On-Premise SteelConnect Manager Setup Guide

Transcription

1 On-Premise SteelConnect Manager Setup Guide SCM Launcher version 0.1.x SCM version May 2018

2 2018 Riverbed Technology, Inc. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed or their respective owners. Akamai and the Akamai wave logo are registered trademarks of Akamai Technologies, Inc. SureRoute is a service mark of Akamai. Apple and Mac are registered trademarks of Apple, Incorporated in the United States and in other countries. Cisco is a registered trademark of Cisco Systems, Inc. and its affiliates in the United States and in other countries. EMC, Symmetrix, and SRDF are registered trademarks of EMC Corporation and its affiliates in the United States and in other countries. IBM, iseries, and AS/400 are registered trademarks of IBM Corporation and its affiliates in the United States and in other countries. Juniper Networks and Junos are registered trademarks of Juniper Networks, Incorporated in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. Microsoft, Windows, Vista, Outlook, and Internet Explorer are trademarks or registered trademarks of Microsoft Corporation in the United States and in other countries. Oracle and JInitiator are trademarks or registered trademarks of Oracle Corporation in the United States and in other countries. UNIX is a registered trademark in the United States and in other countries, exclusively licensed through X/ Open Company, Ltd. VMware, ESX, ESXi are trademarks or registered trademarks of VMware, Inc. in the United States and in other countries. This product includes Windows Azure Linux Agent developed by the Microsoft Corporation ( Copyright 2016 Microsoft Corporation. This product includes software developed by the University of California, Berkeley (and its contributors), EMC, and Comtech AHA Corporation. This product is derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm. The SteelHead Mobile Controller (virtual edition) includes VMware Tools. Portions Copyright VMware, Inc. All Rights Reserved. NetApp Manageability Software Development Kit (NM SDK), including any third-party software available for review with such SDK which can be found at and are included in a NOTICES file included within the downloaded files. For a list of open source software (including libraries) used in the development of this software along with associated copyright and license agreements, see the Riverbed Support site at https//support.riverbed.com. This documentation is furnished AS IS and is subject to change without notice and should not be construed as a commitment by Riverbed. This documentation may not be copied, modified or distributed without the express authorization of Riverbed and may be used only in connection with Riverbed products and services. Use, duplication, reproduction, release, modification, disclosure or transfer of this documentation is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military agencies. This documentation qualifies as commercial computer software documentation and any use by the government shall be governed solely by these terms. All other use is prohibited. Riverbed assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation. Riverbed Technology 680 Folsom Street San Francisco, CA Part Number

3 Contents Welcome... 5 About this guide... 5 Documentation and release notes... 5 Contacting Riverbed On-Premise SteelConnect Manager Solution... 7 What is On-Premise SCM?... 7 Supported SteelConnect services and applications Installing On-Premise SCM Before you begin Provisioning the On-Premise SCM image To provision SCM for the first time Logging in to the SCM Launcher and SCM Upgrading SCM DNS setup Modifying the A-record and SRV records for static DNS Configuring DNS to ensure SCM and SteelConnect appliance connectivity Verifying DNS setup Registering an appliance Appliance registration overview Registering an appliance Registering a SteelConnect virtual gateway Migrating from SCM to On-Premise SCM What to know before migrating from SCM to On-Premise SCM Backing up and restoring an On-Premise SCM Generating a certificate and key What s next A - Firewall Ports, VM Requirements, and Troubleshooting Ports required for operation Inbound ports used by On-Premise SCM On-Premise SteelConnect Manager Setup Guide 3

4 Contents Outbound ports used by On-Premise SCM Virtual machine limitations Virtual machine requirements for On-Premise SCM Amazon EC2 and Flow storage requirements for On-Premise SCM Known issues with SCM Static IP address is changed back to the one set by DHCP Troubleshooting On-Premise SCM issues Static IP address overwritten by DHCP address System does not update SCM does not start On-Premise SteelConnect Manager Setup Guide

5 Welcome About this guide Welcome to the On-Premise SteelConnect Manager Setup Guide, SCM Launcher version 0.1.x and SCM version This guide explains how to install and configure the On-Premise version of SteelConnect Manager (On-Premise SCM) on a customer s premises and in an Amazon Virtual Private Cloud (Amazon VPC). This document assumes that you are familiar with SteelConnect and the SteelConnect Manager. For more information about SCM, see the SteelConnect Manager User Guide. Documentation and release notes The most current version of all Riverbed documentation is on the Riverbed Support site at support.riverbed.com. The Riverbed Knowledge Base contains any known issues, how-to documents, system requirements, and common error messages. You can browse titles or search for keywords and strings. To access the Riverbed Knowledge Base, log in to the Riverbed Support site at Each software release includes release notes. The release notes list new features, known issues, and fixed problems. To see the most current version of the release notes, click the version number in the lower-left corner of SCM. We recommend taking a look at the release notes before you begin using a new version of SCM. Contacting Riverbed Technical support - Problems installing, using, or replacing Riverbed products? Contact Riverbed Support or your channel partner who provides support. To contact Riverbed Support, open a trouble ticket by calling RVBD-TAC ( ) in the United States and Canada or outside the United States. You can also go to Professional services - Need help with planning a migration or implementing a custom design solution? Contact Riverbed Professional Services. proserve@riverbed.com or go to Documentation - Have questions about Riverbed s documentation? Send your comments to techpubs@riverbed.com. On-Premise SteelConnect Manager Setup Guide 5

6 Welcome Contacting Riverbed 6 On-Premise SteelConnect Manager Setup Guide

7 1 On-Premise SteelConnect Manager Solution What is On-Premise SCM? On-Premise SteelConnect Manager (On-Premise SCM) is a locally hosted SCM designed for customers who require control of the SD-WAN network configuration and management at their local site, instead of relying on a third-party host. On-Premise SCM is located on site behind your firewall to provide maximum security and allow complete control of the configuration. SCM manages the switches, gateways, and appliances at your site. For more information, see the SteelConnect Manager User Guide. Note: The VM containing the On-Premise SCM installation stores sensitive data such as unencrypted private keys and external services credentials. The VM host is a critical infrastructure; place it behind a firewall and limit the administrative access to it. The topology in Figure 1-1 shows the On-Premise SCM installed on a VM in a corporate network with three SteelConnect sites. Figure 1-1. Simplified On-Premise SCM topology On-Premise SteelConnect Manager Setup Guide 7

8 On-Premise SteelConnect Manager Solution Supported SteelConnect services and applications The top layer in this figure shows Zero Touch Provisioning (ZTP) services, which provide these utilities: Web services An SCM image registry Services used for communication between appliances Services used for registering and licensing appliances Services used to map devices to their corresponding SCM ZTP services reside in the internet and must be reachable from the network and all sites. Make sure the ports of your firewall (placed between the network and the sites) are open to allow communication to the ZTP services. See Appendix A, Firewall Ports, VM Requirements, and Troubleshooting for the list of ports. This figure shows a domain name server (DNS) and a Dynamic Host Configuration Protocol (DHCP) server in the corporate network. These servers must be reachable from the On-Premise SCM and from all three sites. DNS is required to register the On-Premise SCM to ZTP services and to register any new hardware. Therefore, the DNS must be up and running before you install On-Premise SCM. You also configure DNS records that are specific to On-Premise SCM. For details, see DNS setup on page 22. For help to set up DNS, contact your system administrator. DHCP is required to provide DNS, gateway, and IP address information to SCM and the SteelConnect appliance. While DHCP is not required in your network, it is required when you install SCM and any time you reboot SCM. The certificate authority server shown in this figure stores the SSL certificates and keys, in.pem format, that are required for On-Premise SCM to function. See Security certificates on page 11 for details. Supported SteelConnect services and applications On-Premise SCM supports these services with no additional configuration: Application Controller (AppCtrl)/Category Server- A service that classifies applications that are detected by deep packet inspection (DPI) into categories, such as social, productivity, and so on. Dynamic DNS (DynDNS) service - A method to update a name server in DNS. IP Reflector- A method for all gateways to find their public IP address per uplink and report these addresses to the SCM. Network Time Protocol (NTP) - NTP settings are enabled in SCM and no additional configuration is required. To change the default settings or for more information, see the section about NTP settings in the SteelConnect Manager User Guide. Messaging system - On-Premise SCM supports the same services as SCM. You can configure a third-party service; for details, see the SteelConnect Manager User Guide. MessageBird is supported for SMS. No other SMS services are supported with On-Premise SCM. 8 On-Premise SteelConnect Manager Setup Guide

9 Supported SteelConnect services and applications On-Premise SteelConnect Manager Solution On-Premise SCM supports these applications with additional configuration: - Configure this application by completing these steps: Go to this URL to get and copy an API key: At the Realm level in SCM, select the Third-Party Integrations tab and paste the API key you received in the API Key field (highlighted in red in this figure). Refresh the application. Figure 1-2. API screen Configuring your cloud account with Amazon Web Services (AWS) - when you add an AWS account, select an account type of IAM credentials. An access key and a secret key are required. This differs from the default SteelConnect method of choosing an account type of IAM role. Figure 1-3. Selecting AWS Credentials Backup (configuration & flows) - To back up your system, see Backing up and restoring an On- Premise SCM on page 30. On-Premise SteelConnect Manager Setup Guide 9

10 On-Premise SteelConnect Manager Solution Supported SteelConnect services and applications 10 On-Premise SteelConnect Manager Setup Guide

11 2 Installing On-Premise SCM Use the procedures in this chapter to install On-Premise SCM. After installation is complete, use SCM to manage your SD-WAN gateways, WiFi access points, and Ethernet switches with the same functionality as the web-based SCM. For details, see the SteelConnect Manager User Guide and the SteelConnect SD-WAN Deployment Guide. Before you begin Here s what you need to install On-Premise SCM. Riverbed-provided links and files Link to the On-Premise SCM Open Virtualization Appliance (OVA) image - Use the link to download and install the OVA image. Riverbed-supplied license token - Use the token to license SteelConnect. Virtual machine VMware ESXi virtualization (hypervisor) software - Use this software to import the On-Premise SCM virtual appliance (OVA) file. This software must be already downloaded, installed, and ready to use. On-Premise SCM has been tested with ESXi version 6.0. Adequate CPU and memory (RAM) in the VM - See Virtual machine requirements for On-Premise SCM on page 35 for CPU and memory requirements for small, medium, and large networks. Adequate IP of the VM - Use an IP address outside the /16 range. See Virtual machine limitations on page 34. Security certificates SSL certificates and keys (in PEM format) - Required for the fully qualified domain name (FQDN) you are using for SCM (for example, scm.example.com). Use your certificate authority to generate the certificate and key, or create them by following the procedures in Generating a certificate and key on page 31. When you create the certificate, be sure to match the FQDN of the SCM in the DNS with the common name in the certificate. On-Premise SteelConnect Manager Setup Guide 11

12 Installing On-Premise SCM Provisioning the On-Premise SCM image Network access and device requirements Internet connectivity - On-Premise SCM uses the internet to communicate with the web-based ZTP services. DHCP - to provide DNS, gateway, and IP address information to SCM and the SteelConnect appliance, DHCP is required when you install SCM and any time you reboot SCM. DNS server - A server to which you can add A-record and SRV record entries and that is accessible to SCM and all SteelConnect appliances is required. See DNS setup on page 22 for details. Open ports to external services - if your network is behind a firewall, open the ports to the external services that are required for On-Premise SCM. See Appendix A, Firewall Ports, VM Requirements, and Troubleshooting for a list of the ports. Provisioning the On-Premise SCM image To provision the On-Premise SCM image, you import the On-Premise SCM virtual appliance (OVA) file, which starts the On-Premises SCM Launcher (SCM Launcher). You then add the required values to provision and start SCM for the first time. To import the OVA file VMware ESXi virtualization (hypervisor) software is required. Note: If this installation is for demonstration purposes only, you can use Oracle VirtualBox or VMware Fusion; however, functionality of the On-Premise SCM can t be guaranteed. 1. Open VMware ESXi. 2. Right-click Host in the VMware Host Client inventory and select Create/Register VM. The New Virtual Machine opens. 3. In the Select creation type page, select Deploy a virtual machine from an OVF or OVA file and click Next. 4. In the Select OVF and VMDK files page, enter a name for the virtual machine. 12 On-Premise SteelConnect Manager Setup Guide

13 Provisioning the On-Premise SCM image Installing On-Premise SCM 5. Click the blue pane, select Riverbed-supplied OVA file, click Open, and then click Next. Figure 2-1. Select OVF and VMDK files page 6. In the Select Storage page, select a datastore from the list of available datastores and click Next. See Virtual machine requirements for On-Premise SCM on page 35 for memory requirements based on network size. The storage shown in Figure 2-2 provides enough space for a large network deployment. Figure 2-2. Select Storage page On-Premise SteelConnect Manager Setup Guide 13

14 Installing On-Premise SCM Provisioning the On-Premise SCM image 7. In the Deployment Options page, select the following options. In the Network mappings field, specify a port group associated with a connected Network Interface Card (NIC). Be sure that the port group has access to all the inbound and outbound ports that are required for On-Premise SCM to function. See Ports required for operation on page 33 for details. In the Disk provisioning field, select either Thin or Thick. This figure shows Thin being selected, however selecting Thick can give better performance and reduce datastore over-subscription issues. Click Next. Figure 2-3. Deployment Options page 14 On-Premise SteelConnect Manager Setup Guide

15 Provisioning the On-Premise SCM image Installing On-Premise SCM 8. In the Ready to complete page, review your options and click Finish. The On-Premise SCM instance is created on the virtual machine. Figure 2-4. Ready to complete page 9. Click the Console tab in the virtual machine and make a note of the IP address that is displayed. You use this address to log in to the SCM Launcher. The address is blurred out in this figure. Note: If the IP address is in the /16 range, you need to reconfigure your DHCP server to provide addresses outside this range and then restart the VM in order to get another IP address. See Virtual machine limitations on page 34. Figure 2-5. Console tab and IP address in the VM On-Premise SteelConnect Manager Setup Guide 15

16 Installing On-Premise SCM Provisioning the On-Premise SCM image To provision SCM for the first time 1. Using a browser, log on to the SCM Launcher at using the IP address that you received in Step 9 of the previous procedure. 2. When the Provision SteelConnect Manager page displays, click OK to change the default password, and then change the password from the default. Figure 2-6. Provision SteelConnect Manager page 3. In the Token value field, enter the Riverbed-supplied token value. 4. Click Upload Certificate, then navigate to and upload your certificate file. If you generated this file, it is named gui-cert.pem. This file must be in.pem format. 5. Click Upload Key, then navigate to and upload the file that contains the license keys for the certificate file you uploaded in Step 4. If you generated this file, it is named gui-key.pem. The license key must not require a password. 6. Enter these values in the Provision SteelConnect Manager page: In the Fully Qualified Domain name field, enter the FQDN for SCM. In the Time zone field, enter the time zone for SCM. 16 On-Premise SteelConnect Manager Setup Guide

17 Provisioning the On-Premise SCM image Installing On-Premise SCM 7. Optional: To set a static IP address for SCM and the DNS server, complete these steps. If you are using DHCP to get the IP address, these steps are not required. In the IP address field, click the Static tab. In the IP Address field, enter the IP address of the DNS server, Gateway, the IP address to use for SCM, and the subnet mask. 8. In the Set Login information fields, enter a username and password for the SCM Launcher. Make a note of this information; it can t be retrieved and is required to log in to the SCM Launcher. 9. Click Provision. It might take up to 45 minutes to provision the SCM. Note: After you provision SCM for the first time, the SCM Launcher changes appearance. To view or edit any of this information after provisioning, click Settings in the left navigation pane. Logging in to the SCM Launcher and SCM 1. Using a browser, log on to the On-Premises SCM Launcher at This is the same IP address you used in the previous procedure. For user name and password, use the credentials you created in the Provision SteelConnect Manager page. Figure 2-7. SCM Launcher login page 2. Click Visit your SteelConnect Manager on the top right of the SCM Launcher page to go to SCM. The default user name is admin and the default password is pppp. Figure 2-8. Visit SteelConnect Manager If SCM does not start, see SCM does not start on page 36 for troubleshooting tips. On-Premise SteelConnect Manager Setup Guide 17

18 Installing On-Premise SCM Provisioning the On-Premise SCM image Upgrading SCM When you start the SCM Launcher for the first time, it connects to the ZTP services using SSL (x509) certificates and the latest image is retrieved. Verify that you have the latest image by performing the steps in this procedure. Use this procedure if you are running an existing On-Premise SCM; this procedure upgrades your SCM version from 2.7 to Important: Schedule a maintenance window for this upgrade; the Launcher and the SCM versions are both updated during this procedure, which can take up to 8 hours. Important: We strongly recommend that you upgrade the firmware on any gateways immediately after upgrading SCM. If the gateway firmware is running SCM version 2.7, existing VPN tunnels between gateways will have a service impact after SCM upgrade. For more information about upgrading gateway firmware, see Step 3 of the upgrade procedure. To upgrade On-Premise SCM 1. Back up the system by completing the following steps: Take a snapshot of your VM using the ESXi snapshot utility. Refer to the VMware ESXi documentation for details. Back up the On-Premise SCM by completing the procedure in To back up an On-Premise SCM on page From the SCM Launcher, check the software version by clicking Visit your SteelConnect Manager on the top right of the page. The default username for SCM is admin and the default password is pppp. 18 On-Premise SteelConnect Manager Setup Guide

19 Provisioning the On-Premise SCM image Installing On-Premise SCM Earlier versions display the software version on the lower left of the page in the left navigation bar. If the version displayed is 2.7, the SCM requires an upgrade. Figure 2-9. Version number on SCM page earlier software versions Later versions of SCM display the version by clicking the Help button. The version is shown in the What s New area. On-Premise SCM supports a software version of Figure Version number on SCM page later software versions On-Premise SteelConnect Manager Setup Guide 19

20 Installing On-Premise SCM Provisioning the On-Premise SCM image 3. Make sure that the SCM upgrades its gateway firmware immediately after the SCM upgrade by choosing Realm, then clicking the Maintenance tab, and then making sure that Apply firmware upgrades immediately is set to On. Figure Setting firmware updates to On 4. Return to the SCM Launcher page and click Upgrade. If the version on the SCM matches the version listed in the Upgrade page, no update is required. 5. Click the Update button to upgrade SCM and the SCM Launcher to the latest version. Figure Upgrading the SCM software 20 On-Premise SteelConnect Manager Setup Guide

21 Provisioning the On-Premise SCM image Installing On-Premise SCM These screens display during the upgrade. Figure Upgrade beginning Figure Upgrade complete 6. Log in to the SCM Launcher and SCM and check the Launcher and SCM versions. The SCM Launcher version should be and the SCM version should be On-Premise SteelConnect Manager Setup Guide 21

22 Installing On-Premise SCM DNS setup 7. Make sure that the firmware SCM upgrades its firmware immediately by choosing Realm, then clicking the Maintenance tab, and making sure that Apply firmware upgrades immediately is set to On. Figure Setting firmware updates to On If the upgrade failed, see System does not update on page 36 to troubleshoot update issues. DNS setup Make these DNS changes to allow your network to run On-Premise SCM: Modify the A-record and Service (SRV) records to add DNS settings. See Modifying the A-record and SRV records for static DNS on page 22 for details. Configure DNS to make sure that the SCM domain name can be resolved for all SteelConnect appliances. See Configuring DNS to ensure SCM and SteelConnect appliance connectivity on page 24 for details. Modifying the A-record and SRV records for static DNS Add or modify the following settings in the DNS A-record. If you do not have access to DNS records, ask your network administrator to configure these settings. Configuration depends on the type of server software that is used (for example, BIND or Microsoft DNS). The A-record uses the IP address of the VM where the On-Premise SCM is hosted and the FQDN uses the SCM name. 22 On-Premise SteelConnect Manager Setup Guide

23 DNS setup Installing On-Premise SCM A-Record example for Windows Server This figure shows an A-record in Windows Server. The FQDN is the SCM name (scm.example.com) and the IP address is Figure Sample A-record in Windows Server The SRV record must have these settings: Field Service Proto Host Setting cc tcp A_record Priority 10 Weight 10 Port 3900 TTL 60 seconds On-Premise SteelConnect Manager Setup Guide 23

24 Installing On-Premise SCM DNS setup SRV record example for Windows Server This figure shows an SRV record in Windows Server, using the SCM FQDN of scm.example.com. Note the use of _cc and _tcp for service and protocol. Figure Sample SRV record in Windows Server Configuring DNS to ensure SCM and SteelConnect appliance connectivity On-Premise SCM deployments require additional configuration to make sure that SteelConnect appliances use the DNS server with the modified A-record and SRV record. This configuration ensures that the SCM domain name can be resolved for all SteelConnect appliances, and prevents the SteelConnect appliance from using public Google DNS servers if the default DHCP-assigned DNS server fails. See Registering an appliance on page 26 for more information about appliance registration. There are two methods to configure DNS. Choose one that is best for the network: To configure SCM so that the private DNS server resolves all queries, including the A-record and SRV record of the SCM, use To change the DNS settings for all DNS queries on page 24. To configure SCM so that the DNS server resolves the SCM-specific domain while other queries (including A-record and SRV record queries) go to the default DNS server, use To resolve DNS labels using specific internal servers on page 25. To change the DNS settings for all DNS queries 1. Log in to SCM and choose Network Design > Sites. 2. Select a site from the list. 3. Select the DNS tab. 24 On-Premise SteelConnect Manager Setup Guide

25 DNS setup Installing On-Premise SCM 4. After Site DNS Server, specify the IPv4 or IPv6 DNS server primary IP address and click Submit. To resolve DNS labels using specific internal servers 1. Choose Network Design > Sites. 2. Select a site from the list. 3. Select the DNS tab and click New DNS route. Figure DNS tab 4. In the Domain field, specify the domain name of the SCM. For example, if your SCM FQDN is scm.example.com, add scm.example.com to the list of domains. Figure New DNS route 5. Specify the IPv4 or IPv6 address of the target server to use to route the domain. Separate multiple IP addresses with a space. Verifying DNS setup To confirm that the DNS service is set up properly, you can run one of these commands: On-Premise SteelConnect Manager Setup Guide 25

26 Installing On-Premise SCM Registering an appliance nslookup -q=srv _cc._tcp.<domain.com> or dig srv _cc._tcp.<domain.com> The response should return the On-Premise SCM's hostname. Registering an appliance After SCM is running in your enterprise network, register appliances to it. These sections describe how SteelConnect registers appliances and the steps you perform to register them. Appliance registration overview For a SteelConnect hardware (non-virtual) appliance, you enter the serial number of the appliance, which facilitates the pairing of the SCM and appliance. SteelConnect appliances find their assigned SCM using the registration process shown in this figure. Figure SCM registration process 26 On-Premise SteelConnect Manager Setup Guide

27 Registering an appliance Installing On-Premise SCM These steps describe the hardware registration process. The numbers correspond to the callouts shown in the figure. The SteelConnect appliance boots and gets an IP address from DHCP or another network service. The DNS must have a record of the URL used for the ZTP services or the gateway can t perform the next steps.most enterprise DNS servers can resolve external host names. To configure DNS for On- Premise SCM, see DNS setup on page 22. The appliance contacts the server used for ZTP services, which replies with the SRV record of the assigned SCM. The appliance sends its serial number and DNS information to the ZTP services located in the cloud. Once received, the ZTP services confirm the received information with the information found in its database. The appliance queries a DNS server to resolve the SRV record, which results in the appliance receiving a domain address and port from the assigned SCM. The gateway registers itself to its assigned On-Premise SCM and downloads its configuration. Registering an appliance Complete this procedure to register a hardware appliance. To register a hardware SteelConnect appliance 1. Choose Organization. 2. Choose Appliances. 3. Click Register hardware appliance. 4. Enter the serial number of the appliance and click Submit. Figure Adding a hardware (non-virtual) gateway SCM will inform ZTP of the pairing. After the appliance is powered on, it contacts ZTP, which pairs SCM with the appliance. On-Premise SteelConnect Manager Setup Guide 27

28 Installing On-Premise SCM Migrating from SCM to On-Premise SCM Registering a SteelConnect virtual gateway An internet connection is required to register a virtual gateway. After you download the image and bring up the virtual machine, the virtual gateway contacts the ZTP services using the internet connection to pair SCM with the virtual gateway. To register a SteelConnect virtual gateway 1. Choose Organization. 2. Choose Appliances. 3. Click Add appliances. 4. Select the OVA image associated with the virtual appliance. Figure Adding a virtual gateway 5. Optionally, override the default DNS for the virtual gateway by navigating to Network > Sites > DNS and entering the IP address for the DNS server that is used to connect to the ZTP services. This information is saved in the OVA file and is used for the gateway to connect to ZTP, as well as to pair the gateway with SCM. Migrating from SCM to On-Premise SCM If you have an existing SCM setup, you can migrate an organization to On-Premise SCM. Use the guidelines and procedures in the following sections to migrate from SCM to On-Premise SCM. 28 On-Premise SteelConnect Manager Setup Guide

29 Migrating from SCM to On-Premise SCM Installing On-Premise SCM What to know before migrating from SCM to On-Premise SCM On-Premise SCM must have a connection to the Internet to function. See Appliance registration overview on page 26 for an overview of the registration process for On-Premise SCM. Backups are managed by the customer. See Backing up and restoring an On-Premise SCM on page 30 for the procedures to back up and restore On-Premise SCM. High availability is managed by the customer using the capabilities in ESX; Riverbed does not manage HA for On-Premise SCM. Service-level agreements (SLAs) are managed by the customer. To migrate from SCM to On-Premise SCM 1. Refer to the instructions in the you received to download the On-Premise SCM software. 2. Install and provision On-Premise SCM on an ESX system by completing the procedures in Provisioning the On-Premise SCM image on page 12, Logging in to the SCM Launcher and SCM on page 17 and Upgrading SCM on page Make sure that the On-Premise SCM and the non-on-premise SCM versions are at versions To export and download data for an organization from SCM 1. Log in to your current SCM and click Realm to enter Realm Admin mode. 2. Click Organizations in the left navigation bar. 3. Click the name of an organization in the Organizations area. 4. Click the Import/Export tab. 5. Click (Re-) Generate export package to generate an export package. Figure Exporting an organization file 6. Make a note of the download location. 7. Perform this procedure for each organization in your realm. On-Premise SteelConnect Manager Setup Guide 29

30 Installing On-Premise SCM Backing up and restoring an On-Premise SCM To import data for an organization to On-Premise SCM 1. Log in to On-Premise SCM and click Realm to enter Realm Admin mode. 2. Click Organizations. 3. Click New > Import. Figure Importing a new organization 4. Click Browse and locate the file for the organization that you downloaded in To export and download data for an organization from SCM on page After the organization is imported, select the name of the organization and click the Import/Export tab. 6. Click Migrate Organization to this controller. 7. Perform this procedure for each organization in your realm. Backing up and restoring an On-Premise SCM We recommend taking advantage of VMware features when you deploy On-Premise SCM. VM features include fault tolerance, high availability, Distributed Resource Scheduler (DRS), and the ability to back up without interference with the VM that is running. Backups should be performed on a regular schedule as with all other production applications. In addition to VMware backups, you can download and back up the current configuration for backup purposes. Note: There is no need to backup the gateways, access points, or switches. Configurations of the devices are stored in SCM and pushed to the devices when connected to the network, along with any firmware. 30 On-Premise SteelConnect Manager Setup Guide

31 Generating a certificate and key Installing On-Premise SCM To back up an On-Premise SCM 1. Log in to the SCM Launcher and click Backup or Restore. Figure Backup or Restore 2. Click Backup SCM Now. The file is saved to the browser s configured download location. 3. Click OK when the backup is complete. To restore an On-Premise SCM from a previous image 1. Log in to SCM. 2. Click Backup or Restore. 3. Select Restore from Saved File. 4. Select the file from which to restore. 5. Reboot the system. Note: If you set static values for the SCM or DNS server, specify those values after the backup. Generating a certificate and key All communication between the appliances and ZTP, as well as all interoperating services inside of ZTP, are authenticated through SSL (x509) certificate validation, which can either be generated by the certificate authority being used by the enterprise or by using this procedure. To generate the SSL certificate and key without using a certificate service 1. Open a command-line interface (CLI) window with a machine that is running the OpenSSL toolkit. On-Premise SteelConnect Manager Setup Guide 31

32 Installing On-Premise SCM Generating a certificate and key 2. Using OpenSSL, create the key and certificate request by running these commands: openssl genrsa -des3 -passout pass:x -out server.pass.key 2048 openssl rsa -passin pass:x -in server.pass.key -out server.key openssl req -new -key server.key -out server.csr Note: A series of questions are asked when you run this script. When asked for the Common Name, use the FQDN of the SCM. 3. Download the server.csr file. 4. Send the server.csr file to your Certificate Authority to be signed, or use OpenSSL to sign it by running these commands: openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt openssl x509 -inform PEM -in server.crt > gui-cert.pem openssl rsa -in server.key -text > gui-key.pem 5. If you generated the certificate (gui-cert.pem) and key (gui-key.pem) files with OpenSSL, save those files. 6. Upload the files using the procedure in To provision SCM for the first time on page 16. What s next For more information about using SCM, see the SteelConnect Manager User Guide. For more information about deploying SteelConnect, see the SteelConnect SD-WAN Deployment Guide. 32 On-Premise SteelConnect Manager Setup Guide

33 A Firewall Ports, VM Requirements, and Troubleshooting If your network is behind a firewall, you need to open ports to the external services before you install the On-Premise SCM virtual image. This appendix lists the inbound ports (administrative and application/end user) and outbound ports that you may need to open. Ports required for operation Make sure that the following ports are open in your firewall for On-Premise SCM to function. Port Service System 22 SSH VM 443 HTTPS SCM 3898 API VM 3899 UI VM 3900 NODE API SCM 3901 TUNNEL SCM 3902 HYDRA SCM 3903 PROXY SCM 3904 SteelConnect SDI-5030 gateway SCM Inbound ports used by On-Premise SCM This table lists the inbound administrative ports used by On-Premise SCM. Port Service Description 22 SSH VM instance shell access 53 DynDNS Local or remote DNS server 443 HTTPS SCM web application over HTTPS access (user access) Note: Port 80 requests are not redirected to the HTTPS port SSH SCM instance shell access On-Premise SteelConnect Manager Setup Guide 33

34 Firewall Ports, VM Requirements, and Troubleshooting Outbound ports used by On-Premise SCM Port Service Description 3898 MGMT API Management API 3899 WEB GUI Web-based management console Important: This port is required for basic installation and configuration APPS Apps 3901 NODE Port node used to connect to the SCM 3902 NODE Port node used to connect to the SCM 3902 SSH SCM instance shell tunneling port used to support access 3904 NODE SDI-5030 Outbound ports used by On-Premise SCM This table lists the outbound ports used during operation of On-Premise SCM. Port Service URL Description 21, 80, 443 OS updates us.archive.ubuntu.com/ security.ubuntu.com OS updates 53, 443 AppCtrl/ Category server appcs.x.riverbed.cc x.riverbed.cc Application control 80 IP reflector rfl.ocedo.com rfl.x.riverbed.cc 443 Core core.ocedo.cc (ZTP services) core.riverbed.cc portalcheck.ocedo.com Quay.io (Docker container services for SCM updates, *.amazonaws.com 465 AWS SES SMTP -smtp.us-east- 1.amazonaws.com IP reflector Used for zero touch provisioning (ZTP) services, messaging system (if configured), licensing, backing up and restoring, access to the Riverbed support site, data center gateway cluster service (if required), Docker container service, Dynamic DNS (DynDNS) service, AppCtrl/Category server, Portalcheck Mail delivery and notifications Virtual machine limitations The IP address of the VM must be outside the /16 range because this range is the default IP class used by docker (docker0). 34 On-Premise SteelConnect Manager Setup Guide

35 Virtual machine requirements for On-Premise SCM Firewall Ports, VM Requirements, and Troubleshooting Virtual machine requirements for On-Premise SCM Adequate CPU and memory (RAM) space must be reserved in the VM. The VM size depends on the number of appliances (nodes) that are in your network. This table provides the definitions for small, medium, and large networks. Network type Small networks Medium networks Large networks Full-mesh 50 nodes 100 nodes 250+ nodes Hub-and-spoke 100 nodes 200 nodes 500+ nodes This table describes the required CPU, memory, and flow storage required by network size. Network component Small networks Medium networks Large networks CPU core 2-GHz Memory (in GB) Storage for flows (based on 15-day storage) (in GB) Amazon EC2 and Flow storage requirements for On-Premise SCM Specify an adequate EC2 instance type and storage for network flows. Use these tables to determine the resources you need based on your network size. Network type Small networks Medium networks Large networks Full-mesh 50 nodes 100 nodes 250+ nodes Hub-and-spoke 100 nodes 200 nodes 500+ nodes This table describes the required EC2 and EBS required by network size. Network component Small networks Medium networks Large networks EC2 instance type t2.large t2.xlarge m4.4xlarge Storage for flows (based on 15 storage) (in GB) Known issues with SCM A gateway can fail to send statistics when connected to an unregistered modem. For details, see the Riverbed Knowledge Base article S32132 at index?page=content&id=s On-Premise SteelConnect Manager Setup Guide 35

36 Firewall Ports, VM Requirements, and Troubleshooting Troubleshooting On-Premise SCM issues Static IP address is changed back to the one set by DHCP In an on-premise installation prior to , when using the boot menu to configure the IP as static, this setting will not take effect. Even after the upgrade to , this setting will not take effect; that is, the IP will remain dynamic and have the value previously set by DHCP. However, when using the same boot menu during a fresh installation, it works as expected (IP becomes static). To stay with a static IP after an upgrade, set the IP to static from the UI, not from the boot menu. For more information, see the Riverbed Knowledge Base article S32371 at supportkb.riverbed.com/support/index?page=content&id=s Troubleshooting On-Premise SCM issues Static IP address overwritten by DHCP address A static IP address can be overwritten by a DHCP address when the static IP address lease expires. This condition is caused by the DHCP client not being terminated after the static IP address is set. To fix this issue, reboot the virtual machine after you set a static IP address. System does not update If the SCM does not update, check for connectivity issues to the internet. The current update process includes an Ubuntu system upgrade and security patches, and a connection to the ZTP services must be established, both of which require internet access. On-Premise SCM versions do not currently require mandatory updates; you can choose when to update the SCM. SteelConnect versions later than 2.7 are not supported. SCM does not start If your SCM does not start after being provisioned, check the following issues: Make sure that the FQDN matches in the following places: The certificate generated by the Certificate Authority or OpenSSL The name of the SCM The DNS A Record Make sure that DHCP is activated across all sites in your network where SCM and SteelConnect appliances are deployed. DHCP provides the IP address to SCM and the SteelConnect appliances at system startup. Make sure that DHCP is supplying a DNS value that can resolve public IP addresses and is able to connect to the ZTP services. If you use Dynamic DNS (DynDNS), make sure that a firewall does not block this service or On- Premise SCM can t start. System logs indicate the problem. 36 On-Premise SteelConnect Manager Setup Guide

37 Troubleshooting On-Premise SCM issues Firewall Ports, VM Requirements, and Troubleshooting Make sure the IP address of the VM is outside the /16 range. See Virtual machine limitations on page 34. On-Premise SteelConnect Manager Setup Guide 37

38 Firewall Ports, VM Requirements, and Troubleshooting Troubleshooting On-Premise SCM issues 38 On-Premise SteelConnect Manager Setup Guide