INSTALLATION GUIDE. A10 Thunder TM Series vthunder for AWS

Transcription

1 INSTALLATION GUIDE A10 Thunder TM Series vthunder for AWS

2 2/18/2014 A10 Networks, Inc. - All Rights Reserved Information in this document is subject to change without notice. Patents Protection A10 Network products including all AX Series products are protected by one or more of the following U.S. patents and patents pending: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Trademarks The A10 logo, A10 Lightning, A10 Networks, A10 Thunder, acloud, ACOS, aflex, aflow, agalaxy, avcs, axapi, IDaccess, IDsentrie, IP to ID, Link Director, MultiLink Director, SoftAX, Thunder, the Thunder logo, VirtualN, and vthunder are trademarks or registered trademarks of A10 Networks, Inc. All other trademarks are property of their respective owners. Confidentiality This document contains confidential materials proprietary to A10 Networks, Inc. This document and information and ideas herein may not be disclosed, copied, reproduced or distributed to anyone outside A10 Networks, Inc. without prior written consent of A10 Networks, Inc. A10 Networks Inc. Software License and End User Agreement Software for all A10 Networks products contains trade secrets of A10 Networks and its subsidiaries and Customer agrees to treat Software as confidential information. Anyone who uses the Software does so only in compliance with the terms of the End User License Agreement (EULA), provided later in this document or available separately. Customer shall not: 1) reverse engineer, reverse compile, reverse de-assemble or otherwise translate the Software by any means 2) sublicense, rent or lease the Software. Disclaimer This document does not create any express or implied warranty about A10 Networks or about its products or services, including but not limited to fitness for a particular use and non-infringement. A10 Networks has made reasonable efforts to verify that the information contained herein is accurate, but A10 Networks assumes no responsibility for its use. All information is provided "as-is." The product specifications and features described in this publication are based on the latest information available; however, specifications are subject to change without notice, and certain features may not be available upon initial product release. Contact A10 Networks for current information regarding its products or services. A10 Networks products and services are subject to A10 Networks standard terms and conditions. Environmental Considerations Some electronic components may possibly contain dangerous substances. For information on specific component types, please contact the manufacturer of that component. Always consult local authorities for regulations regarding proper disposal of electronic components in your area. Further Information For additional information about A10 products, terms and conditions of delivery, and pricing, contact your nearest A10 Networks location, which can be found by visiting

3 Installation 5 Overview...5 Setting Up vthunder for AWS...8 Setting Up AWS VPC...8 Launching vthunder Instance on Amazon Web Services...9 Disable Source/Dest Checking...20 Configuring the Elastic IP...21 Accessing vthunder with CLI or GUI Configuring DHCP and the VIP in vthunder...23 Managing the License (BYOL Only)...24 Initial vthunder Configuration Login via CLI...26 Change the Admin Password...26 Save the Configuration Changes write memory...27 License Installation for BYOL Licenses Upgrading from Evaluation or Lab License to Production License (for BYOL) Related Documentation Documentation Updates...32 Providing Documentation Feedback of 34 Document No.: D /18/2014

4 Document No.: D /18/ of 34

5 Installation Overview Essential Setup Information Default vthunder management IP address: N/A (DHCP) SSH login is key-based and not password-based. Default admin username: admin and password: instance-id Default enable password: blank (none) Licensing: See License Installation for BYOL Licenses on page 27. Note: This guide describes how to install the 64-bit vthunder Application Delivery Controller (ADC) on Amazon Web Services (AWS). vthunder for AWS vthunder for AWS is a fully operational, software-only version of the ACOS load balancing device. vthunder is a virtual appliance, yet it retains most of the functionality available on the hardware-based ACOS appliances. Managing vthunder is the same as managing a hardware-based ACOS device, and vthunder has the same CLI configurations and GUI presentation. The networking configuration for vthunder is also similar to a hardware-based ACOS device. With the release of the 64-bit image, vthunder for AWS can support up to four virtual CPUs. Amazon Web Services Amazon Web Services is a leading cloud computing platform that enables businesses to move their network infrastructure to the cloud. Enterprises can set up virtual servers (or instances ), and other computing resources, in a virtual platform powered by customized Xen hypervisors. vthunder can be set up as a virtual instance in the AWS cloud and can be used to provide a robust load balancing solution. Virtual Private Cloud (VPC) is a service provided by Amazon Web Services. By using VPC, you can set up virtual subnets, with Elastic Cloud Compute (EC2) instances acting as real servers, thus gaining more control over how the network is set up. vthunder for AWS is supported for ACOS Release P3-AWS. Beginning with this release, the product name for the ACOS virtual appliance is changed from SoftAX to vthunder. This document uses the new name, but some file names, directory paths, and screenshots may still refer to SoftAX. In these cases, the instructions are still valid. 5 of 34 Document No.: D /18/2014

6 Figure 1 shows how vthunder fits into the AWS infrastructure. FIGURE 1 vthunder for AWS Prerequisites for Installing vthunder Before installing vthunder, you must first set up an account with Amazon Web Services. Creating this account will enroll you in the standard AWS services, such as Elastic Compute Cloud (EC2) and Virtual Private Cloud (VPC). You can create an AWS account with Amazon by navigating to the following URL, and following the onscreen instructions. Document No.: D /18/ of 34

7 Configuring vthunder Network Settings for Web GUI Access You can use two separate IP addresses to separate the different types of traffic. For example, one IP could be used for network traffic accessing the VIP, and the other IP could be used for SSH/GUI management traffic. However, it is also possible to use the primary interface IP to handle both network and management traffic. Since the primary IP of the first interface is used for both types of traffic, you must configure the vthunder instance to use one port (such as port 80) for VIP traffic and a different port for Web-based GUI traffic (port 8080 for HTTP and port 8443 for HTTPS). This is necessary to separate the two types of traffic. You can use the commands below to perform these configurations. web-service server web-service port 8080 web-service secure-server web-service secure-port 8443 Note: In order to avoid port conflicts, make sure the vthunder VIP uses a different port than the one used to access the vthunder GUI interface. Configuring Elastic Network Interfaces (ENIs) vthunder can have more than one Elastic Network Interface (ENI). For information about Elastic Network Interfaces, please refer to Amazon s documentation: The first ENI is created by default during installation. However, the second ENI must be added manually. Ethernet 1 Data interface (default) Ethernet 2 Data interface (manual) Note: The management interface is not physically separate, but is instead carried in-band, as the first interface. In typical deployments in the VPC, one of the data interfaces is connected to the server farm, and the other data interface is connected to the clients. One-armed deployments have only one interface and therefore use a different topology. These deployments are not discussed in this document. Feature Support vthunder for AWS supports many of the same features as the Thunder and AX Series hardware-based models. However, the following features are not supported: Transparent (Layer 2) deployment Direct Server Return (DSR) configurations 7 of 34 Document No.: D /18/2014

8 SmartNAT, which is typically used to automatically create NAT mappings using virtual protocol when the standard NAT pools can not support any more mappings High Availability (HA) Layer 3 Virtualization (L3V) IPv6 migration features (Large-scale NAT, DS-Lite, NAT64/DNS64) Jumbo Frame Hardware-specific features (for example, hardware-based HTTP/HTTPS compression and hardware-based SSL acceleration) Role-Based Administration (RBA). Only the shared partition is supported. Private partitions are not supported. AX Virtual Chassis System (avcs) Port mirroring Trunking (802.1Q trunking) SSL Intercept and SSL Forward Proxy (requires an SSL ASIC) Setting Up vthunder for AWS This section describes the process of installing a vthunder instance in Amazon s AWS environment. The first task before launching the vthunder instance is to set up the virtual network within Amazon s Virtual Private Cloud (VPC). Setting Up AWS VPC The process of setting up a Virtual Private Cloud (VPC) in AWS consists of the following steps: 1. Set up the Virtual Private Cloud (VPC). 2. Set up the VPC gateway. 3. Set up the subnets within the VPC. 4. Configure the routing table. 5. Configure the Access Control List and other security settings. Note: Check the VPC Route Table. It should be associated with all the relevant subnets and should have a default route pointing to the VPC gateway. Document No.: D /18/ of 34

9 Note: Check the VPC ACL. It should be associated with all the relevant subnets, and the rules should allow SSH and your virtual ports. For more details on setting up AWS VPC, please refer to the Amazon Virtual Private Cloud Getting Started Guide, which can be accessed at the following URL: Launching vthunder Instance on Amazon Web Services To launch a vthunder instance on AWS, follow the instructions below: 1. Access AWS and log in using your standard credentials. FIGURE 2 Sign in to AWS Account 2. Search for the A10 Networks vthunder instance. Choose the AMI 3. Search for the A10 vthunder AMI by entering A10 vthunder in the Search AWS Marketplace field. 4. Based upon your bandwidth needs, select the desired AMI file from the following list of AMI files: A10 Networks vthunder - 10 Mbps A10 Networks vthunder - 50 Mbps A10 Networks vthunder Mbps 9 of 34 Document No.: D /18/2014

10 A10 Networks vthunder Mbps A10 Networks vthunder Mbps A10 Networks vthunder - BYOL Note: BYOL is a permanent license. This option is recommended if you prefer to own the license rather than being charged licensing fees on an hourly basis. Please contact A10 Sales for more information about the different pricing structures. 5. In the window that appears, click the Continue button. FIGURE 3 Ordering a vthunder Instance 6. Next, click the Launch with EC2 Console tab, and then click Accept Terms, as shown below. FIGURE 4 Select the Launch with EC2 Console Tab 7. A confirmation message appears similar to the one shown below. Document No.: D /18/ of 34

11 FIGURE 5 Order Confirmation Message This message will be sent to your account in order to confirm the details of this transaction. 8. Click on the Launch with EC2 Console button, as shown below. Select the AMI file that corresponds to the region where your application servers are located. FIGURE 6 Select an AMI File Near Your Application Servers When you click the Launch with EC2 Console button, this will open the EC2 console in a separate window. From this window, you can select the vthunder instance type. 11 of 34 Document No.: D /18/2014

12 Choose Instance Type 9. By default, the Micro instances tab is selected. However, it is recommended that you click the All instance types tab (at left) and select an instance of m1.large or higher, as this will offer superior network performance. 10. Click Next: Configure Instance Details to proceed. FIGURE 7 Select Instance Size of m1.large (or higher) Configure the Instance 11. You can configure the new vthunder instance details as follows: a. Retain the default values that appear in the window below, with the exception of the Network and Subnet parameters. For these values, you must select the correct VPC. b. The VPC and subnet should have been set up when the instance was created. (For details on setting up VPCs, please see Amazon s tutorials at ) Document No.: D /18/ of 34

13 FIGURE 8 Configure the Instance Details When you select a value for the Network and Subnet, a separate set of fields appears, which allow you to configure eth0, as shown Figure 9 below. Note: Note: Make sure all the interfaces are in different subnets. Make sure the primary interface (eth0) is in the public Internet-facing subnet for management and VIP traffic. 12. Next, click the Add Device button. The options for configuring eth1 appear. a. Select the network interface and subnet within the associated VPC. The eth0 should use a different subnet than eth1. b. In the Primary IP field, enter the desired IP, which should be in your designated subnet. FIGURE 9 Configure the Instance Details for Additional Interface (eth1) 13 of 34 Document No.: D /18/2014

14 Note: Although DHCP is used to assign an IP address to the network interfaces, by entering a specific IP address in this field, you can ensure that the DHCP server assigns the same IP address every time the vthunder instance is rebooted. Doing this helps avoid having to rewrite the axapi scripts, which contain IP addresses that could keep changing. 13. Click Next: Add Storage to proceed. 14. In the Add Storage window, accept the default values. FIGURE 10 Review Details in Add Storage Window 15. Click Next: Tag Instance to proceed. 16. Next, the Tag Instance window appears. From here, you can assign a name to the instance or to other aspects of the vthunder instance. For example, you could enter a name for this instance in the Value field to make this instance easier to find if you have many instances. Keep in mind that this is an optional setting and is intended for ease of use. Document No.: D /18/ of 34

15 FIGURE 11 Tag the Instance 17. Click Next: Configure Security Group to proceed. 18. The Configure Security Group window appears. FIGURE 12 Configure the Security Group 19. You can configure the security group settings as follows: a. Choose a pre-configured (default) security group, OR b. Create your own security group. 15 of 34 Document No.: D /18/2014

16 If creating a new security group, it is recommended that you use the following settings: 20. Click Review and Launch to proceed. Review Your Configuration Changes 21. The Review Instance Launch page appears. Verify the settings, and if everything appears in order, click the Launch button to launch the vthunder instance. FIGURE 13 Review Settings for this vthunder Instance 22. A window similar to the one shown below appears, allowing you to select an existing key pair or create a new key pair if one does not already exists. Document No.: D /18/ of 34

17 FIGURE 14 Creating a New Key Pair 23. Click the drop-down menu and select one of the following from the drop-down menu: a. Choose an existing key pair, OR b. Create a new key pair (you will need to do as follows) Enter a name in the Key pair name field Click Download Key Pair Note: If you have questions about setting up the key pairs, or if you have trouble using the SSH key to log in, please review Amazon s EC2 documentation, which is available at the following link: Click Launch Instance. 25. The Review Instance Launch page appears, as shown in Figure 15 below. 17 of 34 Document No.: D /18/2014

18 FIGURE 15 Reviewing Instance Launch 26. Click the Launch button to proceed. The Launch Status window appears, indicating that the instance has launched. FIGURE 16 Launch Instance Confirmation Page 27. Click the View Instances button (at lower right) to monitor the running vthunder instance. Figure 17 shows the new vthunder instance just created in this example. Document No.: D /18/ of 34

19 FIGURE 17 Monitor the New vthunder Instance From here, you can view information about all of your instances or establish a connection to the instance. For more information, please see the link in the Amazon EC2: User Guide link under the helpful resources section of this page. If desired, you can click on any of the tabs near the bottom of the window shown in Figure 17, which are highlighted with a red oval. Just select the checkbox to the left of the name of the vthunder instance and then the tabs will appear below. Click the tabs to perform the following operations: View details for an instance Create a status check Set up an alarm based on CPU utilization rates, disk usage, or other parameters Edit the tags for an instance 19 of 34 Document No.: D /18/2014

20 Disable Source/Dest Checking To disable Source/Dest Checking, do the following: 1. Navigate to the EC2 dashboard (at left) and then scroll down and click the Network Interfaces link. 2. Select the desired Elastic Network Interface (ENI) and then click the Actions dropdown menu and select Change Source/Dest Check, as shown below. FIGURE 18 Select the ENI The selected Elastic Network Interfaces are displayed in a dialog box, as shown below. FIGURE 19 Change Source/Dest Checking (Disabled) 3. For the selected ENI, select the Disabled radio button for Source/Dest Checking and click Save. Note: There are two elastic interfaces associated with this instance. You must disable the Source/Destination Check for both of them. 4. Click Save to store your changes. Document No.: D /18/ of 34

21 Configuring the Elastic IP The next step is to configure the Elastic IP as an external IP: 1. In the AWS Management Console, click the Elastic IPs link (under Network & Security), and then click the Allocate New Address button at the upper left corner. FIGURE 20 Allocate New Address The following Allocate New Address screen appears: FIGURE 21 Confirming Allocation of New Address 2. Click VPC from the drop-down menu and then click Yes, Allocate. 3. The allocated elastic IP appears in a table. 4. Right-click the allocated elastic IP and then select Associate from the drop-down menu to display the Associate Address screen. 21 of 34 Document No.: D /18/2014

22 FIGURE 22 Assigning an Elastic IP to the ENI 5. Select the VPC Instance from the drop-down. 6. Select the corresponding private IP address. 7. Click the Yes, Associate button, located at the lower right-most corner. 8. The screen shows the association between private and elastic IP. FIGURE 23 Elastic IPs (with association) Document No.: D /18/ of 34

23 9. Connect to the Elastic IP using SSH, as discussed in the section, Accessing vthunder with CLI or GUI on page 23. Accessing vthunder with CLI or GUI This section shows how to log onto the vthunder with SSH (CLI) or HTTPS (GUI), and how to obtain and install your product license. The default management IP address will be the elastic IP associated with the IP of the first interface. SSH should use the key-pair created during launch Default enable password required for configuration access, blank (none) When accessing the web via HTTP, the default value is port 80, but you must specify port 8080, as configured in Configuring vthunder Network Settings for Web GUI Access on page 7. Default admin username and password for web access: admin, instance-id Configuring DHCP and the VIP in vthunder Configuring DHCP 1. SSH to the Elastic IP of the vthunder instance. 2. Use the following CLI commands to force the interfaces to use the private IP that was assigned by DHCP: interface ethernet 1 ip address dhcp interface ethernet 2 ip address dhcp 3. Next, use the following commands to configure the vthunder to use the private IP (assigned to the interface by DHCP) as the VIP: slb virtual-server v1 use-if-ip ethernet 1 port 80 tcp service-group http-sg1 23 of 34 Document No.: D /18/2014

24 4. To configure additional private IPs, (which are necessary for adding VIPs to your vthunder instance), do the following: a. In the AWS management console, add additional private IPs on the client-side interface. Simply right-click the instance, and then select Manage Private IP addresses from the drop-down menu. b. Associate the Elastic IPs with the recently-added private IPs. c. From within vthunder, directly configure the private IP as a VIP using the following CLI commands: slb virtual-server v port 80 tcp service-group http-sg2 Managing the License (BYOL Only) This section applies to the process of managing the Bring Your Own License (BYOL). If you have already purchased a vthunder instance directly from A10 Networks, the license must be installed using the GUI, as described below. USING THE GUI TO INSTALL THE BYOL LICENSE To install the BYOL license using the GUI, do the following: Note: You must first configure the web port settings. To do so, please see Configuring vthunder Network Settings for Web GUI Access on page In a web browser, log in and navigate to Config > System > Maintenance > License. 2. Copy the entire host ID. The host ID is the hexadecimal string to the right of the Host ID field name. 3. Include the host ID in an to the following address: vthunder@a10networks.com 4. Install the license: a. Navigate to Config > System > Maintenance > License and click Install. b. Copy and paste the entire text of the license into the License field and click Update. Document No.: D /18/ of 34

25 USING THE CLI TO INSTALL THE BYOL LICENSE To install the BYOL license using the CLI, do the following: 1. Establish an SSH session. 2. In an SSH session, enter the commands shown here: vthunder>enable Password:(just press Enter on a new system) vthunder#config vthunder(config)#show license 3. Include the output in an and send to the following address: vthunder@a10networks.com 4. Install the license: vthunder#import license softax-lic1.txt tftp:// /licenses/softax-lic1.txt vthunder#show license Feature Installed: bandwidth : 300 Mbps Version: 1.01 Exp date: permanent Host ID: 5172DE29D49EE3C101C7A0CD54FB8A0B6EC92CEE 25 of 34 Document No.: D /18/2014

26 Initial vthunder Configuration This section describes how to configure IP connectivity on the vthunder management and data interfaces. Note: To display a list of commands for a level of the CLI, enter a question mark (? ) and press Enter. You can display the list separately for each level. For syntax help, enter a command or keyword followed by a space, then enter? then press Enter. This works for commands with sub-commands also. Login via CLI 1. Log into vthunder with the default username admin and the key-pair associated with this instance. 2. Enable the Privileged EXEC level by typing enable and pressing the Enter key. There is no default password to enter Privileged EXEC mode. vthunder>enable Password:(just press Enter on a new system) vthunder# 3. Enable the configuration mode by typing config and pressing Enter. vthunder#config vthunder(config)# 4. It is strongly suggested that a Privileged EXEC enable password be set up as follows: vthunder(config)#enable-password newpassword Change the Admin Password A10 Networks recommends that you change the admin password immediately for security. vthunder(config)#admin admin password newpassword vthunder(config)# The vthunder is now network accessible for configuration under the new IP address and admin password. Document No.: D /18/ of 34

27 Save the Configuration Changes write memory Configuration changes must be saved to system memory to take effect the next time the vthunder is powered on. Otherwise, the changes are lost if the vthunder virtual machine or its host machine are powered down. vthunder(config)#write memory Building configuration... [OK] To write the current configuration to system memory: License Installation for BYOL Licenses The vthunder instance with a BYOL AMI will not pass any user traffic until the license has been installed. The maximum throughput of vthunder for AWS instance is variable and depends on which license has been purchased. To obtain a BYO license, send an containing the vthunder license host ID string to A10 Networks at vthunder@a10networks.com. The host ID is a 40-digit hexadecimal number. For example: 5172DE29D49EE3C101C7A0CD54FB8A0B6EC92CEE Note: The license host ID is different from the user-configurable system host name. The license has the following format: #Please Do not delete this comment line. INCREMENT bandwidth atennetw 1.01 permanent uncounted \ VENDOR_STRING=300 \ HOSTID=A10_HOSTID=5172DE29D49EE3C101C7A0CD54FB8A0B6EC92CEE \ ISSUER="My Corporation" ISSUED=2-aug-2010 START=1-aug-2010 \ SIGN="007F 602F 0598 B789 3FDB 711F 5541 D200 05E5 8F \ 1423 C8B3 FE1C 0AA9" Once you have received the license from A10 Networks, you can install it using the GUI or CLI. 27 of 34 Document No.: D /18/2014

28 USING THE GUI To obtain the BYOL license: 1. Select Config > System > Maintenance > License. 2. Copy the entire host ID. The host ID is the hexadecimal string to the right of the Host ID field name. 3. Include the host ID in an to the following address: To install the license: 1. Select Config > System > Maintenance > License. 2. Click Install to display the License input field. 3. Copy and paste the entire text of the license into the License field. 4. Click Update. USING THE CLI To obtain the BYOL license: 1. Access the Privileged EXEC (enable) level or any configuration level of the CLI. 2. Enter the following command: show license 3. Copy the entire output. 4. Paste the output into the body of an and send it to the following address: To install the BYOL license: 1. Access the Privileged EXEC (enable) level or any configuration level of the CLI. 2. Save the license file sent by A10 Networks onto a server that can be locally accessed over the network by the vthunder. 3. Enter the following command to install the license: import license file-name url The file-name is the name of the license file received from A10 Networks. The url specifies the file transfer protocol, username (if required), and directory path. You can enter the entire URL on the command line or press Enter to display a prompt for each part of the URL. If you enter the entire URL and a password is required, you will still be prompted for the password. To enter the entire URL: Document No.: D /18/ of 34

29 tftp://host/file 4. Enter the following command to verify license installation: show license CLI Example The following commands log onto the CLI, access the Privileged EXEC level, and display the license host ID: Last login: Mon Aug 2 07:58: [type? for help] vthunder>enable Password:******** <blank by default> vthunder#show license uid 5172DE29D49EE3C101C7A0CD54FB8A0B6EC92CEE The following command installs the license: vthunder#import license softax-lic1.txt tftp:// /licenses/softax-lic1.txt vthunder#show license Feature Installed: bandwidth : 200 Mbps Version: 1.01 Exp date: permanent Host ID: 5172DG29E49EE3C102C7A0CD54FB8A0B6EC92CEE The following command verifies license installation: 29 of 34 Document No.: D /18/2014

30 Upgrading from Evaluation or Lab License to Production License (for BYOL) Thunder Series vthunder for AWS Installation Guide Note: Older ACOS releases offered a free, limited-time Evaluation License. In later releases, the Evaluation License has been discontinued, and A10 offers a low-cost Lab License, which has no expiration date. Please contact your A10 sales representative for more information. If you are using a BYOL Evaluation License, at the end of the evaluation period you will be required to upgrade to a Production License. This process will convert the evaluation vthunder copy to a production copy without the need to reinstall vthunder. You can request a Production License by sending an containing the vthunder license host ID string to A10 Networks. You can obtain the host ID string and install the production license using the CLI. USING THE CLI To obtain the Production License using the CLI: 1. Establish a connection to the device using the management interface. 2. Access the Privileged EXEC (enable) level or any configuration level of the CLI. 3. Enter the following command: show license 4. Copy the entire output and paste it into the body of an Send the to the following address: vthunder@a10networks.com To install the Production License from the CLI: 1. Access the Privileged EXEC (enable) level or any configuration level of the CLI. 2. Save the Production License file sent by A10 Networks onto a server that can be locally accessed over the network by the vthunder. 3. Enter the following command to install the license: import license file-name url The file-name is the name of the license file received from A10 Networks. The url specifies the file transfer protocol, username (if required), and directory path. You can enter the entire URL on the command line or press Enter to display a prompt for each part of the URL. If you enter the entire URL and a password is required, you will still be prompted for the password. To enter the entire URL: tftp://host/file ftp://[user@]host[:port]/file Document No.: D /18/ of 34