Aruba VAN SDN Controller 2.8 Installation Guide

Aruba VAN SDN Controller 2.8 Installation Guide Part Number: 5200-3099 Published: March 2017 Edition: 1

2013, 2017 Hewlett Packard Enterprise Development LP Notices The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website. Aruba VAN SDN Controller license text The Aruba VAN SDN Controller license text is in /opt/sdn/legal/eula.txt. The Aruba VAN SDN Controller incorporates materials from several Open Source software projects. Therefore, the use of these materials by the Aruba VAN SDN Controller is governed by different Open Source licenses. Refer to /opt/sdn/legal/hp-sdn- CONTROLLER-OPENSOURCE-LIST.pdf for a complete list of the materials used. Open Source Software For information on licenses for the open source software used by the Aruba VAN SDN Controller, see the Aruba VAN SDN Controller Open Source and Third-Party Software License Agreements. This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise. For information about acquiring the open source code for the Aruba VAN SDN Controller, contact Hewlett Packard Enterprise Support, listing the product name and version information for which the source code is being requested. See Support and other resources for information about contacting Support. Because such information can become outdated quickly, Hewlett Packard Enterprise does not publish mailing addresses and telephone numbers for open source queries. Available source code distribution methods include network transmission of the source code and sending the source code on physical media to a mailing address. Physical media distribution might require a fee to cover the media and mailing costs. The SDN Controller OVA is built on hlinux opensource code. You can download the hlinux source code and license from the following location: https://h20392.www2.hpe.com/opensource. The Aruba VAN SDN Controller includes both proprietary software that is closed source in addition to the open source software listed in the Aruba VAN SDN Controller Open Source and Third-Party Software License Agreements. In response to queries to Hewlett Packard Enterprise for source code on the Aruba VAN SDN Controller, Hewlett Packard Enterprise distributes the source code for open source software only. Hewlett Packard Enterprise does not distribute source code for closed source software.

Acknowledgments Intel, Itanium, Pentium, Intel Inside, and the Intel Inside logo are trademarks of Intel Corporation in the United States and other countries. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Adobe and Acrobat are trademarks of Adobe Systems Incorporated. Java and Oracle are registered trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group.

Contents Chapter 1 Getting Started...6 Controller authentication... 6 Controller licensing... 6 Installation options... 6 Prerequisites... 7 Downloading the controller software...7 Controller upgrade paths... 8 Next steps... 8 Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance... 10 About the Controller virtual appliance (OVA)... 10 Deployment options... 10 Installing the controller virtual appliance on a hypervisor... 10 Migrating from 2.7.10 or 2.7.16 to a new 2.8.8 virtual appliance... 13 Post migration tasks...19 Chapter 3 Controller installation with a local Keystone server... 21 Preliminary steps... 21 Installing the local Keystone server... 21 Unpacking the controller software...22 Verifying hardware requirements... 23 Installing and verifying the controller...24 Configuring a user on a local Keystone server... 24 Chapter 4 Controller installation with a remote Keystone server... 26 Preliminary steps... 26 Resetting the provider type on the remote Keystone server...26 Unpacking the controller software on your local machine...28 Verifying hardware requirements... 28 Installing and verifying the controller on your local machine...29 Configuring the controller on a local machine to operate with a remote Keystone server... 30 Chapter 5 In-place controller upgrade using the Debian package... 32 In-place upgrade when one or more Aruba SDN applications are installed on the controller...32 Controller configuration file updates during an upgrade... 33 Preliminary steps... 34 Unpacking the controller software...35 Verifying hardware requirements... 35 Installing and verifying the controller...36 Upgrading the applications... 37 Chapter 6 Post install tasks... 38 Verifying the NTP configuration... 38 Verifying the controller installation... 38 Applying a controller license... 40 Contents 4

Running post install configuration scripts...40 Ensuring high availability and secure controller operation...45 Obtaining Aruba SDN applications... 45 Chapter 7 Uninstalling the controller and the local Keystone server... 46 Uninstalling the controller...46 Uninstalling the local Keystone server... 46 Chapter 8 Troubleshooting...47 The SDN Controller service (SDNC) failed to start... 47 Port 35357 being used by non-keystone processes... 48 Controller installation failed...48 Install verification command shows incorrect output...49 The controller installation failed due to web proxy settings...50 User login fail and locked out of GUI... 50 Controller lockout... 50 Local Keystone server installation failure...51 NTP not operating...51 Username sdn warning... 52 Chapter 9 Websites... 53 Chapter 10 Support and other resources... 54 Accessing Hewlett Packard Enterprise Support... 54 Accessing updates...54 Customer self repair...54 Remote support... 55 Warranty information...55 Regulatory information...55 Documentation feedback... 56 Contents 5

Chapter 1 Getting Started The Aruba VAN SDN Controller provides an extensive platform for developing and running SDN applications. It features: A base controller platform for Linux/Java/OSGi, OpenFlow 1.0/1.3, built-in services, and a device driver framework Operation with either a local or a remote Keystone server Embedded Java applications, an extensible REST API and UI, and an HPE Intelligent Management Center (IMC) management interface As an Aruba VAN SDN Controller administrator, you must be familiar with OpenFlow, and have OpenFlow enabled and configured on the network switches managed by the controller. Controller authentication The Aruba VAN SDN Controller supports both local and remote Keystone authentication servers. Keystone provides the OpenStack Identity Service used for controller authentication. For more information on Keystone operation, see the chapter titled Security Features" in the latest edition of the Aruba VAN SDN Controller Administrator Guide. For information on a specific Keystone version, visit http://docs.openstack.org/ developer/keystone/ and see the documentation for the OpenStack Keystone version you are using. The controller supports v2.0 of the Keystone REST API. Controller licensing For controller software licensing and registration information, see the License registration and activation chapter in the Aruba VAN SDN Controller Administrator Guide. Installation options With the 2.7 and later releases of the Aruba VAN SDN Controller, there are two installation options. Aruba VAN SDN Controller Virtual Appliance Designed to make installing a new controller a simple process, the virtual appliance comes with the HPE Linux operating system, Keystone server, and the controller Debian packages and dependencies preinstalled. The virtual appliance is deployed on a VMware hypervisor. For installation instructions, see Installing or migrating to a new 2.8.8 virtual appliance on page 10. Aruba VAN SDN Controller Debian package Provided primarily for customers that want to install the controller on a system with the Ubuntu operating system already installed. Requires installation on a system with Ubuntu 14.04. If the version of Ubuntu on the system is 12.04, you must upgrade to Ubuntu 14.04 before upgrading the controller. You can use a local Keystone server, or as an option, you can configure the controller to use a remote Keystone server. For installation instructions with a local Keystone server, see Controller installation with a local Keystone server on page 21. For installation instructions with a remote Keystone server, see Controller installation with a remote Keystone server on page 26. Various migration or upgrade scenarios are supported, whether you want to use the controller virtual appliance or do an in-place upgrade using the Debian package. For more information, see Next steps on page 8. 6 Aruba VAN SDN Controller 2.8 Installation Guide

Prerequisites For complete requirements, see the latest Aruba VAN SDN Controller and Applications Support Matrix available at www.hpe.com/info/sdn/infolib (scroll down to Installation). The Aruba VAN SDN Controller and Applications Support Matrix includes the following: Required and recommended hardware and software Supported OpenFlow versions SNMP information Supported network switches Configuration maximums Hardware requirements For a controller in a medium production environment of 100 to 500 devices, links, and hosts, Hewlett Packard Enterprise recommends the following hardware specifications: 2.2 GHz x86-64 8-core processor or equivalent 16 GB RAM 150 GB of available disk space One 1 Gbps Ethernet NIC Controllers in small production environments, large production environments, development environments, and test environments have different hardware requirements. For detailed information about these requirements, see the Aruba VAN SDN Controller and Applications Support Matrix. Prerequisite software for installing the controller If you are deploying the Aruba VAN SDN Controller Virtual Appliance (OVA) onto a host machine (hypervisor) as a guest VM, the following hypervisor version is supported: VMware vcenter ESXi 5.5.0 or later running in vcenter 5.5.0 or later using VM hardware versions 8 through 11 If you are installing the controller Debian package, you must ensure that the following software is installed on the physical or virtual machine: Operating system: Ubuntu 14.04 LTS 64-bit Server When installing Ubuntu, do not use sdn and sdnadmin for user or group names, as these credentials are created during the controller installation process. Using these names for user or group names for Ubuntu before installing the controller will cause the controller installation to fail. Downloading the controller software In the Aruba VAN SDN Controller release 2.8.8, you can select the following downloads: Aruba VAN SDN Controller Virtual Appliance Aruba VAN SDN Controller Debian package You can download the controller software from either the HPE My Networking Portal or from the HPE SDN App Store. To download the Aruba VAN SDN Controller software package from the My Networking Portal: Chapter 1 Getting Started 7

1. Go to the Hewlett Packard Enterprise Networking support site at www.hpe.com/networking/support. 2. Enter the Aruba VAN SDN base product number J9863AAE in the Enter product name/number field. 3. Select the check box next to the Aruba VAN SDN Controller product, then click Show selected items. 4. In the lower right quadrant of the My Support screen, click Software downloads. 5. On the Download software screen, select and download the appropriate controller software package to your local machine. a. Virtual appliance: sdn-controller-medium-deployment-hlinux-ova_2.8.8.0366.ova b. Debian package: hp-sdn-ctl_2.8.8.0366_amd64.deb 6. If you downloaded a zip file, unzip the software package. 7. Read the latest Aruba VAN SDN Controller Release Notes included with the software package. To download the Aruba VAN SDN Controller software package from the Hewlett Packard Enterprise SDN App Store: Log in to the Hewlett Packard Enterprise SDN App Store at www.hpe.com/networking/sdnappstore. Select Controller from the list of available applications and download the controller software package. Use the links provided to download the latest Aruba VAN SDN Controller Release Notes and other documentation. Controller upgrade paths The following table shows what is supported in upgrading the controller from different software versions to version 2.8.8. From SW Version To SW Version 2.7.16 2.8.8 2.7.10 2.8.8 2.6.11* Upgrade directly to 2.8.8 is not supported. 2.6.8* Upgrade directly to 2.8.8 is not supported. 2.5.2x* Upgrade directly to 2.8.8 is not supported. * To upgrade the controller from version 2.5.2x or 2.6.x to version 2.8.8, you must first upgrade to 2.7.16 (see the Aruba VAN SDN Controller 2.7 Installation Guide March 2016 version for upgrade instructions). Then you can upgrade from 2.7.1.6 to 2.8.8. Next steps To continue the controller installation or upgrade, select one of the following procedures. For a new controller installation using the Aruba VAN SDN Controller virtual appliance download, go to Installing or migrating to a new 2.8.8 virtual appliance. To migrate from a pre-existing 2.7.10 or 2.7.16 controller virtual appliance to a new 2.8.8 controller virtual appliance, go to Installing or migrating to a new 2.8.8 virtual appliance. For a new controller installation using the Debian package that will use a local Keystone server, go to Controller installation with a local Keystone server. 8 Aruba VAN SDN Controller 2.8 Installation Guide

For a new controller installation using the Debian package that will use a remote Keystone server, go to Controller installation with a remote Keystone server. To do an in-place upgrade of a controller you installed on an Ubuntu system from versions 2.7.10 or 2.7.16 to version 2.8.8, go to In-place controller upgrade using the Debian package on page 32. A migration involves deploying the 2.8.8 virtual appliance as a separate virtual appliance, then migrating the network configuration and other configuration from the pre-existing 2.7.10 or 2.7.16 controller virtual appliance to the new 2.8.8 controller virtual appliance. An upgrade is in-place on a single existing controller system, going from an existing version 2.7.10 or 2.7.16 controller to version 2.8.8, using the 2.8.8 Aruba VAN SDN Controller Debian package. Chapter 1 Getting Started 9

Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance About the Controller virtual appliance (OVA) Aruba VAN SDN Controller is available for download as a virtual appliance, which contains all the required packages and components for the controller, simplifying the deployment process of the controller. The virtual appliance comes with the following preinstalled: HPE Linux operating system Controller Debian package Local Keystone server (Icehouse release) Keystone configured for the sdn and sdn-admin users Java Open JDK version 1.8 PostgreSQL 9.4 NTP client tshark or tcpdump Passwordless sudo access for the sdn user Network configured for DHCP address assignment The hardware requirements for the controller virtual appliance are described in Prerequisites on page 7. The controller virtual appliance is created as an OVA (Open Virtual Appliance) package. The controller virtual appliance is deployed onto a host machine (hypervisor) as a guest VM. Deployment options You can deploy the Aruba VAN SDN Controller virtual appliance for either: A new initial controller installation using the virtual appliance. For details, see Installing the controller virtual appliance on a hypervisor on page 10. OR A migration to a 2.8.8 virtual appliance from a pre-existing 2.7.10 or 2.716 virtual appliance A migration involves deploying the 2.8.8 virtual appliance as a separate virtual appliance and then migrating the network configuration, and other configuration from the pre-existing 2.7.10 or 2.716 controller virtual appliance to the new 2.8.8 controller virtual appliance. For details, see Migrating from 2.7.10 or 2.7.16 to a new 2.8.8 virtual appliance on page 13. You cannot upgrade or migrate an existing 2.7.10 controller virtual appliance with more than one Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed on it to a later version. Instead, you install the new controller version on a different system and then install the applications on the new system. With this scenario, your controller configuration data is not preserved. Installing the controller virtual appliance on a hypervisor For a new controller installation, complete the following steps to deploy the controller virtual appliance on a hypervisor, configure the network, and complete the controller installation. If instead, you want to upgrade an existing controller virtual appliance, see Migrating from 2.7.10 or 2.7.16 to a new 2.8.8 virtual appliance on page 13. 10 Aruba VAN SDN Controller 2.8 Installation Guide

If you want to use static IP, use the configuration utility which starts when the virtual appliance boots up for the first time. The network configuration utility is described in the steps that follow. 1. Download the Aruba VAN SDN Controller virtual appliance package. The download is available as described in Downloading the controller software on page 7. 2. Extract the OVA template from the ZIP file. 3. Deploy the OVA template onto the hypervisor. For example, from VMware vsphere, select File > Deploy OVF Template..., then browse to and select the OVA file you downloaded. To deploy the OVA file, proceed through the steps. In the Network Mapping step, map the two Source Networks appropriately. The mgmt network is the northbound network. In Network Mapping, map the mgmt Source Network to the Destination Network on which you will communicate with the virtual appliance. If you want to use an assigned DHCP address, make sure that the selected Source Network has a DHCP server. The sw-mgmt network is the southbound network and is disabled by default. Map the swmgmt Source Network to the Destination Network that controls the switches. If you want to enable the sw-mgmt Source Network, you must manually configure the IP Settings. For details, see Setting the IP address of the sw-mgmt Source Network on page 13. The OVA includes the HPE Linux operating system, Keystone server, controller Debian package, and scripts for configuring the networking of the controller. 4. Power on the controller VM for the first time. For example, in vsphere, right-click the controller VM, and select Power > Power On. 5. In the VM console, when prompted, log in to the controller. Use the default login and password (sdn and skyline). 6. After you log in, the network configuration utility runs displaying the following screen. Select the VAN SDN Controller Initial Network Configuration option and click Next. If you click Cancel, you exit the network configuration utility. To restart the network configuration utility run python easy_config.py -f yes. However, once you complete the migration you may not run the network configuration utility again. Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance 11

7. The Network Configuration screen is then displayed. Enter the hostname for the VM at the prompt. Then select the type of IP address you want to use: DHCP or Static. Click OK when you have made your selections. DHCP is the default. To change the selection to Static, use the arrow key to highlight Static, and use the spacebar or the X key to change the selection. 8. To configure a static IP, change the IP Settings to static IP values for the following: 12 Aruba VAN SDN Controller 2.8 Installation Guide

IP address Subnet mask Default gateway Primary DNS Secondary DNS (Optional) You can change to a static or DHCP IP address later, after you complete the initial installation, using the controller UI from the Configurations screen System tab. See the Aruba VAN SDN Controller Administrator Guide for more details. 9. Follow the prompts to complete the network configuration and controller installation. The controller is now up and running. Next steps: Continue with post install tasks, see Post install tasks on page 38. Setting the IP address of the sw-mgmt Source Network The sw-mgmt source network is the southbound interface and is used to communicate with the switches. For the switches to communicate with the controller, they must be on the destination network. To assign an IP address on the sw-mgmt source network, you must manually configure it. 1. Go to the following folder: cd /etc/network 2. Edit the interfaces file using the command sudo vi interfaces 3. Modify and configure the static IP address to match your environment as in the following example: auto eth1 iface eth1 inet static address 192.168.1.10 netmask 255.255.255.0 4. Save the file and reboot the VM. Migrating from 2.7.10 or 2.7.16 to a new 2.8.8 virtual appliance To upgrade a 2.7.10 or 2.7.16 controller virtual appliance to 2.8.8, a quick and easy migration option is provided. Migrating involves first deploying the 2.8.8 virtual appliance as a separate virtual appliance and then selecting the migration option in the network configuration utility. The network configuration, and other configuration from the pre-existing 2.7.10 or 2.7.16 controller virtual appliance is exported and then imported to the new 2.8.8 virtual appliance. Migration from a 2.7.10 controller virtual appliance with more than one Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed to 2.8.8 is not supported. Migration to 2.8.8 is also not supported for the following: A 2.7.10 or 2.7.16 controller virtual appliance in a team (HA) environment. A 2.7.10 or 2.7.16 small deployment controller virtual appliance. Migration is only supported for the medium deployment controller virtual appliance. A controller installed on an Ubuntu system using the Debian package. In this case, do an in-place upgrade instead of a migration. Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance 13

How the migration works The process of migration consists of exporting the configuration and data from the pre-existing 2.7.10 or 2.7.16 controller appliance and then importing the information into the new 2.8.8 controller appliance. To maintain the network configuration (IP address) and connectivity to the connected switches, the new controller appliance has to assume the identity (IP address and network settings) of the pre-existing controller. For a pre-existing 2.7.10 controller virtual appliance: If it is in a team (HA) environment, migration is not supported. If it has more than one of the Aruba SDN applications installed (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer), migration is not supported. If it (stand-alone, not in a team) has any one of the following ACTIVE SDN applications installed: Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer, then while migrating the controller, the application and application configuration information is also migrated. If the Aruba SDN application is in any state other than ACTIVE, it is not migrated. For a pre-existing 2.7.16 controller virtual appliance: If it is in a team (HA) environment, migration is not supported. If it (stand-alone, not in a team) has one or more of the following ACTIVE SDN applications installed: Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer, then while migrating the controller, the applications and application configuration information is also migrated. If the Aruba SDN applications are in any state other than ACTIVE, they are not migrated. Not all data for these SDN applications is migrated, so check the documentation for the SDN application to find the details on what you need to know before the migration and what data will be migrated. As part of application migration, applications are installed on the new controller virtual appliance. However, the application version remains the same as on the pre-existing controller virtual appliance. After migration, you can upgrade applications to the latest version. For details, see the application documentation. The migration is handled automatically using the network configuration utility. After you deploy the 2.8.8 controller virtual appliance on the new VM, you power on the VM and log in. In the VM console, the network configuration utility screen is displayed. In the initial screen, you select the Migration option and the migration proceeds as follows: In the network configuration utility, a temporary IP address has to be assigned to the new controller appliance that is reachable from the pre-existing controller appliance. An export script is run remotely on the pre-existing controller VM from the new controller VM. An archive tar file is created, containing all the network configuration, data, and other configuration files needed for migration. The tar file is remotely copied from the pre-existing controller VM to the new controller VM. The exported information includes configuration information for the controller and ACTIVE applications such as: Configuration files Network configuration Controller license Install ID license Controller log files Keystone SQLite database file For these SDN applications in ACTIVE state: Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer, application licenses are exported. And for those SDN applications being migrated, application-specific configurations are exported. For details, see the application documentation. The pre-existing controller VM is shut down in preparation for the new controller VM to assume its identity, including its network configuration. On the new controller VM, the information in the tar file is extracted and copied to the proper location. 14 Aruba VAN SDN Controller 2.8 Installation Guide

Any migrated applications are installed on the new controller VM. The application version will be the same as on the pre-existing controller. See the application documentation for how to upgrade the application to a newer version. The data migration completes, and the controller is started up on the new controller VM. A sanity check is run to ensure that the controller is working properly. Two log files are generated on the new controller VM showing the progress of the migration: /var/log/sdn/ migratelogsexport.log (which logs the export process), and /var/log/sdn/migratelogs.log (which logs the import process). Prerequisites for migration from a pre-existing 2.7.10 controller virtual appliance Prerequisites for migrating from a pre-existing 2.7.10 controller virtual appliance to a new 2.8.8 controller virtual appliance include the following: The pre-existing 2.7.10 controller virtual appliance cannot be in a team (HA) environment. It cannot have more than one Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed, and it cannot be a small deployment (demo) OVA. The pre-existing 2.7.10 controller must be a virtual appliance, not a controller installed on an Ubuntu system using the Debian package. You cannot migrate data from a system installed using the controller Debian package. For a controller installed on Ubuntu from the Debian package, do an in-place upgrade as described in In-place controller upgrade using the Debian package on page 32. If the pre-existing controller virtual appliance is using a DHCP address, you must change the DHCP address for the eth0 NIC to a static IP address before migration to avoid IP setting loss. The static IP address from the pre-existing controller virtual appliance will be used for the new controller virtual appliance to ensure connectivity with configured switches. If you also want the eth1 address migrated from the pre-existing controller virtual appliance, then it must also be configured as a static IP address. Successful ping connectivity is required between the pre-existing controller virtual appliance and the new controller virtual appliance. You must be able to connect to the pre-existing controller virtual appliance from the new controller virtual appliance via ssh. You will need to know the IP address of the pre-existing controller virtual appliance. You can use the ifconfig command to find the IP address. You will also need to know the following for the pre-existing controller virtual appliance: Controller GUI log in password for sdn user ssh login password Requirements when you have an Aruba SDN application installed Migration to controller version 2.8.8 is not supported if you have more than one Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed. Instead, you install the new controller version on a different system and then install the applications on this new system. With this scenario, your controller configuration data is not preserved. The Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed on the pre-existing controller you are migrating must be in the ACTIVE state in order for the application and application configuration to be migrated to the new controller virtual appliance. Prior to migration, check that the Aruba SDN application installed on the pre-existing 2.7.10 controller matches the following versions: Controller 2.7.10 and Network Protector 1.3.55 Controller 2.7.10 and Network Visualizer 1.1.18 Controller 2.7.10 and Network Optimizer 1.4.6.131 If the application is an earlier version, follow the application upgrade procedure to upgrade the application to the required version before upgrading the controller. Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance 15

Prerequisites for migration from a pre-existing 2.7.16 controller virtual appliance Prerequisites for migrating from a pre-existing 2.7.16 controller virtual appliance to a new 2.8.8 controller virtual appliance include the following: The pre-existing 2.7.16 controller virtual appliance cannot be in a team (HA) environment. The pre-existing 2.7.16 controller virtual appliance cannot be a small deployment (demo) OVA. The pre-existing 2.7.16 controller must be a virtual appliance, not a controller installed on an Ubuntu system using the Debian package. You cannot migrate data from a system installed using the controller Debian package. For a controller installed on Ubuntu from the Debian package, do an in-place upgrade as described in In-place controller upgrade using the Debian package on page 32. If the pre-existing controller virtual appliance is using a DHCP address, you must change the DHCP address for the eth0 NIC to a static IP address before migration to avoid IP setting loss. The static IP address from the pre-existing controller virtual appliance will be used for the new controller virtual appliance to ensure connectivity with configured switches. If you also want the eth1 address migrated from the pre-existing controller virtual appliance, then it must also be configured as a static IP address. Successful ping connectivity is required between the pre-existing controller virtual appliance and the new controller virtual appliance. You must be able to connect to the pre-existing controller virtual appliance from the new controller virtual appliance via ssh. You will need to know the IP address of the pre-existing controller virtual appliance. You can use the ifconfig command to find the IP address. You will also need to know the following for the pre-existing controller virtual appliance: Controller GUI log in password for sdn user ssh login password Requirements when you have Aruba SDN applications installed The Aruba SDN applications (Aruba Network Optimizer, Aruba Network Protector, Aruba Network Visualizer) installed on the pre-existing controller you are migrating must be in the ACTIVE state in order for the applications and application configurations to be migrated to the new controller virtual appliance. Prior to migration, check that any Aruba SDN applications installed on the pre-existing 2.7.16 controller match the following versions: Controller 2.7.16 and Network Protector 1.3.108.2100 Controller 2.7.16 and Network Visualizer 1.1.27.581 Controller 2.7.16 and Network Optimizer 1.4.11.184 If the applications are an earlier version, follow the application upgrade procedure to upgrade the applications to the required version before upgrading the controller. Migration from a 2.7.10 or 2.7.16 virtual appliance to a new 2.8.8 virtual appliance Follow these steps to deploy the 2.8.8 controller virtual appliance on a new VM and migrate configuration and data from a pre-existing 2.7.10 or 2.7.16 controller virtual appliance. If you are doing an initial installation of the 2.8.8 virtual appliance and do not want to import data from a pre-existing 2.7.10 or 2.7.16 controller, then use the installation procedure in Installing the controller virtual appliance on a hypervisor on page 10. You cannot upgrade or migrate an existing 2.7.10 controller virtual appliance with more than one Aruba SDN application (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer) installed to a later controller virtual appliance version. 16 Aruba VAN SDN Controller 2.8 Installation Guide

1. Download the 2.8.8 Aruba VAN SDN Controller virtual appliance package. The download is available as described in Downloading the controller software on page 7. 2. Extract the OVA template from the ZIP file. 3. Deploy the OVA template on a separate VM from the pre-existing 2.7.10 or 2.7.16 VM. For example, from VMware vsphere, select File > Deploy OVF Template..., then browse to and select the OVA file you downloaded. Proceed through the steps to deploy the OVA file. 4. Power on the new controller VM for the first time. For example, in vsphere, right-click the controller VM, and select Power > Power On. 5. In the VM console, when prompted, log in to the controller. Use the default login and password (sdn and skyline). 6. After you log in, the configuration utility runs displaying the following screen. Select the Migration from Preexisting VAN SDN Controller option and click Next. If you click Cancel in any step, you exit the network configuration utility and the migration will not be done. If you exit without migrating, you can manually run the network configuration utility with the command python easy_config.py -f yes. However, once you complete the migration you may not redo the migration. 7. A Help screen is displayed. Click Next. Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance 17

8. On the Migration screen, enter the following information: a. For the pre-existing 2.7.10 or 2.7.16 controller virtual appliance, enter the IP address, GUI log in password for the sdn user and ssh login password. This information is used to connect to the preexisting VM and extract information to be migrated. Basic validation is done on the values you enter. b. For the new 2.8.8 controller virtual appliance, select DHCP or Static IP address. The IP address is temporary in that the new controller VM will assume the IP address of the 2.7.10 or 2.7.16 pre-existing controller VM after migration. If you select Static, you will need to enter a temporary IP address. c. Click Next. 18 Aruba VAN SDN Controller 2.8 Installation Guide

9. The Migration Summary screen is displayed. Click OK to continue with the migration or Cancel to return to the previous screen. 10. The migration takes a few minutes. A screen is displayed with a Migration Success message when the migration is complete. Click OK. Two log files are generated on the new controller VM showing the progress of the migration: /var/log/sdn/migratelogsexport.log (which logs the export process), and /var/log/sdn/migratelogs.log (which logs the import process). After the migration completes, the new 2.8.8 controller is started and a sanity check is performed. The old 2.7.10 or 2.7.16 pre-existing controller VM is powered down. The new 2.8.8 controller VM should have the IP address and network configuration of the old 2.7.10 or 2.7.16 pre-existing controller VM. The new 2.8.8 controller is ready to use. Any migrated applications are also ready to use. In the controller UI, you can check that the controller version is 2.8.8. Continue on to Post migration tasks. Post migration tasks For any of these migrated applications (Aruba Network Optimizer, Aruba Network Protector, or Aruba Network Visualizer), the application version will be the same as on the pre-existing controller and the application will be in the ACTIVE state in the Application Manager UI. After migration, you can upgrade the application to the latest version. See the Aruba VAN SDN Controller and Applications Support Matrix for the application version supported on the 2.8.8 controller. See the application documentation for how to upgrade the application to a newer version. Upgrading the applications After the migration is complete, you must upgrade the applications to the following versions: Network Optimizer: 1.5.4.109 Network Visualize: 1.2.6.160 Network Protector:1.5.4.30 Not all data for the SDN applications is migrated; check the application documentation for detailed information about which data is migrated. All configuration settings for the applications are preserved throughout the migration and upgrade process. Chapter 2 Installing or migrating to a new 2.8.8 virtual appliance 19

1. Verify that all applications are active. 2. From the Controller Application Manager UI, select one of the applications to be upgraded and click Upgrade. 3. Select the correct version of the application and upload it. 4. Upgrade the second application, and if present, the third application. 20 Aruba VAN SDN Controller 2.8 Installation Guide

Chapter 3 Controller installation with a local Keystone server This chapter describes installing a new controller using the Aruba VAN SDN Controller Debian package for use in an environment with the Keystone server on the same (local) machine as the controller. A script for configuring the user on the local Keystone server is included in the controller download package. Using this option automatically configures the Keystone server. (If you want your controller to operate with a previously configured, remote Keystone server, then skip this chapter and go to Controller installation with a remote Keystone server on page 26.) The Aruba VAN SDN Controller Debian package is installed on a system or VM with the Ubuntu operating system already installed. Alternately you can install a new controller on a bare metal server VM by deploying the Aruba VAN SDN Controller virtual appliance, see Installing or migrating to a new 2.8.8 virtual appliance on page 10. Where commands in this chapter are shown with multiple lines, the line breaks are inserted at the points where a space occurs in the actual command. Preliminary steps 1. Install the Ubuntu 14.04 operating system. When installing the Ubuntu operating system, avoid using sdn and sdnadmin for user or group names. These names are reserved for controller use, and configuring them for Ubuntu before installing the controller will cause the controller installation to fail. For more information on hardware and software requirements for the controller, see Prerequisites on page 7 or the latest edition of the Aruba VAN SDN Controller and Applications Support Matrix. 2. Verify that the system on which you are installing the controller meets the hardware and software requirements appropriate to the size of your network deployment. 3. Download the Aruba VAN SDN Controller Debian package as described in Downloading the controller software on page 7. 4. Continue to the next section to install a local Keystone server. Installing the local Keystone server For most controller installations, Hewlett Packard Enterprise recommends using a local Keystone server as described in this chapter. Doing so avoids the need to address certain security implications associated with using a remote Keystone server. For more information on using a remote Keystone server, see Installing a new controller using the Debian package and a remote Keystone server. The local configured keystone server must be accessible and responsive to basic Keystone REST API queries. The controller supports v2.0 of the Keystone REST API. Although the Aruba VAN SDN Controller operates with the Folsom, Grizzly, Havana, Icehouse, or Juno releases of OpenStack Keystone, the following instructions are for the Juno version. Chapter 3 Controller installation with a local Keystone server 21

1. Point the Ubuntu system to the most recent package meta-data: ~$ sudo apt-get update 2. Use the following commands to install the Keystone server on the local machine. ~$ sudo apt-get install python-software-properties ~$ sudo apt-get install ubuntu-cloud-keyring ~$ sudo add-apt-repository cloud-archive:juno If the following message appears, press Enter before continuing: Press [ENTER] to continue or ctrl-c to cancel adding it ~$ sudo apt-get update ~$ sudo apt-get install keystone Hewlett Packard Enterprise recommends using the juno version of the OpenStack Keystone server, as shown in the above command. However, you can use any of the following Keystone server options: juno (recommended) icehouse havana grizzly folsom For information on a specific Keystone version, visit http://docs.openstack.org/developer/keystone/ and see the documentation for the OpenStack Keystone version you are using. For information on the keystore and truststore features, see the Aruba VAN SDN Controller Administrator Guide. 3. If the following prompt is displayed, type Y and go to the next step. If you do not see this prompt, then continue to the next step. Do you want to continue [Y/n]? 4. If the following prompt is displayed, type N and continue to the next section to unpack the software. If you do not see this prompt, then continue to the next section. Configuration file ==> Modified (by you or by a script) since installation. Package distributor has shipped an updated version. What would you like to do about it? Your options are: Y or I : install the package maintainer's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** dmk.sh (Y/I/N/O/D/Z) [default=n]? Unpacking the controller software Do the following to prepare the downloaded Aruba VAN SDN Controller Debian package for installation: 1. Ensure that you have root access on the Ubuntu system using the sudo command. 2. Unpack the Aruba VAN SDN Controller Debian package from the directory in which the package is stored: 22 Aruba VAN SDN Controller 2.8 Installation Guide

In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb (Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366.) The unpack command first does a verification to ensure that your system hardware meets the minimum requirements needed for controller operation. If your system does not meet hardware requirements, the command fails and an error message is displayed. For an example of the error and instructions on what to do if this error occurs, see Verifying hardware requirements. If the unpack command completes with no error, continue on to Installing and verifying the controller. Verifying hardware requirements The installation verifies that your hardware system meets the minimum requirements needed for operation in a medium (production) environment. If the installation detects that the hardware does not meet these minimum requirements, you will see an Error message and output similar to the following. If the Error message does not appear, skip this section and go to the next section, Installing and verifying the controller on page 24. Error! This controller has X cores! (8 cores required) Error! This controller has XX GB of RAM! (16 GB required) Error! This controller has XX GB of available storage! (64 GB required) This hardware platform doesn't meet the minimum requirements for a production deployment. Please see the Support Matrix for additional hardware requirements for sizing production deployments. To override this check, run the following command before installation: 'touch /tmp/override.txt' Overriding this check is useful for demonstrations and small test environments. Some features may not work properly without a controller that meets minimum hardware requirements. An installation using this check should not be used in production networks and will not be supported by HPE support. If the above message appears, the controller hardware does not meet the minimum requirements for number of cores, free RAM, and/or available storage for a development or test environment. If you are installing a controller for operation in a production network, Hewlett Packard Enterprise recommends that you halt the installation process and start over with controller hardware that meets the requirements for your system. For full information on controller hardware requirements, see the section titled Hardware requirements and recommendations in the latest edition of the Aruba VAN SDN Controller and Applications Support Matrix. If you choose to override hardware verification, run the touch command and rerun the dpkg --unpack command as shown below, and then go to the next section, Installing and verifying the controller on page 24. ~$ touch /tmp/override.txt Chapter 3 Controller installation with a local Keystone server 23

In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366. Continue on to the next section. Installing and verifying the controller Use the following procedure to install the downloaded Aruba VAN SDN Controller Debian package. 1. Execute the following command to install software dependencies and complete the installation: sudo apt-get install -f If the system prompt appears (~$), proceed to the next step. If you are prompted with Do you want to continue [Y/n]? press Y and continue to the next step. If the following warning message appears, see Username sdn warning. ****************************** WARNING ****************************** THE USER sdn EXISTED PRIOR TO THE INSTALLATION OF THE CONTROLLER. THE CONTROLLER REQUIRES THE USER sdn TO HAVE CERTAIN ATTRIBUTES AND PERMISSIONS. IT IS RECOMMENDED THAT YOU DELETE THE sdn USER, AND THEN RE-INSTALL THE CONTROLLER TO ENSURE CORRECT FUNCTIONALITY. ********************************************************************* 2. Verify the controller installation: ~$ sudo dpkg -l hp-sdn-ctl If the Aruba VAN SDN Controller Debian package is properly installed, output similar to the following appears: ii hp-sdn-ctl 2.8.8.0366 HP VAN SDN Controller The ii in the above output line indicates a successful controller installation. Any other characters appearing instead of ii (such as iu) indicates that the controller is not correctly installed. In this case, see Controller installation failed. 3. In the command-line window, verify that the sdnc service is started: ~$ sudo service sdnc status You should see the following output, which indicates that the sdnc service is started: ~$ sdnc start/running, processnnnn Where: nnnn is the process ID assigned to the main controller process (sdnc). 4. To continue the controller installation with a local Keystone server, go to Configuring a user on a local Keystone server on page 24. Configuring a user on a local Keystone server This procedure uses the /opt/sdn/admin/config_local_keystone script provided in the controller software download to configure user, tenant, password, and role variables in the Keystone server. 24 Aruba VAN SDN Controller 2.8 Installation Guide

1. If a web proxy is set on the machine running the controller, record and remove any http_proxy and https_proxy settings, as follows: a. Use this command to list the current environmental variables: ~$ export Search the resulting listing for any https or http proxy variables in the current environment. If present, these variables will appear similar to the following: declare x http_proxy="http://web proxy.mycompany.com:8888/ declare x https_proxy="https://web proxy.mycompany.com:8888/ b. Record any variables listed for https_proxy and http_proxy and save them for restoration after you complete the user configuration procedure. Using the above example output, you would record these two variables: "http://web-proxy.mycompany.com:8888/ "https://web-proxy.mycompany.com:8888/ c. Use this command to remove the proxy settings: ~$ unset https_proxy http_proxy 2. Use the following command to run the script: ~$ sudo /opt/sdn/admin/config_local_keystone This step configures the controller user name as sdn and the password as skyline. You can configure a different user name or password after completing the installation process, see Running post install configuration scripts on page 40. Run the script only once on a given installation. If you have to rerun the script, first use sudo dpkg -P keystone to uninstall the Keystone server, and then repeat the install process. The above script sets the provider type to UUID by the Keystone server. The PKI provider type is also supported on the Aruba VAN SDN Controller. The script enforces these settings, which enable the controller to access the local Keystone server: user: AUTH_TOKEN: ADMIN AUTH_ENDPOINT: 127.0.0.1 PORT: 35357 tenant: sdn password: skyline roles: sdn-admin and sdn-user 3. Use the following commands to restore any web proxy settings that you removed in step 1. export http_proxy="http://web-proxy.entity:web-proxy-port/ export https_proxy="https://web-proxy.entity:web-proxy-port/ For example, you would use these commands to restore the web proxy settings for an entity known as mycompany.com and a web proxy port of 8888 : ~$ export http_proxy= http://web-proxy.mycompany.com:8888/ ~$ export https_proxy= https://web-proxy.mycompany.com:8888/ Continue with post install tasks, see Post install tasks on page 38. Chapter 3 Controller installation with a local Keystone server 25

Chapter 4 Controller installation with a remote Keystone server This chapter describes installing a new controller using the Aruba VAN SDN Controller Debian package for use in an environment that employs a remote Keystone server. However, in most cases, Hewlett Packard Enterprise recommends using the controller with a local Keystone server installation instead. For details on using a local Keystone server installation, see Controller installation with a local Keystone server on page 21. Using a remote Keystone server involves security implications that HPE recommends being discussed with your system administrator before proceeding. The Aruba VAN SDN Controller Debian package is installed on a system or VM with the Ubuntu operating system already installed. Alternately you can install a new controller on a bare metal server VM by deploying the Aruba VAN SDN Controller virtual appliance, see Installing or migrating to a new 2.8.8 virtual appliance on page 10. In the default configuration, the Aruba VAN SDN Controller supports role-based authentication. To allow authentication through a Keystone server, the controller user must be configured with sdn for domain, and sdn-admin for role. This procedure assumes that the Keystone server you will use is installed and configured on a remote machine. For information on configuring a remote Keystone server, see the OpenStack Keystone documentation at http://docs.openstack.org/developer/keystone/. The configured keystone server must be accessible and responsive to basic Keystone REST API queries. The controller supports v2.0 of the Keystone REST API. Although the Aruba VAN SDN Controller operates with the Folsom, Grizzly, Havana, Icehouse, or Juno releases of OpenStack Keystone, Hewlett Packard Enterprise recommends that you use the Juno version with this release of the controller. Where a command in this procedure is shown with multiple lines, the line breaks are inserted at the points where a space occurs in the actual command. Preliminary steps 1. Install the Ubuntu 14.04 operating system. When installing the Ubuntu operating system, avoid using sdn and sdnadmin for user or group names. These names are reserved for controller use, and configuring them for Ubuntu before installing the controller will cause the controller installation to fail. For more information on hardware and software requirements for the controller, see Prerequisites on page 7. 2. Download the Aruba VAN SDN Controller Debian package as described in Downloading the controller software on page 7. 3. Continue to the next section. Resetting the provider type on the remote Keystone server If you do not want to change the provider type on the remote Keystone server, skip this section and go to Unpacking the controller software on your local machine on page 28. The controller supports two provider types: 26 Aruba VAN SDN Controller 2.8 Installation Guide

UUID The default provider type for the Folsom release of Keystone. To set UUID as the provider type, edit the /etc/keystone/keystone.conf file on your Keystone server by adding the following line: provider=keystone.token.providers.uuid.provider PKI The default provider type for the Grizzly, Havana, Icehouse, and Juno versions of Keystone. To set PKI as the provider type, edit the /etc/keystone/keystone.conf file on your Keystone server by adding the following line: provider-keystone.token.providers.pki.provider Ensure that there is only one provider type line in the keystone.conf file. For example, in the Juno version of Keystone, you would use a file editor to specify UUID in the [token] section of the /etc/keystone/keystone.conf, as shown in the boldface entry in the example: [token] # # Options defined in keystone # # External auth mechanisms that should add bind information to # token e.g. kerberos, x509. (list value) #bind= # Enforcement policy on tokens presented to keystone with bind # information. One of disabled, permissive, strict, required # or a specifically required bind mode e.g. kerberos or x509 # to require binding to that authentication. (string value) #enforce_token_bind=permissive # Amount of time a token should remain valid (in seconds). # (integer value) #expiration=3600 # Controls the token construction, validation, and revocation # operations. Core providers are # "keystone.token.providers.[pki uuid].provider". (string # value) provider=keystone.token.providers.uuid.provider 1 # Keystone Token persistence backend driver. (string value) #driver=keystone.token.backends.sql.token # Toggle for token system cacheing. This has no effect unless # global caching is enabled. (boolean value) #caching=true... To continue the installation process, return to the local machine where you have downloaded the controller software package and go to Unpacking the controller software on your local machine on page 28. 1 Adding this line sets the UUID provider type. Chapter 4 Controller installation with a remote Keystone server 27

Unpacking the controller software on your local machine Do the following to prepare the downloaded Aruba VAN SDN Controller Debian package for installation: 1. Ensure that you have root access on the Ubuntu system (sudo). 2. Unpack the Aruba VAN SDN Controller Debian package from the directory in which the package is stored: In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366.) The unpack command first does a verification to ensure that your system hardware meets the minimum requirements needed for controller operation. If your system does not meet hardware requirements, the command fails and an error message is displayed. For an example of the error and instructions on what to do if this error occurs, see Verifying hardware requirements. If the unpack command completes with no error, continue on to Installing and verifying the controller on your local machine. Verifying hardware requirements The installation verifies that your hardware system meets the minimum requirements needed for operation for a development or test environment of 50 or fewer devices, links, and hosts. If the installation detects that the hardware does not meet these minimum requirements, you will see an Error message and output similar to the following. If the Error message does not appear, skip this section and go to the next section, Installing and verifying the controller on your local machine on page 29. Error! This controller has X cores! (8 cores required) Error! This controller has XX GB of RAM! (16 GB required) Error! This controller has XX GB of available storage! (64 GB required) This hardware platform doesn't meet the minimum requirements for a production deployment. Please see the Support Matrix for additional hardware requirements for sizing production deployments. To override this check, run the following command before installation: 'touch /tmp/override.txt' Overriding this check is useful for demonstrations and small test environments. Some features may not work properly without a controller that meets minimum hardware requirements. An installation using this check should not be used in production networks and will not be supported by HPE support. 28 Aruba VAN SDN Controller 2.8 Installation Guide

If the above message appears, the controller hardware does not meet the minimum requirements for number of cores, free RAM, and/or available storage for a development or test environment. If you are installing a controller for operation in a production network, you must halt the installation process and start over with controller hardware that meets the requirements for your system. For full information on controller hardware requirements, see the section titled Hardware requirements and recommendations in the latest edition of the Aruba VAN SDN Controller and Applications Support Matrix. If you choose to override hardware verification, run the touch command and rerun the dpkg --unpack command as shown below, and then go to the next section, Installing and verifying the controller on your local machine on page 29: ~$ touch /tmp/override.txt In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366. Installing and verifying the controller on your local machine Prerequisites Hewlett Packard Enterprise recommends creating a user on the Keystone server before installing the controller. Ensure that you have root access on the Ubuntu system (sudo). Use the following procedure to install the downloaded Aruba VAN SDN Controller Debian package. 1. Execute the following command to install software dependencies: ~$ sudo apt-get install -f If the system prompt appears (~$), proceed to the next step. If you are prompted with Do you want to continue [Y/n]? press Y and continue to the next step. If the following warning message appears, see Username sdn warning. ****************************** WARNING ****************************** THE USER sdn EXISTED PRIOR TO THE INSTALLATION OF THE CONTROLLER. THE CONTROLLER REQUIRES THE USER sdn TO HAVE CERTAIN ATTRIBUTES AND PERMISSIONS. IT IS RECOMMENDED THAT YOU DELETE THE sdn USER, AND THEN RE-INSTALL THE CONTROLLER TO ENSURE CORRECT FUNCTIONALITY. ********************************************************************* 2. Verify the controller installation: ~$ sudo dpkg -l hp-sdn-ctl If the Aruba VAN SDN Controller Debian package is properly installed, output similar to the following appears: Chapter 4 Controller installation with a remote Keystone server 29

ii hp-sdn-ctl 2.8.8.0366 Aruba VAN SDN Controller The ii in the above output line indicates a successful controller installation. Any other characters appearing instead of ii (such as iu) indicates that the controller is not correctly installed. In this case, see Controller installation failed. 3. In the command-line window, verify that the sdnc service is started: ~$ sudo service sdnc status You should see the following output, which indicates that the sdnc service is started: ~$ sudo sdnc start/running, process nnnn Where: nnnn is the process ID assigned to the main Aruba VAN SDN Controller process (sdnc). 4. Continue by going to Configuring the controller on a local machine to operate with a remote Keystone server on page 30. Configuring the controller on a local machine to operate with a remote Keystone server This section describes how to configure the controller to use an existing remote Keystone server. Using the sdnctl.conf file to specify remote Keystone environment variables Set up the controller to use an existing, remote Keystone server using the /etc/sdn/sdnctl.conf file provided in the controller software to specify the Keystone environmental variables required to configure the controller to operate with a remote Keystone server. In the default sdnctl.conf configuration, these variables are not populated. The following table lists the variables with their corresponding AuthenticationManager keys and descriptions as seen in the controller UI General / Configuration window. Table 1: Keystone environmental variables sdnctl.conf file variable Corresponding AuthenticationManager field in Controller GUI Description AUTH_ENDPOINT ServerVIP Keystone server virtual IP TRUSTSTORE Truststore Keystone truststore location TRUSTSTORE_PASS TruststorePass Keystone truststore password AUTH_TOKEN AdminToken Keystone admin token The variables you configure in the sdnctl.conf file must match the corresponding remote Keystone server variables in the adm.auth.impl.authenticationmanager component of the controller UI General / Configurations window. Otherwise, a controller lockout can occur. For more information, see Controller lockout. Populating the empty variable fields in the sdnctl.conf file with actual values configured on the remote Keystone server causes the controller to attempt to access the remote Keystone server: 30 Aruba VAN SDN Controller 2.8 Installation Guide

1. Determine the values for the above variables. 2. Open the file at /etc/sdn/sdnctl.conf and locate the variable fields. For example: # Defines the endpoint path to the Keystone server. # If not specified, defaults to http://127.0.0.1:35357/v2.0 AUTH_ENDPOINT= # Defines the location of the trust store file for use in one-way SSL # communication with the Keystone serve. Not set, by default TRUSTSTORE= # Defines the password used to access the contents of the Trust Store # file. It must be provided in plain text, which is encrypted by the controller installer scripts # when recorded for future use by the controller. After the controller is started, the plain text # password will be deleted from this configuration file TRUSTSTORE_PASS= # Defines the token string to use for administrative configuration on the Keystone server. # If not specified, defaults to ADMIN AUTH_TOKEN= 3. Populate the above empty variable fields with the values corresponding to the settings for the remote Keystone server. 4. Save and close the sdnctl.conf file. If the controller service is restarted after the /etc/sdn/sdnctl.conf file has been configured with an incorrect setting for AUTH_ENDPOINT, the controller cannot communicate with the remote Keystone server, and controller UI access is blocked. To regain UI access, update the sdnctl.conf file to the correct remote Keystone server address, close the file, and use sudo service sdnc restart to restart the controller. 5. Continue with post install tasks, see Post install tasks on page 38. Chapter 4 Controller installation with a remote Keystone server 31

Chapter 5 In-place controller upgrade using the Debian package This chapter describes how to upgrade from an existing version 2.7.10 or 2.7.16 controller to version 2.8.8 using the 2.8.8 Aruba VAN SDN Controller Debian package. The upgrade is in-place on a single existing controller system. If you have a 2.7.1.0 or 2.7.16 controller virtual appliance to upgrade to 2.8.8, do a migration instead of an in-place upgrade. For details on migration, see Migrating from 2.7.10 or 2.7.16 to a new 2.8.8 virtual appliance on page 13. In-place upgrade when one or more Aruba SDN applications are installed on the controller In-place upgrade from 2.7.10 to 2.8.8 Upgrading from 2.7.10 to 2.8.8 is supported if one Aruba SDN application (Aruba Network Protector SDN application, Aruba Network Visualizer SDN application, Aruba Network Optimizer SDN application) is installed on the same system as the controller. If you have more than one Aruba SDN application installed on the same system as the controller, you cannot upgrade or migrate the controller to 2.8.8. Instead, install the new controller version on a different system and then install the applications on this new system. With this scenario, your configuration data is not preserved. Before migration, check that the Aruba SDN application installed on the pre-existing 2.7.10 controller matches the following versions: Controller 2.7.10 and Network Protector 1.3.55 Controller 2.7.10 and Network Visualizer 1.1.18 Controller 2.7.10 and Network Optimizer 1.4.6.131 If the application is an earlier version: 1. Follow the application upgrade procedure to upgrade the application to the required version. 2. Upgrade the controller. 3. Upgrade the application to the latest version. See the Aruba VAN SDN Controller and Applications Support Matrix for the application versions supported on the 2.8.8 controller. In-place upgrade from 2.7.16 to 2.8.8 Upgrade from 2.7.16 to 2.8.8 is supported when one or more Aruba SDN applications (Aruba Network Protector SDN application, Aruba Network Visualizer SDN application, Aruba Network Optimizer SDN application) are installed on the same system as the controller. Before migration, check that any Aruba SDN applications installed on the pre-existing 2.7.16 controller match the following versions: Controller 2.7.16 and Network Protector 1.3.108.2100 (or later) Controller 2.7.16 and Network Visualizer 1.1.27.581 (or later) Controller 2.7.16 and Network Optimizer 1.4.11.184 (or later) If any applications are an earlier version: 32 Aruba VAN SDN Controller 2.8 Installation Guide

1. Follow the application upgrade procedure to upgrade the applications to the required versions. 2. Upgrade the controller. 3. Upgrade the applications to the latest version. See the Aruba VAN SDN Controller and Applications Support Matrix for the application versions supported on the 2.8.8 controller. Controller configuration file updates during an upgrade New releases of the controller can include updates to controller configuration files. During a controller software upgrade, the controller determines whether any of the existing configuration files include nondefault (userentered) settings. If nondefault content is detected for a given configuration file, a determination has to be made whether to overwrite the existing file with the new version or retain the existing file. During the upgrade, you may be prompted with the following message and you can choose whether to retain the existing nondefault controller configuration files or access the new version of the files. Configuration file '<file_name>' ==> Modified (by you or by a script) since installation. ==> Package distributor has shipped an updated version. What would you like to do about it? Your options are: Y or I : install the package maintainer's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** <file_name> (Y/I/N/O/D/Z) [default=n]? Hewlett Packard Enterprise recommends that you enter Y at the prompt to accept the new release version of each configuration file for which you are prompted. This replaces the earlier, nondefault version of the file with a new default version. The controller then adopts the new version of the configuration file and renames and saves the earlier, nondefault version with an -old extension. (You will not be prompted during an upgrade for any configuration files that contain only their default content. Such files are installed automatically.) For example, suppose that you are upgrading the controller from release 2.7.1.0 and 2.7.16 and the configuration file in 2.8.8 named com.hp.sdn.misc.adminrestcomponent.properties includes nondefault content. In this case, you would be prompted to choose an action. By entering Y at the prompt, you would be choosing to accept the new 2.8.8 version of the file and save the former version by renaming it to com.hp.sdn.misc.adminrestcomponent.properties. This operation enables you to save a copy of the earlier, nondefault version of the file, while accepting the new version. However, if you wish to retain the nondefault version of a configuration file, you can do so by entering N at the prompt. If any of the following configuration files are changed to nondefault content in the 2.7.1.0 and 2.7.16 controller and the 2.8.8 upgrade delivers a new value for the changed content, then when upgrading, a determination has to be made whether to overwrite the existing file with the new version or retain the existing file. 1. /opt/sdn/virgo/configuration/config.ini 2. /opt/sdn/virgo/bin/dmk.sh 3. /opt/sdn/virgo/repository/usr/com.hp.sdn.api.impl.alertpostmanager.properties 4. /opt/sdn/virgo/repository/usr/com.hp.sdn.ctl.of.impl.controllermanager.properties 5. /opt/sdn/virgo/repository/usr/com.hp.sdn.misc.adminrestcomponent.properties 6. /opt/sdn/virgo/repository/usr/com.hp.sdn.misc.servicerestcomponent.properties 7. /opt/sdn/virgo/repository/usr/com.hp.sdn.adm.auth.impl.authenticationmanager.properties 8. /opt/sdn/virgo/repository/usr/com.hp.sdn.adm.mgr.impl.hpws.hpwsinstallmanager.properties 9. /opt/sdn/virgo/repository/usr/com.hp.sdn.teaming.impl.teamconfigurationmanager.properties Chapter 5 In-place controller upgrade using the Debian package 33

10. /opt/sdn/virgo/repository/usr/com.hp.sdn.teaming.impl.cassandraprocessmanager.properties 11. /etc/init/sdnc.conf 12. /etc/init/sdna.conf 13. /opt/sdn/virgo/configuration/tomcat-server.xm 14. /etc/sdn/sdnctl.conf If you accept the new version of a configuration file but later want to revert to the previous version of the file, you can do so by renaming the files accordingly. The following is an example of the process: Stop the controller server using the following command: sudo service sdnc stop In this example, rename the new version of /opt/sdn/virgo/bin/dmk.sh to /opt/sdn/virgo/bin/ dmk.dpk-old2. Then rename the saved version of /opt/sdn/virgo/bin/dmk.dpk-old to /opt/sdn/ virgo/bin/dmk.sh. Restart the controller service. sudo service sdnc start If you retain the old version of a configuration file but later want to use the new version, you can do so by renaming the files accordingly. The following is an example of the process: Stop the controller server using the following command: sudo service sdnc stop In this example, rename the file /opt/sdn/virgo/bin/dmk.sh to dmk.sh.old2. Then rename the file dmk.sh.dpkg-dist to dmk.sh. Restart the controller service. sudo service sdnc start Preliminary steps Before you begin upgrading, you must do the following: 1. If you have an Aruba SDN application installed on the controller system, see the documentation for the application for any steps you must complete before upgrading the controller. 2. Back up the controller you want to upgrade. For details on the backup and restore procedure for the controller, see the Aruba VAN SDN Controller Administrator Guide. 3. If the controller is operating in an HA (team) environment, you must first disband the team before upgrading. Then you upgrade each controller individually, as described in this section, then rebuild the team. For information on disbanding and rebuilding a team, see the Aruba VAN SDN Controller Administrator Guide. If you have Aruba Network Protector or Aruba Network Optimizer installed, if the team is dismantled, all the application configuration and data will be lost. Check the application installation guide for application HA upgrade steps. 4. Ensure that Network Time Protocol (NTP) is installed and configured on your system. 5. Verify if any of the following Aruba SDN applications were installed on the controller: Aruba Network Optimizer SDN application, Aruba Network Protector SDN application, or Aruba Network Visualizer SDN application. Disable any of these Aruba SDN applications on the controller before upgrade. The Aruba SDN applications must be enabled after the upgrade even if they will simply be uninstalled, unless the application documentation states explicitly otherwise. 6. Shut down the controller using the following command: ~$ sudo service sdnc stop 34 Aruba VAN SDN Controller 2.8 Installation Guide

7. Download the 2.8.8 Aruba VAN SDN Controller Debian package as described in Downloading the controller software on page 7. 8. Continue to the next section. Unpacking the controller software Where a command in the following procedures is shown with multiple lines, the line breaks are inserted at the points where a space occurs in the actual command. Do the following to prepare the downloaded Aruba VAN SDN Controller Debian package for installation: 1. Ensure that you have root access on the Ubuntu system using the sudo command. 2. Unpack the Aruba VAN SDN Controller Debian package from the directory in which the package is stored: In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366. The unpack command first does a verification to ensure that your system hardware meets the minimum requirements needed for controller operation. If your system does not meet hardware requirements, the command fails and an error message is displayed. For an example of the error and instructions on what to do if this error occurs, see Verifying hardware requirements on page 35. If the unpack command completes with no error, continue on to Installing and verifying the controller on page 36. Verifying hardware requirements Unpacking the Aruba VAN SDN Controller Debian package verifies that your hardware system meets the minimum requirements for operation in a medium (production) environment. If the verification detects that the hardware does not meet these minimum requirements, you will see an Error message and output similar to the following. If the Error message does not appear, skip this section and go to the next section, Installing and verifying the controller on page 36. Error! This controller has X cores! (8 cores required) Error! This controller has XX GB of RAM! (16 GB required) Error! This controller has XX GB of available storage! (64 GB required) This hardware platform doesn't meet the minimum requirements for a production deployment. Please see the Support Matrix for additional hardware requirements for sizing production deployments. To override this check, run the following command before installation: 'touch /tmp/override.txt' Overriding this check is useful for demonstrations and small test environments. Some features may not work properly without a controller that meets minimum hardware requirements. An installation using this check should not be used in production networks and will not be supported by HPE support. Chapter 5 In-place controller upgrade using the Debian package 35

If the above message appears, the controller hardware does not meet the minimum requirements for number of cores, free RAM, and/or available storage for a development or test environment. If you are installing a controller for operation in a production network, you must halt the installation process and start over with controller hardware that meets the requirements for your system. For full information on controller hardware requirements, see the section titled Hardware requirements and recommendations in the latest edition of the Aruba VAN SDN Controller and Applications Support Matrix. If you choose to override hardware verification, run the touch command and rerun the dpkg --unpack command as shown below, and then go to the next section, Installing and verifying the controller on page 36: ~$ touch /tmp/override.txt In the following command, two hyphens precede the unpack keyword; that is, --unpack. ~$ sudo dpkg --unpack hp-sdn-ctl_2.8.x.yyyy_amd64.deb (Where x.yyyy completes the actual release version number of the controller. For example, 2.8.8.0366.) Installing and verifying the controller During the upgrade, the controller checks to see if any of the configuration files have been changed to include nondefault (user-entered) settings. If nondefault content is detected for a given configuration file, you are prompted to choose whether to retain the existing, nondefault configuration files, or accept the new version of the file. For details, see Controller configuration file updates during an upgrade on page 33 before continuing. Use the following procedure to install the downloaded Aruba VAN SDN Controller Debian package. 1. To install software dependencies, execute the following command. ~$ sudo apt-get install -f 2. Depending on your existing controller configuration, installing the version 2.8.8.0366 controller may include manually managing certain controller configuration files. If only the system prompt (~$ ) appears, manual management of controller configuration files is not necessary. Go to the next step. If the following configuration file prompt appears instead of the system prompt, then one or more of the controller configuration files were changed from the default content before starting the controller upgrade. In this case, for each changed configuration file prompt, you must either accept the new version of the file or retain the existing version. For more information on the configuration file option, see Controller configuration file updates during an upgrade on page 33. Configuration file ==> Modified (by you or by a script) since installation. Package distributor has shipped an updated version. What would you like to do about it? Your options are: Y or I : install the package maintainer's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation 36 Aruba VAN SDN Controller 2.8 Installation Guide

The default action is to keep your current version. *** dmk.sh (Y/I/N/O/D/Z) [default=n]? Hewlett Packard Enterprise recommends that you enter Y to each instance of the above prompt but you can choose other options as described in Controller configuration file updates during an upgrade on page 33. When you have completed responding to the configuration file prompts, go to the next step. 3. Verify the controller installation: ~$ sudo dpkg -l hp-sdn-ctl If the Aruba VAN SDN Controller Debian package is properly installed, output similar to the following appears: ii hp-sdn-ctl 2.8.x.xxx Aruba VAN SDN Controller The ii in the above output line indicates a successful controller installation. Any other characters appearing instead of ii (such as iu) indicates that the controller is not correctly installed. In this case, see Controller installation failed. 4. In the command-line window, verify that the sdnc service is started: ~$ sudo service sdnc status It may take up to 60 seconds after installing the controller (the sudo apt-get install -f command) for the service to be up. Wait 60 seconds after installing the controller before verifying the sdnc is started. If the service fails to start, see The SDN Controller service (SDNC) failed to start. You should see the following output, which indicates that the sdnc service is started: ~$ sdnc start/running, process nnnn Where: nnnn is the process ID assigned to the main Aruba VAN SDN Controller process (sdnc). Upgrading the applications Prerequisites 1. Enable the applications one at a time. 2. Log in to each application and verify that all of the data exists. 3. Upgrade each application. 4. Verify that all data and configurations exist for each application. 5. Continue with post install tasks, see Post install tasks on page 38. Chapter 5 In-place controller upgrade using the Debian package 37

Chapter 6 Post install tasks After you do a new install, there are a number of post install tasks you may want to do. Verifying the NTP configuration on page 38 Verifying the controller installation on page 38 Applying a controller license on page 40 Running post install configuration scripts on page 40 for configuring the following: Set the logging level (supported levels include DEBUG, INFO, WARN, ERROR, ALL, TRACE, OFF) Set the JVM options for the controller Set the date and time or NTP server to use Set the password for the controller UI Enter the controller license key. Run a sanity check on the health of the controller system Ensuring high availability and secure controller operation on page 45 Obtaining Aruba SDN applications Verifying the NTP configuration The Network Time Protocol (NTP) is required to keep the controller in synchronization with your network hardware and virtual devices. It is automatically installed with the controller unless already installed on your machine. In most cases NTP will already be installed and configured. (A new NTP installation synchronizes with default time servers if your machine is not already configured for specific time servers.) To verify that NTP is configured on your system, do the following: 1. Run this command: ~ $ ntpdc -c peers 2. If the command output returns a server list similar to the following, one or more NTP servers are configured on the system. remote local st poll reach delay offset disp ======================================================================= =clock.example.net 192.0.2.105 16 64 0 0.000000 0.000000 3.99217 =myco.altopt.ca 192.0.2.137 16 64 0 0.000000 0.000000 3.99217 3. If no NTP servers are configured on the controller system, you can configure an NTP server using the post install configuration script. For details, see Running post install configuration scripts on page 40. 4. You can also configure an NTP server in the controller UI in the Configurations screen in the System tab. Verifying the controller installation Verify the controller installation by logging on to the controller UI using the default user name and password. (For information on supported web browsers, see the Aruba VAN SDN Controller and Applications Support Matrix.) 1. Using a supported web browser, access the controller user interface: https://controller_ip_address:8443 38 Aruba VAN SDN Controller 2.8 Installation Guide

(Replace controller_ip_address with your controller IP address.) The Aruba VAN SDN Controller login screen appears: 2. Enter your user name and password and click Login. The user name and password are set in the Keystone software before the Aruba VAN SDN Controller installation. Unless the Keystone configuration script is changed before installation, the default user name and password are used: default user name: sdn default password: skyline Chapter 6 Post install tasks 39

If the controller is running, a display similar to the following appears: Figure 1: Default controller console UI Applying a controller license There are several different ways you can activate the SDN Controller license. To use the post install configuration script, see Running post install configuration scripts on page 40. To use the controller UI, see the chapter covering licensing in the Aruba VAN SDN Controller Administrator Guide. To use curl commands and the REST API, see the appendix covering curl commands in the Aruba VAN SDN Controller Administrator Guide. Running post install configuration scripts Post install configuration tools include a Python script you can use to do the following basic configuration tasks: Set the logging level (supported levels include DEBUG, INFO, WARN, ERROR, ALL, TRACE, OFF) Set the JVM options for the controller Set the date and time or set the NTP server to use Set the password for the controller UI Enter the controller license key Run a sanity check on the health of the controller system The post install configuration Python script (config_sdn.py) is available locally on a controller. This script allows you to make configuration changes on a single controller. The script uses Python version 2.7. You can also complete the following configuration tasks in the controller UI on the Configurations screen in the System tab: Set the logging level Set the data and time or set the NTP server to use Change the password 40 Aruba VAN SDN Controller 2.8 Installation Guide