OneSign Virtual Appliance Guide A OneSign Virtual Appliance is a self-contained software implementation of the OneSign server that is functionally equivalent to a OneSign hardware appliance. You host and manage OneSign Virtual Appliances (OVA) using VMware virtualization software. This provides the procedures and background information you need to configure a OneSign virtual appliance. Overview of OneSign Virtual Appliances - describes the appliance and its controls, connections, and specifications. Deploying the OVA - describes how to deploy the OneSign Virtual Appliance in the different VMware virtualization environments. Configuring OneSign Virtual Appliances - shows you how to configure a deployed OneSign Virtual Appliance for use in an enterprise. For additional information about hosting Virtual Machines, refer to the documentation for your VMware product.
Contacting Imprivata, Inc. Website http://www.imprivata.com email support@imprivata.com Phone Support in North America (800) 935-5958 Outside North America 001-408-987-6072 Sales (877) OneSign (663-7446) Office address 10 Maguire Road, Lexington, MA 02421-3120, United States of America 2013 Imprivata, Inc. All Rights Reserved. This product is distributed under licenses restricting its use, copying, distribution and decompilation. Portions of this product are protected under US Patent Number 7,356,705. OneSign, Imprivata, and the Imprivata logo are registered trademarks of Imprivata, Inc. ProveID is a trademark of Imprivata, Inc. in the United States and in other countries. Under international copyright laws, neither the documentation nor software may be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form, in whole or in part without the prior written consent of Imprivata, Inc., except as described in the license agreement. The names of companies, products, people, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. ii
Table of Contents Contacting Imprivata, Inc.... ii Chapter 1 - Overview of OneSign Virtual Appliances...1 Chapter 2 - Deploying the OVA...3 Chapter 3 - Configuring OneSign Virtual Appliances...7 Configuring the OneSign Virtual Appliance on the Network... 8 Accessing the OneSign Virtual Appliance Functions Menu... 10 OneSign Virtual Appliance Menu Descriptions... 11 Using the OneSign Virtual Appliance in a VMware ESX Thin-Provisioned Environment... 12 Deploying a Thin-Provisioned OneSign Virtual Appliance... 13 i
ii
Overview of OneSign Virtual Appliances 1 A OneSign Virtual Appliance is a self-contained software implementation of the OneSign server that is functionally equivalent to a OneSign hardware appliance. You can host and manage OneSign Virtual Appliances (OVA) using VMware virtualization software. What to do Deploy the Virtual Machine - The steps for deploying the OVA in three different VMware environments are detailed in Deploying the OVA on page 7. Configure the OVA - After the OVA has been deployed, you must configure it for service as decribed in Configuring OneSign Virtual Appliances on page 7 For additional information about hosting Virtual Machines, refer to the documentation for your VMware product. What you need Each OneSign Virtual Appliance requires: VMware ESX or ESXi with vsphere 4.x, 2 CPUs 258 GB of allocated disk space 8 GB of allocated memory You can deploy a heterogeneous enterprise with both virtual and hardware OneSign Appliances if your license permits it. OneSign Virtual Appliances cannot be part of a FIPScompliant OneSign Enterprise. 1
Chapter 1 - Overview of OneSign Virtual Appliances 2
Deploying the OVA 2 You can deploy the virtual appliance to VMware ESX or ESXi. Deploy the OneSign Virtual Appliance as a VMware Virtual Machine in vsphere. To deploy a OneSign Virtual Appliance on an ESX or ESXi server: 1. Log into the vsphere Client. 2. Click Inventory. The Inventory screen appears: The vsphere Client 3
Chapter 2 - Deploying the OVA 3. Click File > Deploy OVF Template. The Deploy OVF Template window appears: Deploy the OVF Template 4. Select Deploy from file and open the.ovf file supplied by Imprivata. 5. Click Next. The OVF Template Details screen appears: 4
Review the Properties of the OneSign Virtual Appliance 6. Review the information and click Next. The Name and Location screen appears: Give the OneSign Virtual Appliance a Descriptive Name 7. Enter a name for the VMware Virtual Machine and click Next. 5
Chapter 2 - Deploying the OVA 8. The Ready to Complete screen appears. Review the information and click Finish to deploy the OneSign Virtual Appliance. Deploying OneSign Virtual Appliance 9. After the OneSign Virtual Appliance finishes deploying, power on the Virtual Machine. Select the OneSign Virtual Appliance from the Virtual Machines Tab See Configuring OneSign Virtual Appliances on page 7 to continue configuring the OVA. 6
Configuring OneSign Virtual Appliances 3 You can access the OneSign Virtual Appliance from the VMware Virtual Machine console after configuration. After deploying a OneSign Virtual Appliance, you must configure it on your network from the OneSign Virtual Appliance console by opening the virtual machine console in your VMware software. After the OneSign Configuration Wizard, you can access other OneSign appliance functions from the OneSign Virtual Appliance menu. This section includes: Configuring the OneSign Virtual Appliance on the Network on page 8 Accessing the OneSign Virtual Appliance Functions Menu on page 10 Using the OneSign Virtual Appliance in a VMware ESX Thin-Provisioned Environment on page 12 The OneSign Virtual Appliance in a Virtual Machine Console 7
Chapter 3 - Configuring OneSign Virtual Appliances Configuring the OneSign Virtual Appliance on the Network The OneSign Virtual Appliance runs initialization scripts that can take a varying amount of time. You can begin configuring the appliance when the OneSign Virtual Appliance console appears. To configure the appliance: 1. Open the virtual machine console in your VMware host. The OneSign Virtual Appliance console appears: Select Login from the Menu Note: Do not select the other options from the menu. 2. Select Login and press Enter. A login screen appears: Login to the Appliance 3. At the login prompt, enter menu and press Enter. 4. Enter the appliance IP address and press Enter. 5. Enter the appliance subnet mask and press Enter. 6. Enter the appliance gateway and press Enter. Note: Settings are not persisted. Do not shut down the virtual appliance until you finish the wizard. 8
The OneSign Virtual Appliance menu appears: Configuring the OneSign Virtual Appliance on the Network Exit the Menu to Finish Configuration Options in this menu are described in OneSign Virtual Appliance Menu Descriptions on page 11. 7. Press 6 and then Enter to return to the OneSign Virtual Appliance menu. You Can Begin the OneSign Configuration Wizard You can now begin the OneSign Configuration Wizard. Open an Internet Explorer (V6.0 or later) browser window to: https://<appliance IP address>:81/. 9
Chapter 3 - Configuring OneSign Virtual Appliances Accessing the OneSign Virtual Appliance Functions Menu You can access the OneSign Virtual Appliance function menu at any time from the OneSign Virtual Appliance menu. Not all menu options are available until you complete the OneSign Configuration Wizard. To access the OneSign Appliance menu: 1. Open the virtual machine console in your VMware host. The OneSign Virtual Appliance console appears: 2. Select Login and press Enter. The OneSign Appliance Console 3. At the login prompt, enter menu and press Enter. If prompted, enter the menu password and press Enter. The OneSign Virtual Appliance functions menu appears: The OneSign Appliance Menu See OneSign Virtual Appliance Menu Descriptions on page 11 for descriptions of the menu options. 10
Accessing the OneSign Virtual Appliance Functions Menu OneSign Virtual Appliance Menu Descriptions You can change network settings, shutdown/reboot the system, reset the Appliance Administrator password, clear SSL information, reset the appliance, and modify the OneSign Virtual Appliance menu password. The OneSign Virtual Appliance menu options are: Configure Network - lets you change the default gateway for the appliance. It is for installation only. Change this setting from the Network tab under the Network page of the Appliance Administrator. Reset SSL - clears all SSL information, including the optional SSL 2.0 setting. Reset admin password for Appliance UI - resets the administrator password to admin. You cannot reset the superadmin password. Modify Password for this menu - lets you set or clear the password for this menu. Restage - resets the appliance to factory settings. Contact Imprivata Support for assistance with restaging an appliance. Reboot - restarts the appliance. It is best to restart the appliance by clicking the Reboot button in the Operations tab under the System page of the Appliance Administrator unless the Appliance Administrator is unreachable. Shutdown - shuts down the appliance. The Virtual Machine is still deployed in the VMware host. Quit - exits the menu. 11
Chapter 3 - Configuring OneSign Virtual Appliances Using the OneSign Virtual Appliance in a VMware ESX Thin- Provisioned Environment OneSign Virtual Appliances (OVAs) can be deployed using VMware ESX thin-provisioning. Thin-provisioned OVAs have the same performance as thick-provisioned OVAs, as determined by the ESX infrastructure. Disk provisioning selection does not impact memory, CPU, and other OVA allocations; see Deploying the OVA on page 7. What You Must Know About Thin-Provisioned OVAs Thin-provisioned OVAs will never shrink in size once space is allocated by the hypervisor. This is a limitation of ESX Thin Provisioning, and is not limited to the OneSign OVA. You may see significant increases in OneSign OVA disk sizes if an appliance is unreachable for replication traffic in a problem situation. The only way to recover disk space is to replace appliances (see Replacing OVAs with Thin-Provisioned OVAs). Managing Thin-Provisioned OVAs When your OneSign appliances are thin-provisioned, you must carefully monitor the space where the OVA is deployed, for both the hypervisor (datastore) and the storage device (local disk, SAN, NFS, etc.). The initial thin-provisioned size of the OVA is about 20 GB. The maximum thin-provisioned OVA disk usage is 252 GB, the same as a thick-provisioned OVA. The OVA guest will assume it has a 250GB disk available. If the storage device or datastore runs out of space, the OVA will fail at the first event that requires more disk space. You can monitor OVA disk usage in ESX, in the Appliance Administrator System page Operations tab or in the appliance logs. If the OneSign Virtual Appliance Fails There are no notifications or warnings in OneSign if the hypervisor cannot allocate more disk space for the OVA. The host and OneSign will continue to operate normally without warning/notification until disk space runs out, and then unpredictable problems will occur. Assume that OneSign will shut down and not provide service to end users. Replacing OVAs with Thin-Provisioned OVAs To replace existing OVAs with thin-provisioned ones: 1. Remove the thick-provisioned OVA from the enterprise. Confirm that the OVA is powered off. 2. Deploy the new thin-provisioned OVA. 3. Synchronize the enterprise database from the System page Operations tab. 4. Add the thin-provisioned OVA to the enterprise. 5. Delete the thick-provisioned OVA. 12
Using the OneSign Virtual Appliance in a VMware ESX Thin-Provisioned Environment Deploying a Thin-Provisioned OneSign Virtual Appliance To deploy a OneSign virtual appliance to a thin-provisioned ESX disk: 1. Log into VMware vsphere Client and Create a new virtual machine as you would for a thick-provisioned VM, but for Disk Format, select Thin provisioned format instead. Select Thin Provisioned 2. Complete the process and deploy as you would for a thick provisioned VM. As with all thin-provisioned VMs, the Used Storage will grow over time, and never diminish of its own accord. As the SAN fills up, you may want to recover some of that space: see Replacing OVAs with Thin-Provisioned OVAs on page 12. Summary/Resources/Used Storage Increases over Time 13
Chapter 3 - Configuring OneSign Virtual Appliances 14