine. You can rename this file to myname-seed.json or just leave it as seed.jason if you only have one of them. Create an ISO file with the seed file in the root directory of the ISO. Now attach this ISO to the primary master IDE controller.

At boot the system will look for this seed file and automatically configure itself.

Once booted, the system will now configure itself. It should now show a login prompt (although it can take a while before the full configuration is finished), instead of the prompt shown above, that allows you to login with “cz” and the fresh configured password you provided at download of the json file.

If the Controller and Gateway can communicate on their peer to peer connection, the final configuration will finish successfully. In order to check if the new gateway is now recognized and accepted by the controller you can check the dashboard. The new appliance should be online and the Gateway (or LogServer) service should be running.