RackConnect User Guide

RackConnect User Guide Updated: November 8, 2011

RackConnect User Guide Page 2 of 15 DISCLAIMER This RackConnect User Guide (the Guide ) is for informational purposes only and is provided AS IS. The information set forth in the Guide is intended as a guide and not as a step-by-step process, and does not represent an assessment of any specific compliance with laws or regulations or constitute advice. We strongly recommend that you engage additional expertise in order to further evaluate applicable requirements for your specific environment. RACKSPACE MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE ACCURACY OR COMPLETENESS OF THE GUIDE AND RESERVES THE RIGHT TO MAKE CHANGES TO SPECIFICATIONS AND PRODUCT/SERVICES DESCRIPTION AT ANY TIME WITHOUT NOTICE. RACKSPACE RESERVES THE RIGHT TO DISCONTINUE OR MAKE CHANGES TO ITS SERVICES OFFERINGS AT ANY TIME WITHOUT NOTICE. USERS MUST TAKE FULL RESPONSIBILITY FOR APPLICATION OF ANY SERVICES AND/OR PROCESSES MENTIONED HEREIN. EXCEPT AS SET FORTH IN RACKSPACE GENERAL TERMS AND CONDITIONS, CLOUD TERMS OF SERVICE AND/OR OTHER AGREEMENT YOU SIGN WITH RACKSPACE, RACKSPACE ASSUMES NO LIABILITY WHATSOEVER, AND DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO ITS SERVICES INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. Except as expressly provided in any written license agreement from Rackspace, the furnishing of this document does not give you any license to patents, trademarks, copyrights, or other intellectual property. Rackspace, Rackspace logo, Fanatical Support, RackConnect, RackConnect Design, MyRackspace and other Rackspace marks mentioned in this document are either registered trademarks or trademarks of Rackspace US, Inc. in the United States and/or other countries. All other product names and trademarks used in this Guide are for identification purposes only to refer to either the entities claiming the marks and names or their products, and are property of their respective owners. We do not intend our use or display of other companies tradenames, trademarks, or service marks to imply a relationship with, or endorsement or sponsorship of us by, these other companies.

RackConnect User Guide Page 3 of 15 TABLE OF CONTENTS OVERVIEW... 4 What is RackConnect?... 4 What new features does RackConnect 2.0 introduce?... 4 What requirements are there for implementing RackConnect in my environment?... 5 How do I get started with RackConnect?... 5 IMPORTANT TERMS... 5 GETTING STARTED... 6 Setting up a RackConnect Configuration... 6 Associating your Cloud account with your RackConnect Configuration... 7 Upgrading a current RackConnect 1.0 Configuration to RackConnect 2.0... 7 RACKCONNECT TECHNICAL DESCRIPTION... 8 How does RackConnect work?... 8 MANAGING YOUR RACKCONNECT CONFIGURATION... 8 Accessing RackConnect management interface... 8 Managing Network Policies with RackConnect... 9 Direct Access to Cloud Servers via Public IP Address... 10 Using Load Balancers with RackConnect... 10 Using Cloud Load Balancers with RackConnect... 11 WINDOWS CORE SERVICE LEVEL IMAGES... 12 RACKCONNECT SUPPORT... 13 RACKCONNECT FREQUENTLY ASKED QUESTIONS... 13 CLOUD SERVER IMAGE COMPATABILITY... 14 KNOWN ISSUES... 15 REVISION HISTORY Date November 8, 2011 Revision Comments 1.0 First release of User Guide

RackConnect User Guide Page 4 of 15 OVERVIEW What is RackConnect? RackConnect gives you the freedom to choose the best platform for your applications by unifying the breadth of the Rackspace portfolio into a single solution. RackConnect is a unique solution designed for customers who require the flexibility and elasticity of the cloud, as well as the enhanced security and performance characteristics of traditional hosting the best of both worlds. In essence, RackConnect enables customers to realize the power of Hybrid Hosting. Choose an F5 BIG-IP Local Traffic Manager or a Cisco ASA firewall to connect your traditional hosted infrastructure to the Rackspace Cloud Cloud Servers can be automatically added to your F5 BIG-IP Local Traffic Manager load balancer, enabling you to scale on demand Connect to Rackspace with an encrypted VPN tunnel, connecting the Rackspace Cloud with your datacenter or existing IT infrastructure Define Network Security Policies in the customer portal, which are automatically applied and managed across your firewall, load balancer, and Cloud Servers Add Cloud Files for easily scalable storage What new features does RackConnect 2.0 introduce? The latest version of RackConnect enables additional automation and security features, including: Cloud Servers are automatically configured for connectivity to the dedicated environment Cloud Servers can be automatically load balanced based on server name matching or metadata User Interface in MyRackspace Portal o Set Network Policies o Manage Cloud Servers o View Configuration Details o View Automation Tasks and Event Logs Managed Network Security Policy o Set it once, applied automatically o Manages dedicated firewall, load balancer, and Cloud Servers Managed software firewalls for Cloud Servers o IPTables for Linux o Advanced Firewall for Windows

RackConnect User Guide Page 5 of 15 Note: RackConnect adds a service-level user account to each Cloud Server that is in a RackConnect solution. This is to enable RackConnect to automate network connectivity and software firewalls on Cloud Servers as part of the RackConnect solution. This account is only for use by the automated system, not by actual Rackers (support techs). What requirements are there for implementing RackConnect in my environment? Network Device: The current RackConnect automation should run with any Cisco ASA firewall (5505 Security+ or better) or F5 Big-IP load balancer. You need one of these devices in your managed hosting configuration. If you already have one, there is no additional charge for RackConnect. Datacenter: RackConnect is currently available in our Chicago (ORD), Dallas (DFW), and London (LON3) datacenters. Your dedicated managed hosting and Cloud Servers must be located in the same datacenter. How do I get started with RackConnect? Simply contact your dedicated account team and they will get you started. If you are new to Rackspace, contact us at www.rackspace.com for chat or email, or give us a call at 800.961.2888. IMPORTANT TERMS RackConnect Configuration - represents a deployment of the RackConnect solution. The configuration is comprised of your Edge and Connected physical network devices, along with one or more Cloud accounts that you associate with the configuration. Edge Network Device - in your configuration is the outermost network device that is specifically for your environment. This is typically a firewall, but can also be a load balancer in certain deployment scenarios. Connected Network Device - is the device in your configuration that has a physical connection to our Cloud network. This device can be a firewall, a load balancer, in certain cases; it will be the same device as the Edge Network Device. Network Policy: a Network Policy defines access that you wish to have applied for one of five RackConnect traffic scenarios: Traffic from Cloud Servers to Dedicated Traffic from Cloud Servers to the Internet Traffic from Cloud Servers to Cloud Servers (for example, traffic between a web tier and an application tier, both hosted on Cloud Servers) Traffic from Dedicated to Cloud Servers Traffic from the Internet to Cloud Servers Network Policies provide you the ability to match based on certain criteria (hosts, networks, Cloud Server name matches, etc.) and can limit access to specific protocols and ports (or port ranges).

RackConnect User Guide Page 6 of 15 Network Policy Template: a Network Policy Template provides an easy way of getting started with RackConnect by providing choices of some of our most common RackConnect Network Policy sets (for example, allow all access between a Dedicated environment and all Cloud Servers belonging to the associated Cloud account). The Basic Access Template provides 2 clicks to be up and running in your environment, with unrestricted access between all of your devices in dedicated and cloud. GETTING STARTED New to Rackspace? Currently only using our Cloud services? Contact our sales team at 800.961.2888 for assistance in setting up a Dedicated hosting environment to take advantage of RackConnect. Setting up a RackConnect Configuration 1. Contact your dedicated Account Manager or Account Management Team and let them know you would like to get RackConnect set up on your environment. They will get the process started by having our network engineers assess your configuration for RackConnect compatibility and readiness. a. If you don t yet have a RackConnect compatible device, your sales and account team will work with you to upgrade your environment. b. If you do have a compatible device, your account team will assess your device for RackConnect readiness (software versions, an available physical interface, etc.). Once the device has passed the qualification checks, the RackConnect implementation process will start. 2. At the start of the RackConnect implementation process, you ll receive a ticket in the MyRackspace Portal that outlines the steps which will be completed to get your environment ready for RackConnect. a. At the time you receive the ticket, you will already have access to the RackConnect management interface in the MyRackspace Portal. Simply navigate to Network > RackConnect from the main menu to review your configuration details, track the status of your implementation, and get started setting up your Cloud account(s) and Network Policies (more on that in just a moment). b. While you re getting acquainted with the new features in MyRackspace, our RackConnect engineers will be hard at work getting the physical cabling run to connect your network device to our Cloud network, as well as putting the necessary configuration in place on your device to support the RackConnect automation. 3. To help keep the RackConnect implementation process moving as quickly as possible, we encourage you to associate an existing Cloud account to your RackConnect Configuration. If you do not already have an existing Cloud account, you can set one up via the easy online signup process. See below for instructions on associating your Cloud account and completing the setup of your Network Policies.

RackConnect User Guide Page 7 of 15 4. Once we have completed the necessary steps and your RackConnect Configuration is ready to use (typically within 3-5 business days of receiving the ticket in step 2 above) you will receive an additional update in the ticket letting you know that the implementation is complete. To use RackConnect, you ll need to make sure that you ve completed the process detailed below for at least one Cloud account and you ll be on your way to experiencing the best of both worlds! 5. For videos demonstrating steps in this process, including an overview of the RackConnect portal interface, creating Network Policies, and adding a Cloud account to RackConnect, visit the documentation section of MyRackspace (https://my.rackspace.com/csx/community/rackconnect). Associating your Cloud account with your RackConnect Configuration 1. To associate a Cloud account with your RackConnect configuration you must first ensure that it is linked to your Dedicated account. This can be completed via https://my.rackspace.com/portal/cloudaccount/list (Products > Rackspace Cloud > Cloud Accounts). From that screen, you can link either an existing account or sign up for a new account. 2. After linking your Cloud account to your Dedicated account, click the Add to RackConnect link and select the appropriate RackConnect Configuration to associate it with. (In most cases, you will only have one (1) RackConnect configuration). 3. After establishing the association, we will begin the process of validating the provisioning region for both Cloud Servers and Cloud Files, checking that they match the region (aka Datacenter location) of your Dedicated environment. If there are any discrepancies, a RackConnect engineer will work with you to resolve them. You can track the status of these steps by selecting the newly associated Cloud account under the RackConnect management console and clicking on the Tasks tab. 4. Setup your Network Policies to define the access that you wish to allow between your Cloud Servers, your Dedicated environment, and the Internet. This can be completed by selecting the Cloud account under the RackConnect management console and selecting the Network Polices tab. You can also use one of the available Network Policy Templates for an easy way to get started. Important: Do not create any servers on your Cloud account until you receive confirmation that your Cloud account is setup in our automation system and that your RackConnect Configuration implementation is complete (if this is a new Configuration). Any servers created prior to these steps being complete will not be able to participate in your RackConnect Configuration and will need to be rebuilt after the steps are complete, if you wish to use them with RackConnect. Upgrading a current RackConnect 1.0 Configuration to RackConnect 2.0 Upgrades from RackConnect 1.0 to RackConnect 2.0 are not yet available. We are working to make an upgrade process available in the near future and will be contacting all existing RackConnect customers with additional details as soon as an upgrade process is available.

RackConnect User Guide Page 8 of 15 RACKCONNECT TECHNICAL DESCRIPTION How does RackConnect work? RackConnect starts out by connecting an available physical interface on your network device to the Cloud internal network. Once a new Cloud Server is created, RackConnect automation will get started configuring that server to remove the public interface, and route all traffic through the private (a.k.a. ServiceNet) interface (10.x.x.x) towards your network device as the default gateway. The automation will then proceed to adjust access lists on the firewall, load balancer (if applicable), and Cloud Server software firewalls based on your pre-defined Network Policies. Without RackConnect : Traffic is routed out through internet from Dedicated to Cloud. With RackConnect : Traffic is routed via Dedicated network device to Cloud. RackConnect automation keeps dedicated configuration and Cloud Servers secure. MANAGING YOUR RACKCONNECT CONFIGURATION Accessing RackConnect management interface You can access the RackConnect management interface from the MyRackspace Portal in the same place you can administer your cloud accounts. Simply click on Products and Rackspace Cloud, then you can click on the RackConnect section header to see your RackConnect configuration. From there, you can do multiple things such as adding a cloud account to a RackConnect Configuration, viewing public IP addresses for your connected Cloud Servers, setting Network Policies for your Cloud Servers, and viewing the progress of all automation.

RackConnect User Guide Page 9 of 15 Managing Network Policies with RackConnect One of the main benefits of utilizing RackConnect is that you no longer have to set firewall rules on your individual cloud servers - you can modify network connectivity between all servers (cloud and dedicated) and the internet by adding Network Policies. A Network Policy defines access that you wish to have applied for one of five RackConnect traffic scenarios: Traffic from Cloud Servers to Dedicated Traffic from Cloud Servers to the Internet Traffic from Cloud Servers to Cloud Servers (for example, traffic between a web tier and an application tier, both hosted on Cloud Servers) Traffic from Dedicated to Cloud Servers Traffic from the Internet to Cloud Servers Network Policies provide you the ability to match based on certain criteria (hosts, networks, Cloud Server name matches, etc.) and can limit access to specific protocols and ports (or port ranges). Network Policies are configurable under each individual cloud account in the RackConnect management interface, and can be added to control access between your Cloud Servers, your Dedicated environment, and the Internet. To manage your Network Policies, simply select the Cloud account you wish to customize in the RackConnect management interface, click on the Network Policies tab, and follow the on-screen instructions to add and remove Network Policies. When defining a policy, type a Policy Name, choose the Access Scenario (one of the five listed above), a Source Type, a Destination Type, and Destination Protocol. These fields are context sensitive. That means that based on the Access Scenario you choose, the options for the other tabs can change.

RackConnect User Guide Page 10 of 15 When choosing All, this means all hosts within a network or account. When choosing Server Name Match, the text you enter is the text that will get matched. It is NOT case sensitive, and you do NOT need to enter any wildcards. For example, if you enter Web, this would match a Cloud Server named WEB001, as well as Mywebserver. Server ID Match is an exact match of the Server ID from the Cloud Servers API. If you start typing the server name, a dropdown will appear where you can select the server and it will populate the server ID for you. When choosing Network you can define a network and subnet that will include all IP s within that subnet. Enter it in the format: xxx.xxx.xxx.xxx/xx using CIDR notation (for example, 172.16.1.0/24 enters the entire 172.16.1.0 class C network, which corresponds to 172.16.1.0 with a subnet mask of 255.255.255.0). When choosing Host, enter the IP address of the host you are defining. From the Network Policy screen, you also have the ability to apply a Network Policy Template. Network Policy Templates provide you a quick way to get started using RackConnect. Review the description for each template for details on the type of access it will grant within your environment. Any time you adjust a Network Policy the automation status indicator icon will show you when the Network Policy is being deployed (or removed) and when the changes are complete. You can also track more details on the status via the Tasks tab. Note that currently you will need to refresh the page in MyRackspace to view updated status indicators. Direct Access to Cloud Servers via Public IP Address RackConnect 2.0 automatically assigns a public IP address from your Dedicated environment to each of your Cloud Servers, and adds the appropriate translation (NAT) to your Edge Network Device. Once the IP address is assigned, you will also notice that querying the Cloud Servers API or viewing the server in the Control Panel will show you the newly added public IP. It is important to disregard the initial public IP address that was assigned to your server at build time after the RackConnect automation completes, that IP address is no longer used. You must explicitly create one or more Network Policies in order to directly access your Cloud Servers from the Internet via their public IP address. By default, the policy will not allow inbound access from the Internet to your Cloud Servers, even if you select the Basic Access Network Policy Template. (The one exception to this would be any rules on the outside/external access list of your Edge Network Device that allow requests destined for any public IP through on any ports or protocols). Using Load Balancers with RackConnect When leveraging your Cloud Servers to host an application that scales up and down (e.g. the web tier of an application), it is important to have a method for adding and removing Cloud Servers from their associated load balancer pool(s). If you are using an F5 Big-IP Local Traffic Manager with RackConnect, you can specify the load balancer pool name that a Cloud Server should be placed into upon creation.

RackConnect User Guide Page 11 of 15 When you delete the Cloud Server, the server will automatically be removed from the load balancer pool. With RackConnect 2.0, there are two ways that you can have your Cloud Servers automatically associated with one or more load balancer pools: Option 1 - Metadata: When creating a Cloud Server, leverage metadata to specify the pool(s) the Cloud Server should be associated with; Metadata Key: Metadata Value: RackConnectLBPool (exact name of load balancer pool as defined on the load balancer to add your server to; semi-colon separated list if more than one pool) Option 2 Name Match: Before spinning up your Cloud Servers, provide us with your preferred name and the pool(s) to associate with your Cloud Servers. Currently, you must configure this via a ticket request to your Support team. In the future, we are planning to offer you the ability to manage these associations via the MyRackspace Portal. Regardless of which option you select, please note: It is important to verify that an appropriate health check has been configured for members of the load balancer pool being used. The health check should confirm that the website or application is fully ready to accept end-user traffic, as the server may be added almost immediately after creation (but before the OS has loaded, etc.) depending on the timing of the automation. For example, it would be advisable to use a URL content check versus a TCP port check to confirm that a web application is ready to accept end-user requests. The service port for each member of the load balancer pool must match or the automation will not be able to determine which service port should be utilized. (For this same reason, there should always be at least one member present in the pool.) If a common service port cannot be determined, a notification will be routed to your Support team for manual intervention. To get the name of one or more of your load balancer pools, please contact your Support team. Using Cloud Load Balancers with RackConnect You can use Cloud Load Balancers with RackConnect by following these steps. Create an Internet to Cloud Network Policy. Set the Source Type to Network. Use 10.xxx.xxx.xxx/xx as the source network. o For the DFW region, use 10.183.250.0/23 o For the ORD region, use 10.183.252.0/23

RackConnect User Guide Page 12 of 15 o For the LON region, use 10.190.254.0/23 Set the Destination Type, Destination Protocol, and Destination Port or Port Range to specify the resources you would like Cloud Load Balancer to access. WINDOWS CORE SERVICE LEVEL IMAGES The following information applies only to Core service level Cloud accounts. Cloud accounts leveraging our Managed service level are not affected by the information contained in this section. If you are using Windows Cloud Servers on a Core Service Level account with RackConnect, please take note of the following: If you typically use the following image use this image instead for RackConnect 2.0 Image ID: 28 Image ID: 30 Image Name: Windows Server 2008 R2 x64 Image Name: Windows Server 2008 R2 x64 RC Image ID: 58 Image ID: 32 Image Name: Windows Server 2008 R2 x64 - Image Name: Windows Server 2008 R2 x64 - MSSQL2K8R2 MSSQL2K8R2 RC Image ID: 81 Image Name: Windows Server 2008 R2 x64 - SQL Web Image ID: 34 Image Name: Windows Server 2008 R2 x64 - SQL Web RC The image IDs above will not appear in your image list via the API, but are accessible to your account as hidden images. The only difference between the RackConnect and non-rackconnect versions of the images is a slight change in Windows Firewall to allow access for our automation systems. If you are using the MyRackspace Portal to create Cloud Servers on a Cloud account with RackConnect, you will automatically see the correct Windows images, and no additional action is required to select the correct image. You cannot use the Cloud Control Panel (http://manage.rackspacecloud.com) to create Core Service Level Windows Cloud Servers with RackConnect at this time.

RackConnect User Guide Page 13 of 15 RACKCONNECT SUPPORT Your Dedicated/Managed Hosting support team is your first point of contact for RackConnect support. They will help you isolate any issues as needed, including transitioning you to cloud support if needed to assist with cloud-specific issues. Please note that RackConnect does not include a different support agreement than what you already have in place. In some cases, you may have purchased a different support level for your dedicated environment and your cloud environment. For example, you may have Managed service level for your dedicated account, and a core service level cloud account. This means that while your Managed Hosting team can help you isolate problems with your cloud account, they will not be able to log into your cloud servers to fix issues. Your service experience is our utmost concern. Therefore, it is ALWAYS our recommendation that you use Cloud Servers with a Managed service level with your RackConnect environment. This way Rackspace will be able to assist you in directly troubleshooting your servers. RACKCONNECT FREQUENTLY ASKED QUESTIONS Can I have RackConnect in more than one location? How would I set that up? Yes, it is possible to have more than one RackConnect Configuration, in either different regions or the same region. You would simply deploy dedicated hardware into separate regions and request that your Account Team start the RackConnect implementation process for each environment. If you would like connectivity between your environments deployed in both regions you can work with our Network Security team to establish a site-to-site VPN tunnel. As a reminder, since each Cloud account is associated with a specific region this setup will require that you setup at least one Cloud account per region and RackConnect Configuration. Can I connect multiple Cloud accounts? Yes, multiple Cloud accounts can be associated with the same RackConnect Configuration. Please note that the opposite is not possible a single Cloud account cannot be associated with multiple RackConnect Configurations, as each server can only have a single default gateway for its traffic. Can I share data between Cloud accounts leveraging RackConnect? At this time, Network Policies do not allow you to establish communication between Cloud accounts. We realize that this is a high priority feature and are working to include it in a future release. What if I want Managed and Core cloud? This is possible by establishing two separate Cloud accounts. If you choose, both Cloud accounts can leverage RackConnect to communicate with the same Dedicated environment. Please be aware that direct communication between

RackConnect User Guide Page 14 of 15 accounts is not yet available. (See note above). Are all of my Cloud Servers automatically configured for RackConnect? What if I want some of my Cloud Servers not to have access to my Dedicated environment? All Cloud Servers on a Cloud account configured for RackConnect will be automatically configured. If you have specific servers that you do not want to have access to your Dedicated environment, you can customize your Network Policies to only allow certain Cloud Servers (based on either a wildcard name match or a specific server match) access. What happened to my network configuration after I hard rebooted my server? Hard rebooting a Cloud Server causes the network configuration to revert to the normal Cloud Servers defaults. The RackConnect automation system will detect this event and will automatically reconfigure your server for RackConnect shortly after the hard reboot. CLOUD SERVER IMAGE COMPATABILITY Below is a list of Cloud Server Images that are NOT compatible with RackConnect. All images not listed below are compatible with RackConnect, as of the revision date on the first page of this guide. Core Service Level Managed Service Level Image ID Image ID Oracle EL R5U3 JEOS 41 All images are compatible with RackConnect Windows Server 2008 SP2 Enterprise 32- bit 31 Windows Server 2008 SP2 Enterprise 32- bit w/ SQL 56 Windows Server 2008 SP2 Enterprise 64- bit 24 Windows Server 2008 SP2 Enterprise 64- bit w/ SQL 57 For all other Core Service Level Windows images, please review the section titled Windows Core Service Level Images above.

RackConnect User Guide Page 15 of 15 KNOWN ISSUES The following known issues exist as of the revision date on the first page of this guide. We anticipate resolving these items in a future release. 1. When defining Network Policies for a Cloud account, there is currently no way to allow access for Cloud resources residing outside of the Cloud account. There are two key areas this impacts: a. If you have multiple Cloud accounts in the same RackConnect Configuration, each of them can have Network Policies allowing them to communicate with your Dedicated environment, but the Cloud Servers on each Cloud account will not be able to communicate across accounts. b. Our Cloud Load Balancer service will not be able to pass traffic to your Cloud Servers via the private network by default. For step-by-step directions on setting up Cloud Load Balancers to work with RackConnect, see the section above titled, Using Cloud Load Balancers with RackConnect. A future release of RackConnect will make this feature easier to configure. Workaround: You can allow inbound traffic to your Cloud Servers by creating an Internet to Cloud Network Policy. o Set the Source Type to host or network, and enter the 10.x.x.x private IP address or addresses that should be granted access.. While this workaround will create access controls on both your Edge Network Device and the software firewall of your Cloud Server, the access controls on your Edge Network Device will not have any effect since traffic will not traverse that interface. A future release will provide specific Network Policy access scenarios to make this easier to configure.