VNS3 3.x Trial Edition Configuration Instructions

Transcription

1 VNS3 3.x Trial Edition Configuration Instructions AWS EC2 Deployment 8/2012 1

2 Requirements You have an Amazon AWS account that CohesiveFT can use for enabling your access to the VNS3 (vns-cubed) Manager AMIs. Ability to configure a client (whether desktop based or cloud based) to use OpenVPN client software. Ability to use the Amazon EC2 Command Line tools is preferred. You have a compliant IPsec firewall/router networking device: Preferred: Cisco ASA Validated: Cisco 1800, Cisco PIX, Juniper JunOS Models, Fortigate (3 years old or less), Watchguard Firebox (3 years old or less) Best Effort: Any IPsec device that supports: IKE1 or IKE2, AES256 or AES 128 or 3DES, SHA1 or MD5, AND NAT- Traversal Will Not Work: Checkpoint 2

3 Trial Edition License Consideration The Terms and Conditions associated with the VNS3 Trial Edition DevPay Subscription restrict usage to Development and Test deployments only. If you are interested in a production version of VNS3 try our Lite, SME, or Enterprise Editions or contact us at sales@cohesiveft.com. 3

4 Getting Help with VNS3 This guide uses Cisco s Adaptive Security Device Manager UI. Setting up your IPsec Extranet device may have a different user experience than what is shown here. All the information entered in this guide will be same regardless of your UI or cmd line setup. Please review the VNS3 Support Terms and direct all support inquiries to our GetSatisfaction Site ( 4

5 Firewall Considerations VNS3 Manager instance uses the following TCP and UDP ports. UDP port 1194 For client VPN connections; must be accessible from all servers that will join VNS3 topology as clients. TCP port 8000 HTTPS admin interface; must be accessible from hosts where you will want to obtain runtime status or configure peering, also needs to be open to and from the managers at least for the peering process, and needs to be accessible when downloading credentials for installation on overlay network clients. UDP ports 500 and 4500 These ports are used for native IPsec and NAT-Traversal encapsulation and need to be configured in your IPsec device. If you would like the EC2 IPsec Gateway to be able to initiate a connection (for example in the event of a broken connection) then you need to allow the public IP address of the gateway to connect to your IPsec device over these ports. If you want your IPsec device to initiate the connection, then these ports need to be opened to the public address of your IPsec device in the EC2 Security Group your gateway AMI was launched in. NOTE: NAT-Traversal encapsulation is a requirement when negotiating IPsec tunnels to generic EC2, any tunnel negotiated without NAT-T will be blocked from sending traffic by the AWS EC2 edge. 5

6 Remote Support Note that TCP 22 (ssh) is not required for normal operations. Each VNS3 Manager is running a restricted SSH daemon, with access limited only to CohesiveFT for debugging purposes controlled by the user via the Remote Support toggle and key exchange generation. In the event CohesiveFT needs to observe runtime state of a VNS3 Manager in response to a tech support request, we will ask you to open Security Group access to SSH from our support IP range and Enable Remote Support via the Web UI. CohesiveFT will send you an encrypted passphrase to generate a private key used by CohesiveFT Support staff to access your Manager. Access to the restricted SSH daemon is completely controlled by the user. Once the support ticket has been closed you can disable remote support access and invalidate the access key. 6

7 Sizing Considerations VNS3 Trial Edition Managers are available as 64bit AMIs but are restricted to the m1.small instance type. All VNS3 Premium Edition Manager AMIs (Lite, SME, and Enterprise) can be launched as larger instance types. Contact us at for AMI information. VNS3 Managers currently generate 1024 bit keys for connecting the clients to the overlay network via the clientpacks. Smaller or larger encryption keys can be provided upon request (from 64 bit to 2048 bit). 7

8 Your Configuration Begins Here! VPC Setup 8

9 Setting up the Amazon Security Groups Option 1: Use the Amazon EC2 command line tools Download the latest Amazon API tools from: At a system command line (Mac examples shown here, see the API Doc for Windows): export JAVA_HOME=/usr (Set Java Home directory) export LAUNCH_HOME=/Users/me/Desktop/BYO/ec2 (Set the path to the directory where you unzipped the export) export EC2_HOME=$LAUNCH_HOME/ec2apitools export PATH=$PATH:$EC2_HOME/bin export EC2_PRIVATE_KEY=$LAUNCH_HOME/myexcellentkey.pem (point to where you have your EC2 private key stored) export EC2_CERT=$LAUNCH_HOME/myexcellentcert.pem (point to where you have your EC2 cert stored) 9

10 Setting up the Amazon Security Groups Option 1: Command Examples For US-East VNS3 Manager: export EC2_URL= ec2-add-group vnscubed-mgr -d "vnscubed managers" ec2-add-group vnscubed-client -d "vnscubed clients" ec2auth vnscubed-mgr -P udp -p o vnscubed-client -u AWS_ACCOUNT ec2auth vnscubed-mgr -P tcp -p o vnscubed-cleint -u AWS_ACCOUNT ec2auth vnscubed-mgr -P tcp -p s ip_address_of_your_firewall/32 ec2auth vnscubed-mgr -P udp -p 500 -s ip_address_of_your_firewall/32 ec2auth vnscubed-mgr -P udp -p s ip_address_of_your_firewall/32 For VNS3 Manager located in another Region: export EC2_URL= (or the appropriate Region URL) <ec2 commands from above> 10

11 Setting up the Amazon Security Groups Option 2: Use the AWS Console Select your desired region. Click Security Groups in the left column menu. Click Create Security Group in the Security Group window pane menu bar. Create a vnscubed-mgr group (for the VNS3 Managers) and a vnscubedclient group (for the VNS3 Overlay Connected Devices). Note the Security Group ID for the Client Group (sg-xxxxxxxx). 11

12 Setting up the Amazon Security Groups Option 2: Add Exceptions to the vnscubed-mgr Group Configure the vnscubed-mgr group with the following exceptions. Add exceptions to your vnscubed-client group as needed based on your topology. UDP Exceptions: Custom UDP rule: port 1194 from Source vnscubed-client Security Group ID (sgxxxxxxxx) Custom UDP rule: port 500 from the IP address of your Firewall/IPsec Device Custom UDP rule: port 4500 from the IP address of your Firewall/IPsec Device TCP Exceptions: Custom TCP rule: port 8000 from Source vnscubed-client Security Group ID (sgxxxxxxxx) Custom TCP rule: port 8000 from the IP address of your current location ( whatismyip.com) to allow you to connect to the VNS3 Manager UI Click Apply Rule Changes. 12

13 Launch the VNS3 Manager Instance 13

14 Launch a VNS3 Manager Switch to the EC2 tab at the top of the AWS Console. Click AMIs in the left column menu under the IMAGES section. Launch a VNS3 Trial Edition instance using the AMI ID supplied by CohesiveFT - Important: VNS3 3.0 AMIs do not need to be launched with a different kernel or ramdisk parameter as with previous VPN3 AMI versions. Elastic IP Recommendation: CohesiveFT recommends the use of an Elastic IP for configuration of your VNS3 deployments. This allows more rapid disaster recovery and upgrade paths. 14

15 Initialize and Configure VNS3 Manager(s) 15

16 Logging in and Configuring the Manager Login to the VNS3 Web UI - IP>:8000 In order to have an encrypted connection to the VNS3 Manager, the web UI uses HTTPS with a self-signed certificate generated on each manager individually on boot. You may need to add a security exception in your browser. Log in with a username of vnscubed, password is the instance id of this EC2 instance (i-xxxxxxx). You can obtain instance id with ec2-describeinstances command line, ElasticFox or AWS Console. Reset your passwords: Reset the Web UI Password - Even though the instance id is unlikely to be guessed, please change it for security purposes. NOTE: Your VNS3 Manager answers to API calls on the same port 8000 as the web interface runs on. Ideally make a separate password for the API usage against the manager. Reset the API Password - Even though the instance id is unlikely to be guessed, please change it for security purposes, again making it a different password than the web interface is probably best. NOTE: CohesiveFT does not have any key access or remote access to your VNS3 Managers unless provided by you. If you forget these passwords we cannot recover them for you. 16

17 Generate Keys on VNS3 Manager The Trial Edition Manager is preconfigured to the Trial License specs: Development and Test License Only 1 Manager Topology 5 Clientpacks 1 IPsec Endpoint 1 Tunnel /22 default Subnet Click Generate New under SSL Certs and Keys in the left column. During key generation you can specify a Topology name to be displayed in the Manager UI for a given set of peered Managers. This can be changed at anytime by clicking on the Topology Name left column menu item. Click Generate keys link. Key generator will be started in the background, and you can refresh screen to observe progress. This process will generate the client credentials that will be loaded onto the devices you wish to connect to the VNS3 overlay network. 17

18 Peering the Managers: Peering Manager 1 Click Setup Manager Peering. Managers connect to each other in a process called Peering. Peered Managers create a redundant, highly available and secure overlay network and share traffic load from the overlay network connected servers. The Peering Setup Page will display the number of Managers allowed to peer together in your topology as defined by the license file used to configure the Manager. In more complex VNS3 deployments users can peer two or more VNS3 Managers together to create a redundant, highly available and secure cloud connectivity solution. For more information on SME and Enterprise Edition configurations contact us at sales@cohesiveft.com. Select this instance and click Save changes. 18

19 VNS3 Manager Status The VPN-Cubed Manager is ready to setup an IPsec Tunnel. You should see all your peered Managers listed under the Links to Other Managers section on each Manager Runtime Status Page. Click IPsec under Peering left menu heading. On the resulting IPsec page note the Configuration Settings needed for configuration. Click Define new remote endpoint. 19

20 IPsec Tunnel Configuration 20

21 VNS3 Manager Setup: Define a New Remote Endpoint Enter descriptive name for the Endpoint configuration, this can be anything. Occasionally there is another router between the IPsec firewall and the Internet. Enter the public facing IP address of either the IPsec device or router between EC2 and the IPsec device (see picture below). Enter a Pre-shared Key and keep a record of that key to be entered into the IPsec device. In this example we use VnscubedRocks for obvious reasons. If your IPsec device is behind a router, enter the external IP interface of the IPsec device (see picture below). Click Create. One the resulting page click New Tunnel. Extra Config Parameters: We recommend connecting to the Manager with tunnels using AES256 encryption and SHA authentication for both IKE and ESP. Add the lines shown to the right - phase1=aes256-sha1 and phase2=aes256-sha1. Extra Parameters can be found on the following page. Please contact support@cohesiveft.com for assistance. 21

22 IPsec Configuration: Extra Parameters VNS3's IPSec subsystem is good at autodiscovery on IKE and ESP choices with a wide range of boxes. We recommend being as specific as possible when entering tunnel parameters. Match the algorithm, hash and DiffieH group for your gateway settings by specifying them in the "Extra Params" text field. We support combinations algorithms 3DES, AES128, or AES256; hashes SHA1 or MD5; and DH groups 2 or 5. VNS3 has beta support for DH 14,15,16,17,18. Example entries for IKE (Phase 1) and ESP (Phase 2) in the extra params box: phase1=aes128-sha1 phase1=aes256-sha1 phase1=3des-md5-dh2 phase1=aes256-sha1-dh5 phase2=aes256-sha1 phase2=3des-sha1 PFS Group Extra params entry for PFS Group is technically required only when it must be different from pfs group in phase1. If that is the case, then use pfsgroup=dh2 pfsgroup=dh5 IKE and ESP Lifetimes phase1-lifetime=3600s (default setting on VNS3) phase2-lifetime=28800s (default setting on VNS3) Dead Peer Detection - Disabled by default, to enable DPD to attempt to re-connect during periods of no response use the following: dpdaction=restart (other options are hold meaning just wait, or clear meaning drop the security association. dpddelay=30s dpdtimeout=90s 22

23 IPsec Configuration: Extra Parameters Other, less frequently used options available are: connection=bidirectional (default) Other options are receive meaning to not initiate connections, only receive them. connection-rekey=yes (default) Other options are no meaning no Phase1 or Phase2 re-key operations are done. compat:some-text This option should only be used at the instruction of CohesiveFT. It allows underlying parameters of the IPSec, BGP, Routing, Firewall, or SSL VPN subsystems to be passed straight into the environment with no parsing or validation. It is only used in a small fraction of interoperability situations. 23

24 VNS3 Manager Setup: Setup a Tunnel Enter the subnet behind the datacenter IPsec Extranet Device. In this example we used /24. Enter the subnet you wish linked to the datacenter subnet. This has a couple common options: The full subnet of the overlay network in this case /22 A subnet of the overlay network, perhaps a specific host like /32 A subnet on another network the VNS3 Manager has a route to which could be a datacenter subnet behind another datacenter remote endpoint, or a subnet in a cloud vlan that the manager has access to. Provide a name for the tunnel to allow for easy identification in more complex topologies. External Ping provides a pinging functionality over the IPsec tunnel that can be used in addition to IPsec DPD and Keep Alive settings to ensure the tunnel remains up during low traffic periods. Enter an IP address of a pingable server located on the Remote Subnet specified. Set the time interval (in seconds) for the ping. Click Create. Note the Configuration Settings values, you will need these to correctly configure your extranet device. 24

25 Configuring the IPsec Extranet Device: VPN Wizard Create a new VPN Tunnel. The Cisco ASA used in this guide does this through a VPN Wizard. If you are using another facility to create your IPsec Tunnel, make sure to enter the same information we enter in the following slides. Choose a Site-to-Site Tunnel Type. Click Next Tunnel Configuration Considerations If you want the tunnel to be perpetual and as close to "always on" as IPSec can do, then: Your gateway should be using its "keepalive" feature, VNS3 has this enabled by default Your gateway should be using Dead Peer Detection (DPD) with a "restart" parameter in the event it believes tunnel is dropped Your VNS3 manager has DPD disabled by default, enable it by adding "dpdaction=restart" dpddelay=30s and dpdtimeout=90s in the extra parameters box (no quotes needed). Your gateway should allow the VNS3 manager to make a connection "inbound to it", by default the VNS3 manager allows inbound connections and attempts outbound 25

26 Configuring the IPsec Extranet Device: VPN Wizard Enter the VNS3 Manager s IP address in the Peer IP Address field. Enter the same Pre-Shared Key entered from page 21 (our example used VnscubedRocks ). Click Next. 26

27 Configuring the IPsec Extranet Device: VPN Wizard Choose your Key Exchange Policy (IKE). Make sure it is the same as the one used in the VNS3 Manager setup. On page 21 we used AES-256. Click Next. 27

28 Configuring the IPsec Extranet Device: VPN Wizard Select the ecryption and authentication algos for the Encapsulating Security Payload (ESP). Make sure it is the same as the one used in the VNS3 Manager setup. Again our recommended setup uses AES-256 from page 21. Click Next. 28

29 Configuring the IPsec Extranet Device: VPN Wizard Setting up Hosts and Networks. The following information will setup a test tunnel to your VNS3 Manager. After the tunnel is up and running you can return to this step and change the Source and Destination information to open up more traffic between your IPsec extranet device and the cloud. Setup a test connection using the subnet available behind the Extranet Device as the Source and the VNS3 Overlay Subnet ( /22) as the Destination. Click Next. 29

30 Configuring the IPsec Extranet Device: VPN Wizard Double check that all the information is entered correctly. Click Finish. 30

31 IPsec Extranet Device: Session Details Make sure the IPsec VPN session is up and running. Goto Monitoring > VPN Statistics > Sessions You should be able to see the session under LAN-to-LAN Click Details. 31

32 IPsec Extranet Device: Session Details The Session Details will give you expanded information about your Key Exchange and IPsec status. 32

33 VNS3 Manager: Check the IPsec Status To check the status of your IPsec connection from the VNS3 Manager click on Runtime Status. Each tunnel will be displayed as a connected tunnel. Click the Tunnel ID for tunnel parameters and to access the IPsec log for that specific connection. If you do not see your tunnel listed, it is not correctly configured. Double check that you have entered all the information correctly in both the VNS3 Manager and your IPsec device. If you are having difficulties please support@cohesiveft.com. Now that the IPsec Tunnel is up and running, clients in EC2 can be added to the secure Overlay Network extension of your Datacenter. 33

34 IPsec Connection Trouble Shooting: Verbose Logging VNS3 allows users to enable Verbose Logging to help with IPsec connection troubleshooting. To enable Verbose Logging click IPsec in the left column menu. Click Logging on the IPsec Page. Click the radio button next to verbose logging. Click Submit. NOTE: Verbose Logging is disabled by default and should remain disabled during normal operations. Leaving Verbose Logging enabled over a extended period of time can fill the Manager instances virtual disk drive. This causes the Manager to become inaccessible via the UI and requires our intervention to free up disk space. 34

35 Client Server Configuration 35

36 Client Configuration: Install Client Credentials In the context of VNS3, client means devices which will be configured as members of the overlay network. These network members will usually be servers running in EC2. In more advanced editions of VNS3 this includes desktop based client machines. Note the Client Download username and password on Status screen on every manager (username is clientpack ). On any Manager go to Client Packs and pick a client pack. A client pack can run on a single client at a time. If you shut down or disconnect client from the topology, you can reuse its client pack. The number of client packs provided in your license depends on your purchased parameters. Alternatively, you can use the API to access the client packs. See the VNS3 API documentation for how to use the command line calls get_next_available_clientpack, fetch_clientpack, and edit_clientpack. 36

37 Client Configuration: Security Group Exceptions Depending on what OS your cloud-based clients are running you will need to add access to the vnscubed-client security group via RDP Port 3389 (Windows) or SSH Port 22 (Linux) in order to add the clientpacks. Additionally Port 8000 access will need to be opened between the vnscubed-mgr and vnscubed-client security groups. For Linux Clients Configuration follow the steps on pages For Windows Clients Configuration follow the steps on page

38 Linux Client Configuration: Add SSH Client Access In order to SSH into your cloud-based Linux client servers SSH access must be granted from your IP to TCP Port 22 in the vnscubed-client security group. Using the EC2 command line: ec2auth vnscubed-client -P tcp -p 22 -s your_physical_machine_ip/32 Once you have successfully downloaded the client key credentials from the manager to the client machines you can revoke this authorization. ec2revoke vnscubed-client -P tcp -p 22 -s your_physical_machine_ip/32 38

39 Linux Client Configuration: Add Port 8000 Access from Client to Manager Group To allow clients launched in the vnscubed-client security group to download their credentials via their command line, you need to MOMENTARILY enable port 8000 access between the vnscubed-mgr and the vnscubed-client groups. Or you download credentials from the VNS3 Manager to an admin machine and then SCP them up to the client - where you would only need the SSH exception described on the previous page. Using the EC2 command line: ec2auth vnscubed-mgr -P tcp -p o vnscubed-client -u AWS_ACCOUNT Once you have successfully downloaded the client key credentials from the manager to the client machines you can revoke this authorization. ec2revoke vnscubed-mgr -P tcp -p o vnscubed-client -u AWS_ACCOUNT 39

40 Linux Client Configuration: Install Client Credentials TWO PHILOSOPHIES FOR INSTALLATION a) SSH Port 22 Exception Only - Have ssh access into a client server (if only for the duration of installation). Download credentials to your trusted admin machine via the VNS3 Manager Client Packs link. SCP them into the client machines, and then SSH into the client machines to complete the configuration. b) Port 22 and Port 8000 Exception - Allow port 8000 and port 22 access as described on the previous pages to a Manager. SSH into the client machine and download the credentials from its command line using the following URL: wget --no-check-certificate Something like: wget --no-check-certificate credentials/172_31_1_53.tar.gz NOTE: The clientpack:password combination is on the status screen of each of the VNS3 Managers. 40

41 Linux Client Configuration: Install OpenVPN You can either install OpenVPN 2.1 on physical servers or virtual servers you already possess to connect those devices to the VNS3 overlay network. For a quick test you might want to use the Elastic Server factory at elasticserver.com. You can quickly assemble a representative application stack for testing in the overlay network and easily deploy to the your Amazon account. Use the OpenVPN for VNS3 2.1 bundle in your servers for a ready-made VNS3 client. You will still have to install a client pack on that device once launched locally or in the EC2 cloud, and configure the file /etc/openvpn/vnscubed.conf. Extract clientpack contents to /etc/openvpn directory (consult OpenVPN documentation for your OS if not found). Edit the vnscubed.conf add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_DNS_ADDRESS 1194 Use the public DNS URL of the Manager for the remote entry. In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 41

42 Linux Client Configuration: Launch OpenVPN Start openvpn. On Linux OSs this is done using the /etc/init.d/openvpn start command. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VNS3 manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary (on Linux, your tunnel device name will be tun0). Verify connectivity by pinging , (the IPs we setup for our Managers on page 15) for manager MGR1 and MGR2, respectively. Usually, the manager whose "remote" line appears first in /etc/openvpn/ vnscubed.conf will be pingable first, other managers will become pingable once they learn about new client. 42

43 Windows Client Configuration: Add RDP Client Access In order to RDP into your cloud-based Windows client servers RDP access must be granted from your IP to TCP Port 3389 in the vnscubed-client security group. Using the EC2 command line: ec2auth vnscubed-client -P tcp -p s your_physical_machine_ip/32 Once you have successfully downloaded the client key credentials from the manager to the client machines you can revoke this authorization. ec2revoke vnscubed-client -P tcp -p s your_physical_machine_ip/32 43

44 Windows Client Configuration: Add Port 8000 Access from Client to Manager Group To allow clients launched in the vnscubed-client security group to download their credentials via IE, you need to enable port 8000 access between the vnscubed-mgr and the vnscubed-client groups. Using the EC2 command line: ec2auth vnscubed-mgr -P tcp -p o vnscubed-client -u AWS_ACCOUNT Once you have successfully downloaded the client key credentials from the manager to the client machines you can revoke this authorization. ec2revoke vnscubed-mgr -P tcp -p o vnscubed-client -u AWS_ACCOUNT 44

45 Windows Client Configuration: Install Client Credentials RDP into the Windows Machine using the Administrator credentials specified when launching the server. Navigate to Manager IP>:8000 in IE. Login using the default vnscubed for the password and username or the password you changed on your first login. Click Client Packs on the left menu. Download the appropriate client pack zip file to the Windows machine. 45

46 Windows Client Configuration: Install OpenVPN Install OpenVPN 2.1 on physical servers or virtual servers you already possess to connect those devices to the VNS3 overlay network. On Vista you will need to have admin privileges to install the software. You will have to install a client pack on the Windows desktop machine and put the client pack files in \Program Files\OpenVpn\config\ RENAME vnscubed.conf to vnscubed.ovpn!!!! Edit the vnscubed.ovpn and add the managers you want this client to connect to in priority at the bottom of the file: remote MANAGER_DNS_ADDRESS 1194 Use the public DNS URL of the Manager for the remote entry. In multiple Manager topologies the order of remote commands matters - client will try to connect to the first remote endpoint, if not successful - to the second, and so on. You may want to evenly distributed clients among managers by varying the order of "remote" commands on each client. 46

47 Windows Client Configuration: Launch OpenVPN Start openvpn. On Windows XP and Vista this can be done through the Services tool or via the command line openvpn vnscubed.ovpn. On Vista if you run it from the command line you will need to know how to start a command line with administrative privileges. Details here: Alternatively, start the OpenVPN service from the Services tool. On Vista and Win2k servers OpenVPN also has a graphical tool - OpenVPN GUI. Your client will get a virtual IP address that corresponds to the clientpack it received. WARNING: If you accidentally give the same client credentials to 2 different devices you will notice the two clients popping off and on the overlay network inside the VNS3 manager Status screen. Only one device can have a set of credentials in the same topology at a time. Adjust local firewall on the client if necessary. Verify connectivity by pinging or (the IPs we setup for our Managers on page 16) for manager ID1, ID2,respectively. Usually, the manager whose "remote" line appears first in /etc/openvpn/vnscubed.conf will be pingable first, other managers will become pingable once they learn about new client. 47

48 Windows Client Configuration: Launch OpenVPN 48

49 Windows Client Configuration: Windows 2008 RegEdit Consideration When setting up OpenVPN as a Service on Windows2008 there can be an issue with the machine resolving IPv6 instead of IPv4. Follow the steps below to fix the problem. 1. Go to "regedit" 2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\tcpip\parameters 3. Double-click the ArpRetryCount value, type 0, and then click OK. If it does not exist create a new REG_DWORD, rename to ArpRetryCount, and set the value to Reboot the machine 49

50 Client Configuration: Clients in the overlay network The key elements of the display to look for are the connections to that manager s peer, both showing the local processes are running and the link as up. You should see the clients listed in the client table at the bottom, connected to the appropriate manager. If this is not the case please check the items listed on the Troubleshooting page of this document. 50

51 VNS3 Firewall 51

52 VNS3 Firewall VNS3 Firewall is controlled using IPTables syntax. For more information - Look for PARAMETERS section and below. In general, you write a specification of a packet to match and what to do with this packet. Customer rules are applied in the middle of overall rules on the manager. If customer rules don't reject a packet, it will be allowed. Order of rules matters - rules are applied from top to bottom up to the first match. If not match is found, packet is allowed. "-j ACCEPT" allows a packet. "-j DROP" drops a packet. "-j REJECT" sends an appropriate notification to sender saying such and such packet was rejected (depends on protocol). Basic examples: * Drop all packets from to s d j DROP * Drop all traffic from /24 (entire subnet) except : -s j ACCEPT -s /24 -j DROP 52

53 Change Username/Password 53

54 Change Username and Password Username and Password can be changed via the Left Column Menu Items. 54

55 VNS3 Snapshots 55

56 Runtime Snapshots save the Manager Configuration Once your VNS3 Managers and Clients are configured and running, save the configuration with Runtime Snapshots. Snapshots can be used to reconfigure a new Manager with the same SSL Certificates and Keyset with just one file upload. Click the Runtime Snapshots link to take a new snapshot or view/ download available snapshots. Download the snapshot to your local network. In the event of a Manager failure or re-provisioning event, you can upload the snapshot file to a new VNS3 Manager. The new Manager will retain all the configuration settings as your saved snapshot. If you are utilizing Elastic IPs, once the Elastic IP is transferred to the new Manager, your overlay network devices will automatically connect back with the Managers. Save time on both Manager and client configuration. 56

57 Save and Download a Snapshot Click the Take New Snapshot Now button to generate a new Snapshot. The resulting screen will have the snapshot download link. Download the Snapshot and save locally. 57

58 Save and Download a Snapshot To use a Snapshot to configure a Manager click the Import Runtime Snapshot link. Browse for your saved Snapshot and upload. The Manager will reboot with the updated configuration. The same client packs will be available in the manager, so redistribution to each server on the virtual network is not necessary. A slight configuration change on each server on the virtual network is necessary if you have not assigned Elastic IPs to your Manager. The OpenVPN configuration file (vnscubed.<conf ovpn>) on each server needs the new IP of the new Manager referenced in the remote commands section. To automate this step, you can assign an Elastic IP (see AWS billing for rates) to the Manager and reference the Elastic IP in each server s OpenVPN configuration file. 58

59 Upgrade License 59

60 Upgrading Licenses To upgrade a license click on the License Upgrade link in the left column of the Web User Interface. A license upgrade needs to be deployed to all of the managers of a peered VNS3 topology. In order to upgrade you will need the upgrade keyset ID which is shown in bold in the image displayed here. Provide that license keyset to CohesiveFT Support and they will use it to generate your upgrade license. In order to apply the new license click Import a new license upgrade, and paste the contents of the license you received, and click Submit. 60

61 Confirming the successful license upgrade Along with the license upgrade key you will have received with the key a License Upgrade ID. After clicking Submit your License Upgrade ID is displayed on the user interface. It should be the same as the one you received with your license upgrade. If your license upgrade requires any new data such as IP Addresses to use for new client packs, there will be an opportunity to enter it on the screen, and then you finalize the upgrade by hitting Submit again. You will then see the contents of the license displayed, and should confirm that your new license contents has the parameters you expected. In this example case the license upgrade added the ability to have 2 more remote endpoint definitions for use with IPsec tunnels. Looking at the previous picture you will see the total of ipsec_max_endpoints was 50, and after the upgrade is increased to

62 Troubleshooting 62

63 Troubleshooting and FAQ for the EC2 Managers Client appears to be hopping on and off the network. This is usually the result of the same client keys being installed on two client machines in the network. Only one client machine can use a set of credentials at a given time. Fetch Keyset appears to hang or not work. Check to see if the Amazon security group is correct for port 8000 between the manager you are getting the keyset from and the manager you are do the fetch from. If they are separated across Amazon USA and Amazon EU you will need to have thier security group reference the public IP addresses. When you do the Fetch Keyset command use the managers public IP address. Manager IDs seem correct, EC2 security groups seem correct, but managers, especially ones launched via separate launch commands will not peer. Review your worksheet and your launch commands. Ensure that the managers were all launched with the same security token. I lost my Web UI Password and so can t manage my server or my API password. CFT does not have access to your VNS3 Server(s). In order for us to potentially provide password recovery you will need to leave remote support enabled, while still blocking the port in your security groups, you will need to have coordinated with CohesiveFT to create a valid access key which is still valid and you can provide when recovery is needed. 63