ProxySG Virtual Appliance MACH5 Edition Initial Configuration Guide

Transcription

1 2015 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW, INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE, POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DS APPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, the Blue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties are the property of their respective owners. This document is for informational purposes only. BLUE COAT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. BLUE COAT PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU. Americas: Rest of the World: Blue Coat Systems, Inc. Blue Coat Systems International SARL 420 N. Mary Ave. 3a Route des Arsenaux Sunnyvale, CA Fribourg, Switzerland ProxySG Virtual Appliance MACH5 Edition Initial Configuration Guide Platform: Hyper-V Hypervisor SGOS and later i

2 ProxySG Virtual Appliance MACH5 Edition Contact Information Copyright 2017 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU. Americas: Rest of the World: Symantec Corporation Symantec Limited 350 Ellis Street Ballycoolin Business Park Mountain View, CA Blanchardstown, Dublin 15, Ireland Document Number: Document Revision: SGOS 6.7.x 07/2017 ProxySG Appliances Additional Restrictions Within sixty (60) days of the date from which the User powers up the ProxySG appliance ( Activation Period ), the Administrator must complete the ProxySG licensing requirements as instructed by the ProxySG to continue to use all of the ProxySG features. Prior to the expiration of the Activation Period, the ProxySG software will deliver notices to install the license each time the Administrator logs in to manage the product. Failure to install the license prior to the expiration of the Activation Period may result in some ProxySG features becoming inoperable until the Administrator has completed licensing. Proxy Client: The Administrator may install the Proxy Client only on the number of personal computers licensed to them. Each personal computer shall count as one user or seat. The ProxyClient software may only be used with Blue Coat ProxySG appliances. The Administrator shall require each user of the Blue Coat ProxyClient software to agree to a license agreement that is at least as protective of Blue Coat and the Blue Coat ProxyClient software as the Blue Coat EULA. ProxySG Virtual Appliances, MACH5 or Secure Web Gateway (SWG) Edition: The ProxySG Virtual Appliances (MACH5 or Secure Web Gateway edition) are licensed on either a perpetual or subscription basis for a maximum number of concurrent users. Support for the Virtual Appliances will be subject to the separate support agreement entered into by the parties if the Administrator licenses the Virtual Appliances on a perpetual basis. The Virtual Appliances will (a) not function upon expiration of the subscription if the Administrator licenses the Virtual Appliances on a subscription basis; or (b) if the traffic exceeds the maximum number of concurrent users/connections, features may not function beyond the maximum number of concurrent users/connections. This means that, in these cases, the network traffic will only be affected by the default policy set by the Administrator (either pass or deny). Such cessation of functionality is by design, and is not a defect in the Virtual Appliances. The Administrator may not install the same license key or serial number on more than one instance of the Virtual Appliance. The ii

3 Administrator may move the Virtual Appliance along with its license key and serial number to a different server, provided that server is also owned by the Administrator and the Administrator permanently deletes the prior instance of the Virtual Appliance on the server on which it was prior installed. The Virtual Appliances require a third party environment that includes software and/or hardware not provided by Blue Coat, which the Administrator will purchase or license separately. Blue Coat has no liability for such third party products. iii

4 ProxySG Virtual Appliance MACH5 Edition iv

5 Chapter 2: Overview The ProxySG Virtual Appliance (ProxySG VA) is a software solution that can be installed and deployed on a server running the Microsoft Hyper-V hypervisor. The ProxySG VA for the MACH5 Edition is a branch office solution that accelerates the flow of data and applications between the branch office and data center, and facilitates server consolidation since the ProxySG VA can coexist with other virtual machines on a single hardware platform. With the ProxySG VA providing WAN acceleration, the other virtual machines can provide branch office services (such as Domain Controller, print, DNS, and DHCP), as well as any Hyper-V-certified software application. The ProxySG VA must be installed virtually in-path using Web Cache Communication Protocol (WCCP). WCCP is a protocol that is used when a caching device, such as the ProxySG VA, is not deployed physically in-path with the router. Using the WCCP protocol, a WCCP-capable router transparently redirects traffic to the ProxySG VA. The following network diagram shows an Application Delivery Network (ADN) where the ProxySG VA is deployed virtually in-path at a branch office and a ProxySG hardware appliance is deployed in-path at the data center. 7

6 ProxySG Virtual Appliance MACH5 Edition Section 1 About This Guide This guide is intended for users who are deploying and running a ProxySG VA on Microsoft s Hyper-V hypervisor. It provides information on the minimum system requirements and instructions for creating and configuring a virtual ProxySG appliance. The following topics are covered in this guide: "Before You Begin" "Create the ProxySG Virtual Appliance" "Configure the ProxySG VA" "Upgrading the SGOS" Note: MySymantec ( has the most up-to-date version of this guide. 8

7 Section 2 Conventions Used in This Guide This guide uses the following typographical conventions: Convention Example Terms that identify buttons, fields, menus, or options on the user are shown in Palatino font. Text that you must type exactly is denoted using bold, Consolas font. Information that is variable and specific to your environment is denoted in angle brackets and in italics. 1. Select Maintenance > Licensing > Install. 2. Click Retrieve. Enter <ProxySG_IP_address>:8082/mgmt <ProxySG_IP_address> in <ProxySG_IP_address>:8082/mgmt 9

8 ProxySG Virtual Appliance MACH5 Edition Section 3 Terminology The following table lists the terms used in this guide. Term Definition Application Delivery Network (ADN) Appliance Serial Number Blue Coat Sky Datastore Director Enable Mode Enable Password Microsoft Hyper-V hypervisor Management Console MACH5 ProxySG VA SGOS A Symantec solution that provides visibility, acceleration, and control for the application traffic traversing a WAN. A string of characters that uniquely identify a virtual appliance. On the first boot, you must enter the appliance serial number to begin initial configuration on the Blue Coat ProxySG VA. The default Web interface for the MACH 5 license. Storage defined in Microsoft Hyper-V hypervisor, made up of one or more physical disks. Symantec Director is the centralized management platform for managing ProxySG configurations and policies. It allows you to manage multiple ProxySG appliances in your deployment. A mode that allows administrative privileges on the Command Line (CLI) of the ProxySG appliance. You can make changes to the configuration in this mode. A password used to enter enable mode so that you can configure an appliance. Enable mode is for administrators who are authorized to configure an appliance. The physical computer (host server) on which Microsoft s virtualization product is installed. The Hyper-V hypervisor provides CPU and memory resources, access to storage, and network connectivity to multiple virtual machines. The Web interface for advanced configuration on the ProxySG VA. Enter the following URL in the Web browser for directly accessing the Management Console: where <ProxySG_IP_address> is the IP address of your ProxySG VA. The MACH5 edition license on the Blue Coat ProxySG appliance is used for acceleration deployments. The MACH5 base license allows acceleration of HTTP, FTP, CIFS, DNS, , and streaming protocols. Security-related features are not included. A ProxySG running as a virtual appliance on Hyper-V. The ProxySG appliance operating system. 10

9 Term Virtual Machine VLAN WCCP Definition An instance of an operating system and one or more applications that run in an isolated partition of a Hyper-V Server. ProxySG VA is a virtual machine. Virtual Local Area Network. A local area network (LAN) that is created with software. It maps clients (hosts) on a basis other than by geographic location and extends across LAN segments rather than remaining in one physical LAN. Web Cache Communication Protocol. Allows you to redirect the traffic that flows through routers. 11

10 ProxySG Virtual Appliance MACH5 Edition 12

11 Chapter 2: Before You Begin This chapter assumes that you have configured your hardware platform on the Hyper-V hypervisor, created datastores, and configured the Hyper-V hypervisor for network access. For information on setting up your Hyper-V hypervisor, refer to Microsoft documentation. Before you proceed with creating the ProxySG VA, perform the following tasks: "Verify Support for Microsoft Products" "Verify System Requirements" "Verify Resource Availability" "Retrieve Appliance Serial Numbers" "Create a Virtual Switch" 13

12 ProxySG Virtual Appliance MACH5 Edition Section 1 Verify Support for Microsoft Products The MACH5 VA running SGOS or higher is currently only compatible with the 2012 R2 version of the Hyper-V hypervisor, available on Microsoft Windows Server 2012 R2. Note: The MACH5 VA running SGOS does not support suspend and resume operations, or the creation of watchpoints. 14

13 Section 2 Verify System Requirements To achieve the best performance on the MACH5 VA, it is important that you install the software on a system that meets the specified requirements. Follow these guidelines to guarantee satisfactory performance and operation of the MACH5 VA. Note: The ProxySG VA-20 model is currently not available for the Hyper-V platform. The host server must be on Microsoft s Hardware Compatibility List (see the list at The server must have sufficient virtual resources to run MACH5 VA, as described in Table 2-1. Note: The following requirements reflect Symantec s test environment. Using the same or a similar configuration should achieve satisfactory performance of the MACH5 VA; however, you should expect different performance results if your resources or virtual drive configuration are different from the configuration described in Table 2-1. Table 2 1 General System Requirements Model ProxySG VA-5 (5-10 users) ProxySG VA-10 (10-50 users) ProxySG VA-15 ( users) Virtual CPU minimum 1.0 GHz 1.5 GHz 2.0 GHz Virtual memory 2048 MB 2560 MB 3072 MB Virtual drives Minimum storage space 100 GB 200 GB 400 GB * Minimum number of physical drives in a non-raid system. For disk requirements in a RAID configuration, see "Disk Requirements for a RAID Deployment" *** The storage partition in which a ProxySG VA is installed must include the minimum number of physical drives shown in this table. This requirement ensures that adequate disk IO bandwidth is available to support the throughput for which the model is rated. The storage partition must be on the Hyper-V Server and it must contain adequate storage space. On some platforms with RAID controllers, the storage set-up utility might allow a single drive to be configured as a RAID 0. Although a single drive is technically not a RAID configuration, it is an acceptable configuration for the ProxySG VA-5 and the ProxySG VA- 10. *** To configure drives on the ProxySG VA-15, add extents to the datastore; refer to the Hyper-V documentation for details. 15

14 ProxySG Virtual Appliance MACH5 Edition Disk Requirements for a RAID Deployment RAID (Redundant Array of Independent Disks) technology is a data storage scheme that provides storage reliability and increased performance by dividing and replicating data among multiple hard disk drives. You can install the SWG VA on a Hyper-V hypervisor that implements RAID level 0 or RAID level 5 architecture. Different RAID configurations may produce different IOPS numbers. Refer to the following IOPS section for details. As long as the RAID configuration meets in the minimum IOPS requirement, the VA will operate correctly. If you plan to install SWG VA in a RAID deployment, Symantec recommends the following physical disk drives requirements: Table 2 2 RAID Disk Requirements Model ProxySG VA- 5 ProxySG VA- 10 ProxySG VA- 15 Minimum number of physical drives for RAID 0 Minimum number of physical drives for RAID Note: Symantec does not recommend using RAID 5 because it significantly reduces the number of IOPS. Recommended IOPS for an iscsi SAN Deployment An iscsi storage area network (SAN) transmits storage data between host servers and storage subsystems using the iscsi protocol over an existing Ethernet connection. VM Recommendations The storage partition in which a MACH5 VA is installed must include the minimum number of physical drives shown in this table. This requirement ensures that adequate disk IO bandwidth is available to support the throughput for which the model is rated. The storage partition must be on the Microsoft Windows Server 2012 R2 and it must contain adequate storage space. On some platforms with RAID controllers, the storage set-up utility might allow a single drive to be configured as a RAID 0. Although a single drive is technically not a RAID configuration, it is an acceptable configuration for the MACH5 VA VA-5 and the ProxySG VA-10. To configure drives on the ProxySG VA-15, add extents to the datastore; refer to the Hyper-V documentation for details. 16

15 Deployment Recommendations For optimal performance, follow these guidelines: Support for SSL Use only up to 85% of the available disk space on a datastore. For example, when selecting a datastore for a ProxySG VA-15 that uses 400GB of disk space, ensure that at least 15% disk space is still available on the datastore after the ProxySG VA is created. To meet performance expectations, the ProxySG VA requires local storage; SAN and NAS are not supported storage options and might result in reduced performance. To make a backup of your system configuration, use the archiving feature in the ProxySG VA. Do not take snapshots of the ProxySG VA configuration. Do not suspend and resume the ProxySG VA. On the ProxySG VA, all cryptographic operations are performed in the SGOS software. The SSL license is included with the virtual appliance license. 17

16 ProxySG Virtual Appliance MACH5 Edition Section 3 Verify Resource Availability Because all virtual appliances use a hardware resource pool that can be shared and assigned as needed, you must verify that the Hyper-V hypervisor meets the minimum hardware requirements for the MACH5 VA model that you have purchased. The following instructions describe how to verify system resources on the Hyper- V hypervisor using the Hyper-V Manager. To verify resource availability: 1. Access the Windows Server Manager > Local Server. 2. In the Properties panel, note the total amount of memory and CPU resources available on the server. 3. Access the Hyper-V Manager. 4. In the Virtual Machines panel, note the total amount of memory and CPU resources allocated to existing virtual machines. 5. Verify adequate resource availability. For ProxySG VA resource requirements, see Table 2 1, "General System Requirements" on page

17 Section 4 Retrieve Appliance Serial Numbers The Symantec efulfillment you received after placing your order for ProxySG VA appliances contains activation codes for retrieving appliance serial numbers from the Symantec Licensing Portal. Note: Be sure to use the correct serial number for your MACH5 VA. It helps ensure that your license is valid, and it is also used in Symantec Web Filter (BCWF) authentication. Retrieve appliance serial numbers: 1. Make sure you have a MySymantec ( username and password. In addition to retrieving appliance serial numbers, these credentials are required for obtaining your license and downloading software upgrades. If you do not have a MySymantec account, contact NP_customercare@symantec.com. For additional contact information, see 2. Locate the you received from Symantec. This contains the software activation codes as well as a link to the licensing portal. 3. Log in to the Symantec Licensing Portal a. Click the link embedded in the ( eservice_enu/licensing/register.cgi). The web browser displays the licensing portal page. b. On the login screen, enter yourmysymantec username and password, and then click Sign In. A Home page displays. 4. In the Enter Activation Code field, enter any activation code that is listed in your ; the system retrieves all serial numbers from the same purchase order. a. Type the code as it appears in the , or copy and paste it into the Enter Activation Code field. b. Click Next. The License Agreement page is displayed. 5. Read and accept the License Agreement. a. Read the license agreement. b. Select I accept at the bottom of the page. c. Click Next. A serial numbers page displays. 6. Record the appliance serial number(s). You will refer to the serial number when you perform initial configuration on the MACH5 VA. Perform one of the following tasks to note the appliance serial number: Write down the serial number(s) listed on the screen. 19

18 ProxySG Virtual Appliance MACH5 Edition Download a comma-separated values (CSV) file containing all of the serial numbers. Click the link beside Download as CSV file and save the file to disk. For future reference, record the location and name of the MACH5 VA with the serial number. Note: Each appliance serial number is unique. When performing initial configuration on the SWG VA, make sure that you use a dedicated serial number for each instance of a SWG VA. If you reuse a serial number, the MACH5 VA license could be suspended. See "Licensing and Serial Number FAQ" on page 40 for more information. User Limits As indicated in Table 2 1, each ProxySG VA model supports a range of users, for example the ProxySG VA-10 supports users. However, unlike a physical appliance, the ProxySG VA does enforce the number of users, as permitted by the license. The ProxySG VA bypasses connections from users after the maximum has been reached. For example, on the ProyxSG VA-10, the 51st user is bypassed. Alternatively, you can choose to queue the connections for users over the licensed limit. 20

19 Section 5 Create a Virtual Switch A virtual machine has virtual network interfaces that are not physically cabled to a network interface card (NIC) on the Hyper-V hypervisor host. To provide network access, a virtual switch (VMSwitch) is required to logically connect the virtual network interfaces on the virtual machine to a physical NIC on the Hyper- V hypervisor host. The MACH5 VA includes three virtual network interfaces a LAN interface, a WAN interface, and a third optional interface for handling management traffic. Before creating the ProxySG VA, confirm that you have one VMSwitch available for connecting the WAN and LAN interfaces. The VMSwitch for the third interface is optional. Note: If you use VLANs for segregating traffic within the Hyper-V Server or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations. Follow these steps to create a virtual switch: 1. Start a PowerShell or cmd prompt and type ipconfig /all. From this step, note the description field of the physical NIC that you want to connect to. For example: Ethernet adapter NIC3: Media State : Media disconnected Connection-specific DNS Suffix. : Description : Broadcom NetXtreme Gigabit Ethernet #7 2. In the Hyper-V Manager s Actions panel, click Virtual Switch Manager. 3. Choose External, and click Create Virtual Switch. 4. Name the switch and select the physical NIC to use with this switch. For the example, select 'Broadcom NetXtreme Gigabit Ethernet #7' from the External network list. 5. After applying the settings, go to the VM Settings window. Select a Network Adapter, and choose the switch name (created in step 4) as the virtual switch for this VM NIC. 21

20 ProxySG Virtual Appliance MACH5 Edition 22

21 Chapter 3: Create the ProxySG Virtual Appliance This chapter describes how to import a virtual appliance in to the Hyper-V hypervisor, enable performance monitoring on the virtual appliance, and ensure that the MACH5 VA has the resources available for optimal performance. To create the MACH5 VA, you must have administrator privileges on the Hyper- V hypervisor. This chapter covers the following topics: "Download the Virtual Appliance Package" "Import a MACH5 VA" "Reserve Resources for the ProxySG VA" "Power on the ProxySG VA" 23

22 ProxySG Virtual Appliance MACH5 Edition Section 1 Download the Virtual Appliance Package The Virtual Appliance Package (VAP) is a zip file that contains the following files: ProxySG VA Hyper-V configuration folder, containing all files necessary to import the VA. The install_vm.ps1 installation script PDFs of this document and the Command Line Interface Reference Download the VA Package 1. Go to MySymantec: 2. Select Downloads > Network Protection (Blue Coat) Downloads. 3. When prompted, log in with your MySymantec credentials. 4. Select your product. 5. Select your appliance model (if applicable). 6. Select a software version. 7. Accept the License Agreement. 8. Select the file(s) to download and click Download Selected Files. Note: The first time you download files, you are prompted to install the Download Manager. Follow the onscreen prompts to download and run the installer. For more information, refer to support-center/getting-started. 9. The Download Manager window opens. Select the download location. Note: Complete instructions are also available online at: Bookmark this page for future reference. 10. Extract the contents of the package zip file. The files should be extracted to a location that can be accessed from the system running the Microsoft Hyper-V hypervisor. The installation script is run on the hypervisor. Notes Extract and store the contents of the.zip file within the same folder. Do not rename the files. The ProxySG Hyper-V VM zip package might be blocked by a global setting in the Windows Attachment Manager. To unblock the zip file, edit the file properties or execute Unblock-File myzipfile in PowerShell. 24

23 Instructions from Microsoft: To open a blocked file, follow these steps: a. Right-click the blocked file, and then click Properties. b. In the General tab, click Unblock. Source: 25

24 ProxySG Virtual Appliance MACH5 Edition Section 2 Import a MACH5 VA To use a virtual ProxySG appliance, you must first create it, then connect it to your network. Create the ProxySG Virtual Appliance When the script install_vm.ps1 is called, it creates the required fixed-size virtual disks for the ProxySG VA, and then imports the VA in Hyper-V. On first boot, all attached virtual disks will be formatted and the ProxySG VA will automatically reboot. Depending on your execution policy, you may not be able to execute the installation script without unblocking the script or changing the execution policy. On a Windows Server 2012, you can get and set the effective execution policy in PowerShell as follows: Get-ExecutionPolicy Set-ExecutionPolicy RemoteSigned For more details about execution policies, please refer to technet.microsoft.com/en-us/library/hh aspx The directory where the VHDs will be created is passed as a parameter to the script:.\install_vm.ps1 -disk_dir <virtual disk destination directory> By default, the install script will create fixed-size disks and attach them to the VM. This operation may take a long time, because the disk-creation tool provided by Microsoft zeros-out the entire disks. The install script can optionally make use of a third-party tool, VhdxTool, for fast disk creation. The disks will NOT be zeroedout if a path to vhdxtool.exe is provided as a parameter to the script:.\install_vm.ps1 -disk_dir <virtual disk destination directory> - vhdxtool <path to vhdxtool.exe> Obtain the vhdxtool.exe at: It requires.net 4.5. Symantec assumes you will typically run it on Windows Server 2012 R2, where this component should be already installed. See the Systola vhdxtool.exe release notes before using this tool. Note: WARNING VhdxTool is third-party software provided by Systola. Use at your own risk. Symantec does not assume responsibility for supporting VhdxTool. IN NO EVENT SHALL SYMANTEC BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 26

25 Migrate a Virtual Disk to a Different Physical Disk The number and sizes of the MACH5 VA virtual disks depends on the MACH5 model. For optimal performance of the MACH5 VA, these virtual disks should be on different physical disks. If they are both on the same physical disk, migrate one of them to another disk. Note: Symantec recommends that the hard disks used support recommended in "Recommended IOPS for an iscsi SAN Deployment" for optimal performance from the MACH5 VA. Migrate a virtual disk to a different physical disk: 1. Access the Hyper-V Manager. 2. Right click on the ProxySG VA you wish to configure and click Turn Off if the VA is running. Once the VA is off, select Settings. 3. Each virtual hard drive is attached under a different SCSI Controller. Select the Hard Drive you wish to relocate, and note the full path to the corresponding Vhdx file. 4. Copy or move the Vhdx file to another physical disk, using, for example, Windows Explorer or PowerShell. 5. Go back to the SCSI Controller settings window, and update the virtual hard disk field to the new location. 6. Click Apply. 27

26 ProxySG Virtual Appliance MACH5 Edition Figure 3 1 Disk Settings Connect the VA to the Network Once the VA is created, the next step is to connect it to the network. After that, configure the console so you can work with the VA. If you have already configured virtual switches on the server, the install_vm.ps1. script will attempt to attach all ProxySG virtual network adapters (virtual NICs: VNICs) to a virtual switch. By default, install_vm.ps1 attaches all VNICs to the first available virtual switch. Alternatively, the name of the virtual switch can be supplied as a parameter:.\install_vm.ps1 -disk_dir <virtual disk destination directory> - vmswitch <name of virtual switch> Note: All available virtual switches can be listed in PowerShell using the Get- VMSwitch command. Manually attach a specific virtual switch to a VNIC 1. Go to the Hyper-V Manager. 2. Go to the ProxySG VM settings window. 28

27 3. Select a Network Adapter, then choose the virtual switch name to which the VNIC will be connected. Figure 3 2 Configure the Network Adapter Create a New Virtual Switch If you did not create a virtual switch when you installed Hyper-V, do so now. See "Create a Virtual Switch". Set up the ProxySG Console for Operations Access the ProxySG VM serial console in the Hyper-V Manager by clicking Connect... The installation script will automatically create a named pipe for console redirection. By default, the named pipe is located under \\.\pipe\<proxysg VM Guid>. This location can be changed via Set-VMComPort in PowerShell, or through the VM's COM 1 settings in the Hyper-V Manager. 29

28 ProxySG Virtual Appliance MACH5 Edition Section 3 Reserve Resources for the ProxySG VA Symantec recommends reserving memory and a CPU core for the ProxySG VA. If resource allocation is not accurate for the ProxySG VA model that you have created, the ProxySG VA might not perform optimally. If the Hyper-V hypervisor host does not have the available resources to satisfy the resource reservations, the MACH5 VA will not power on. To reserve resources: 1. Determine the appropriate value for the CPU reservation. The reservation should be the full CPU frequency of one core. 2. Access the Hyper-V Manager. 3. Right click on the ProxySG VA you wish to configure, and click Turn Off if the VA is running. Once the VA is Off, select Settings. 4. Access the Processor node 5. Enter 100 in the Virtual machine reserve (percentage) field. 30

29 Section 4 Power on the ProxySG VA To power on the Mach5 VA: 1. Log in to the Hyper-V Manager. 2. Select the Mach5 VA. 3. Right click and select Start. When the Mach5 VA is powered on, the State changes to Running in the Hyper- V Manager. Figure 3 3 Hyper-V Manager 31

30 ProxySG Virtual Appliance MACH5 Edition 32

31 Chapter 4: Configure the ProxySG VA This chapter describes how to perform the initial set-up and configuration of the ProxySG VA for transparent redirection of traffic. The following topics are covered in this chapter: "Prepare for Initial Configuration" "Launch Blue Coat Sky" "Retrieve and Install the MACH5 VA License" "When to Power Off the ProxySG VA" "Verify your Configuration" "Next Steps" Note: The instructions in this document are for Microsoft Windows Server 2012 R2. 33

32 ProxySG Virtual Appliance MACH5 Edition Section 1 Prepare for Initial Configuration Right-click and select Connect on your Hyper-V Manager to access the MACH5 VA for initial configuration. The set-up script prompts you to configure basic network settings, including adding an interface IP address, and setting up administrative credentials for console access. The following table summarizes the prompts in the setup wizard. Before you launch the setup wizard, obtain and record the information specific to your deployment in this table. After you have recorded your settings in the table, see "Complete Initial Configuration". Description Value My Values Appliance Serial Number Manual set-up or use Director Interface configuration Default gateway Primary DNS server Administrator username (ID) and password Refer to the appliance serial number that you recorded in "Retrieve Appliance Serial Numbers". If using Director, you must configure a registration password or shared secret on the Director. The same password must be entered while performing the initial configuration. The shared secret is required because the MACH5 VA does not have an appliance certificate at this point. Note: When you install a license from MySymantec, an appliance certificate is also installed. After you install the license, you can change your configuration to use Director subjugation. The appliance certificate is then used instead of the shared secret when subjugating with Director. Identify the IP addresses and subnet masks for the interfaces. You also have an option to assign a VLAN ID to each interface. If you use VLANs for segregating traffic within the Hyper-V hypervisor or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations. Provide the IP address for the default gateway. Provide the IP address for the primary DNS server. The password you assign here will also be used for accessing enable mode in the command line interface (CLI). Enable mode allows you to make configuration changes. 34

33 Section 2 Complete Initial Configuration 1. Verify that your Mach5 VA is powered on. a. Open the Microsoft Hyper-V Manager. b. Confirm the Mach5 VA is in the Running state. 2. Access the virtual console of the Mach5 VA on the Microsoft Hyper-V Server. a. Select the MACH5 VA on the Hyper-V Manager. b. Right-click on the selected VA and select Connect, or double-click, to access the MACH5 VA. 3. The appliance serial number is unique for each appliance and must be used on only one MACH5 VA. For more information, see "Retrieve Appliance Serial Numbers". a. Enter the appliance serial number at the prompt. Note: The leading zeros are significant for serial numbers. Enter all 10 digits at the prompt. b. Press Enter. 4. Follow the prompts and enter the details in the setup script. a. Press Enter three times to activate the serial console. 35

34 ProxySG Virtual Appliance MACH5 Edition b. When asked How do you plan to configure this appliance? specify your preference for either configuring the MACH5 VA manually or using Director. If you are using Director, assign a registration password on Director and enter the password in the setup console when prompted. For information on setting up a registration password, refer to the Symantec Director Configuration and Management Guide. c. At the Enter interface number to configure prompt, specify an interface. d. You are prompted Is the IP address to be configured on a non-native VLAN? Specify Y or N. If you use VLANs for segregating traffic within the Hyper-V hypervisor or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations. e. Specify the IP address and subnet mask for the selected interface. f. Specify the IP address for the default gateway. g. Specify the IP address for the DNS server. h. Change the username for administrative access on the MACH5 VA. i. Add a password for allowing administrative access privilege. j. When prompted, enter your Enable password. k. At the Do you want to secure the serial port? prompt, specify Y or N. l. When asked Restrict access to authorized workstations? specify Y or N to indicate whether you allow non-authorized workstations to access the Management Console. m. Press Enter three times to activate the serial console. 5. (If necessary) Repeat the previous steps to configure more interfaces. 6. Close the console. 36

35 Section 3 Launch Blue Coat Sky The Blue Coat ProxySG has two graphical user interfaces Blue Coat Sky and the Management Console. Blue Coat Sky is the default Web interface for managing the ProxySG VA. The Management Console allows you to perform advanced configuration tasks, such as creating policy. To access Blue Coat Sky, enter the IP address of the ProxySG VA into the Web browser, for example: or To access the Management Console directly, enter the following URL in your Web browser: For example, Before you can accelerate traffic in your network, you must obtain and install the license for the ProxySG VA and configure WCCP for transparent redirection of traffic to the ProxySG VA. When you log in to Blue Coat Sky, two alerts are displayed, one for licensing the appliance and the other for configuring WCCP. Use the following instructions to complete initial configuration on the ProxySG VA. Access Blue Coat Sky 1. Enter the IP address of the ProxySG VA into the Web browser. For example: or The WCCP configuration incomplete dialog box displays. 2. Close the WCCP configuration incomplete dialog box. (You will configure WCCP later.) Click Do it Later. 3. View the alerts and proceed with additional configuration tasks a. View the alerts and proceed with additional configuration tasks b. Click the license alert to retrieve the license for the ProxySG VA. See Retrieve and Install the MACH5 VA License on page 38. c. Click the WCCP alert to configure WCCP on the ProxySG VA. See on page 41. Note Before you can accelerate traffic in your network, you must complete both tasks: licensing and WCCP configuration. 37

36 ProxySG Virtual Appliance MACH5 Edition Section 4 Retrieve and Install the MACH5 VA License The ProxySG VA offers a subscription-based license, which is valid for a set period of time (such as one year). After you have installed the license, the ProxySG VA has full functionality, and you have access to software upgrades and product support for the subscription period. Before you begin Set up DNS; see Configuring DNS in the SGOS Administration Guide Confirm NTP is working, or add local NTP servers, and verify the system time is correct; see Accessing the Appliance in the SGOS Administration Guide Supported Licenses The ProxySG VA MACH5 Edition license allows acceleration of HTTP, FTP, CIFS, DNS, , and streaming protocols. Security-related features are not included in the MACH5 Edition; purchase the Secure Web Gateway Virtual Appliance (SWG VA). To use the ProxySG VA as a secure web gateway. The ProxySG VA also includes an SSL license for intercepting SSL traffic and a Flash Streaming license for optimizing Flash video content. The following license components are not supported on the ProxySG VA MACH5 Edition: Proxy Edition license SWG VA license Trial period A new ProxySG VA is unlicensed. Until you install the license, the virtual appliance bypasses all traffic. 38

37 Section 5 License the ProxySG VA The ProxySG VA is in a License expired state when it cannot detect a license, either because it hasn t been installed yet or because the license subscription has expired. An unlicensed virtual appliance bypasses all traffic. To retrieve and install the MACH5 VA license for the first time, the MACH5 appliance must be allowed access to the following Symantec servers: Before you begin Set up DNS; see Configuring DNS in the SGOS Administration Guide Confirm NTP is working, or add local NTP servers, and verify the system time is correct; see Accessing the Appliance in the SGOS Administration Guide Note: If you have blocked the Symantec NTP servers, add a local server. Retrieve and Install the Mach5 VA License 1. In the Management Console, select Maintenance > Licensing > Install. 2. Click Retrieve. 3. In the dialog box that displays, do the following: a. Enter your MySymantec account login information. b. Click Request License. The Confirm License Install dialog box displays. c. Click OK to begin license retrieval. 4. (Optional) Click Show results to verify a successful retrieval. If any errors occur, verify that you are connected to the Internet. 5. Click Close. After you complete the license installation, you do not have to reboot or shut down the appliance. Notes If your ProxySG does not have direct Internet access, you cannot use the automatic procedure described in the next section. You must download the license key file from a workstation with Internet access, then place the file on a web server or a workstation that is used to manage the ProxySG VA. After the license key is accessible, you can install the license on the ProxySG VA. You use the licensing portal to create a License Key File (LKF) for your ProxySG VA appliance. The LKF contains all the component licenses for your ProxySG VA the MACH5 license along with the SSL and Flash Streaming licenses. 39

38 ProxySG Virtual Appliance MACH5 Edition For 90 days before a subscription-based license expires, Blue Coat Sky and the Management Console alert you that the license will be expiring. If your license expires before you have renewed the subscription, the ProxySG VA will cease to optimize your network traffic; all traffic will be bypassed. Therefore, it's important that you renew your license during the warning period so that you never lose functionality. Licensing and Serial Number FAQ This section covers the following topics about serial numbers and licensing: How Can I Prevent Duplicate Serial Numbers? Do not reuse serial numbers. The ProxySG VA periodically connects to the license validation server to confirm that the license is still valid. If the license validation server detects a duplicate serial number, the ProxySG VA displays a warning beside License Validation Status on the Health Monitoring tab (Maintenance > Health Monitoring). When the license is in this state, you have a specified number of days to determine which ProxySG VAs have duplicate serial numbers and then delete the duplicates (the default time window is 30 days). If you do not delete the duplicates within the specified time window, the license is suspended. License suspension disables proxy functionality and the Management Console displays the Duplicate serial number detected error message. If you receive this error message, go to and follow the steps in the article to resolve the issue. I Don't Have Duplicate Serial Numbers. Why is My License Suspended? After you have verified that you do not have duplicate serial numbers, your license should no longer be suspended; however, if the license validation status still has a warning, the ProxySG VA may be unable to connect to the Internet. If the ProxySG VA has not been able to contact the license validation server, the license will not be reactivated until connectivity to the internet is restored. To fix this problem, troubleshoot network connection problems within your deployment. How Do I Renew my Subscription for the ProxySG VA? Your original Symantec efulfillment contains details about the subscription, including the Start Date and End Date for the subscription. To renew your subscription for the ProxySG VA: 1. Contact customercare@bluecoat.com. 2. After Customer Care renews your subscription, update the license key through the Management Console. See "How Do I Update the License Key?". 3. To verify that the subscription has been updated, click the View tab and confirm that the licensed components have new expiration dates. 40

39 Note: You cannot request a user limit upgrade and renew a subscription on a single order; the upgrade and renewal must be on separate orders. How Do I Update the License Key? Install the license key file through the SWG VA Management Console. 1. Launch the ProxySG VA Management Console. 2. Select Maintenance > Licensing > Install. 3. In the License Key Automatic Installation section, click Update. A Confirm License Install dialog displays. 4. Click OK. 41

40 ProxySG Virtual Appliance MACH5 Edition Section 6 Verify your Configuration Use the following instructions to verify that the traffic in your network is being intercepted and accelerated as required. Use the steps below to verify that network connectivity is uninterrupted and intercepted traffic is being accelerated and optimized. Verify Performance 1. Verify that the ProxySG VA is in acceleration mode: a. In Blue Coat Sky, select Configure > Acceleration > Traffic Management. b. If necessary, select Acceleration mode, and click Commit all. 2. Verify that the services enabled on your ProxySG VA are being accelerated. a. Select Report > Active Sessions to view the sessions that are being intercepted and optimized by the ProxySG VA. 3. Verify traffic optimization. a. Click Traffic Summary. In the Traffic Summary report, you can see which proxies are processing traffic and how much benefit you are getting from each proxy. The statistical table at the bottom lists bandwidth utilization and savings for each service or proxy. Use the buttons at the top to switch views (Proxy vs. Service) and to select different time period. 42

41 b. Click Bandwidth Savings. The Bandwidth Savings report shows you how much bandwidth you are saving with the ProxySG VA. By compressing data and caching objects on the ProxySG VA, less traffic has to travel over the WAN, resulting in significant bandwidth savings. Select what you want to graph: To view bandwidth savings for a specific service, select it from the Service drop-down list. To view bandwidth savings for a specific proxy, select it from the Proxy drop-down list. Select All for the Service or Proxy. All services/proxies will be included in the line graph. 43

42 ProxySG Virtual Appliance MACH5 Edition Section 7 Monitor the MACH5 VA It is important to keep tabs on the health of your Mach5 VA. If a component does not function correctly, learning of it in a timely manner allows you to take action before it fails or causes other problems. The Mach5 VA monitors the health of a variety of components and determines the state of each component at one-minute intervals. The state indicates the condition of the monitored component: OK The monitored component is behaving within normal operating parameters. WARNING The monitored component is outside typical operating parameters and may require attention. CRITICAL The monitored component is failing or has exceeded its critical threshold. The health state displays at the top right corner of the Management Console and in the State field (Statistics > Health Monitoring > Licensing). The current state of a component is determined by the relationship between its current value and its monitoring thresholds. The Warning and Critical states have thresholds associated with them. Each component s health state begins at OK. If the value exceeds the Warning threshold and remains there for the threshold s specified interval, the component s health transitions to the Warning state and the SWG VA issues a warning alert. When a component is in the Warning state and the Critical threshold is exceeded for the specified interval, the component health transitions to the Critical state and an error alert is issued. If the problem is resolved, the value returns below the Warning threshold. If the value stays below the Warning threshold longer than the specified interval, the state returns to OK. To edit the thresholds, click Set Thresholds at the bottom of the Maintenance > Health Monitoring tab. For more information on thresholds, see the ProxySG Virtual Appliance MACH5 Edition. Licensing Metrics for the MACH5 VA If there is a problem with the SWG VA license, the health state displays Warning or Critical. Two metrics on the Maintenance > Health Monitoring tab can help you determine if there is a licensing issue and what you can do to resolve it. These metrics are specific to the SWG VA: License Server Communication Status Monitors the connection to the license validation server. 44

43 If the connection to the license validation server is lost, the State field (Statistics > Health Monitoring > Licensing) displays the health state and the Value field displays the number of days remaining until the license is suspended. The health state depends on the threshold that is set: Warning Default interval is six days before license suspension. Critical Default interval is 0 days before license suspension. If there is an error with the communication status, re-establish connection to the license validation server. The state returns to OK if connection is successful. If you do not re-establish the connection within seven days, the Mach5 VA license is suspended. The MACH5 VA must communicate successfully with the license validation server to restore proxy functionality. License Validation Status Monitors the validity of the Mach5 VA license, ensuring no duplicate serial numbers are in use. If the license validation server detects a duplicate serial number, the State field (Statistics > Health Monitoring > Licensing) displays the health state and the Value field displays the number of days remaining until the license is suspended. The health state depends on the threshold that is set: Warning Default interval is 30 days before license suspension. Critical Default interval is 0 days before license suspension. If the license validation server detects a duplicate license and the license is not disabled before the grace period expires, the license is suspended. You must delete the MACH5 VA with the duplicate license to restore proxy functionality. See "Licensing and Serial Number FAQ" for more information. 45

44 ProxySG Virtual Appliance MACH5 Edition Section 8 When to Power Off the ProxySG VA Some tasks that you perform on the SWG VA require a shutdown. When you do any of the following, save all of your configuration changes and then power off the MACH5 VA. Backing up the SGOS configuration Upgrading the server software Taking the server offline for maintenance Migrating the ProxySG VA to a different server Installing additional or higher-capacity drives on the ESX/i host Adding a serial port to the ProxySG VA Upgrading the virtual appliance model Powering off the MACH5 VA Save all configuration changes before shutting down. To power off the Mach5 VA, follow one of these procedures: Shutdown with Sky 1. In the Blue Coat Sky Configure tab, click Commit all to save all configuration changes. 2. Click Shut down, a link on the right side of the banner. The Shut Down ProxySG VA dialog box is displayed. 3. Click Shut down to confirm. Shutdown with CLI 4. In the command line interface (CLI), enter the enable password to go into privileged mode. 5. Issue the shutdown command. 6. In the Microsoft HypervV Manager, select the Mach5 VA. 7. Right click on the selection, then select Turn Off, once the Mach5 VA console prompts that it is safe to do so. 46

45 To power the system back on, see "Power on the ProxySG VA" on page