Product Documentation
Imprivata Virtual Appliance Guide
Imprivata OneSign® 5.0 or Later
Imprivata Confirm ID™ 1.0 or Later
© 2015 Imprivata, Inc. All Rights Reserved.
You can host and manage Imprivata virtual appliances using VMware virtualization software. An Imprivata virtual appliance is a self-contained software implementation of the Imprivata server that is functionally equivalent to an
Imprivata hardware appliance.
Imprivata virtual appliances are formatted using the industry-standard Open Virtualization Format (OVF). You can deploy a heterogeneous enterprise with both virtual and hardware Imprivata appliances if allowed by your license.
Each Imprivata virtual appliance requires: l l l l
VMware ESX or ESXi with vSphere 4.x or later
2 CPUs
250GB of disk space (thin provisioning allowed)
8GB of memory (RAM)
This guide contains the following sections:
Configuring Imprivata Virtual Appliances
Configuring the Imprivata Virtual Appliance on the Network
Accessing the Imprivata Virtual Appliance Functions Menu
Menu Descriptions
Deploying Imprivata Virtual Appliances
Deploying an Imprivata Virtual Appliance on VMware ESX
Deploying an Imprivata Virtual Appliance on Microsoft Hyper-V
Import the Virtual Machine
Choose Import Type
Choose Folders
Using the Imprivata Virtual Appliance in a VMware ESX Thin-Provisioned Environment
Managing Thin-Provisioned Virtual Appliances
Replacing Existing Imprivata Virtual Appliances with Thin-Provisioned Imprivata Virtual Appliances
Deploying a Thin-Provisioned Imprivata Virtual Appliance
Replacing Hardware Appliances with Virtual Appliances
Preparing to Replace Your Hardware Appliances
Single-Site Enterprise
Scenario #1: the New Virtual Appliances Have Different IP Addresses Than the Deleted Hardware
Appliances
Scenario #2: the New Virtual Appliances Have the Same IP Addresses as the Deleted Hardware
Appliances
Multi-Site Enterprise
9
10
10
7
9
7
7
9
9
6
6
6
7
5
5
4
5
3
3
3
Imprivata Virtual Appliance Guide 2
Configuring Imprivata Virtual Appliances
You can access the Imprivata virtual appliance from the VMware Virtual Machine console after configuration. After deploying a virtual appliance, you must configure it on your network from the Imprivata virtual appliance console by opening the virtual machine console in your VMware software. After the Imprivata Configuration Wizard, you can access other Imprivata appliance functions from the Imprivata virtual appliance menu.
Configuring the Imprivata Virtual Appliance on the Network
The Imprivata virtual appliance runs initialization scripts that can take a varying amount of time. You can begin configuring the appliance when the Imprivata virtual appliance console opens. To configure the appliance:
1. Open the virtual machine console in your VMware host. The Imprivata virtual appliance console opens.
NOTE: Do not select the other options from the menu.
2. Select Login and press Enter. A login screen opens.
3. At the login prompt, enter menu and press Enter.
4. Enter the appliance IP address and press Enter.
5. Enter the appliance subnet mask and press Enter.
NOTE: Settings are not persisted. Do not shut down the virtual appliance until you finish the wizard.
The Imprivata virtual appliance menu opens.
Options in this menu are described in
Imprivata Virtual Appliance Menu Descriptions .
6. Press 6 and then Enter to return to the Imprivata virtual appliance menu.
7. You can now begin the Imprivata Configuration Wizard.
Open an Internet Explorer (V6.0 or later) browser window to:
https://<Appliance IP address>:81/.
Accessing the Imprivata Virtual Appliance Functions Menu
You can access the virtual appliance function menu at any time from the Imprivata virtual appliance menu. Not all menu options are available until you complete the Imprivata Configuration Wizard.
To access the Imprivata virtual appliance menu:
1. Open the virtual machine console in your VMware host. The Imprivata virtual appliance console opens.
2. Select Login and press Enter.
3. At the login prompt, enter menu and press Enter. If prompted, enter the menu password and press Enter.
The Imprivata virtual appliance functions menu opens.
Imprivata Virtual Appliance Guide 3
Menu Descriptions
You can change network settings, shutdown/restart the system, reset the Imprivata Appliance Console password, clear SSL information, reset the appliance, and modify the Imprivata virtual appliance menu password.
The virtual appliance menu options are: l l l l l l l l
Configure Network — Lets you change the default gateway for the appliance. It is for installation only. Change this setting from the Network tab under the Network page of the Imprivata Appliance Console.
Reset SSL — Clears all SSL information, including the optional SSL 2.0 setting.
Reset Administrator password for Imprivata Appliance Console — Resets the Administrator password to
admin. You cannot reset the Super Administrator password.
Modify Password for this menu — Lets you set or clear the password for this menu.
Restage — Resets the appliance to factory settings. Contact Imprivata Technical Support for assistance with restaging an appliance.
Restart — Restarts the appliance. It is best to restart the appliance by clicking the Restart button in the
Operations tab under the System page of the Imprivata Appliance Console unless the Imprivata
Appliance Console is unreachable.
Shutdown — Shuts down the appliance. The Virtual Machine is still deployed in the VMware host.
Quit — Exits the menu.
Imprivata Virtual Appliance Guide 4
Deploying Imprivata Virtual Appliances
You can host and manage Imprivata virtual appliances using VMware ESX or Microsoft Hyper-V virtualization software.
Deploying an Imprivata Virtual Appliance on VMware ESX
Each Imprivata virtual appliance hosted in a VMware ESX environment requires: l l l
VMware ESX or ESXi with vSphere 4.x or later
2 CPUs allocated
258GB of total disk space, including 8GB of allocated memory (thin provisioning allowed)
To deploy an Imprivata virtual appliance on an ESX or ESXi server:
1. Log into the vSphere Client.
2. Click Inventory. The Inventory screen opens.
3. Click File > Deploy OVF Template. The Deploy OVF Template window opens.
4. Select Deploy from file and open the .OVF file supplied by Imprivata.
5. Click Next. The OVF Template Details screen opens.
6. Review the information and click Next. The Name and Location screen opens.
7. Enter a name for the VMware Virtual Machine and click Next. The Ready to Complete screen opens.
8. Review the information and click Finish to deploy the Imprivata virtual appliance. A message is displayed that indicates the deployment is in progress in addition to a progress bar and a time remaining indicator.
9. After the Imprivata virtual appliance finishes deploying, power on the Virtual Machine. The vSphere Client screen Virtual Tab opens.
See
Configuring Imprivata Virtual Appliances
to continue configuring the virtual appliance. For additional information about hosting Virtual Machines, refer to the documentation for your VMware product.
See also:
Using the Imprivata Virtual Appliance in a VMware ESX Thin-Provisioned Environment
Deploying an Imprivata Virtual Appliance on Microsoft Hyper-V
Each Imprivata virtual appliance hosted in a Microsoft Hyper-V environment requires: l l l l l
Microsoft Hyper-V x64 or later
Microsoft Windows Server 2012 R2 or later
Imprivata OneSign 4.9 or later
2 CPUs allocated
258 GB of total disk space, including 8GB of allocated memory (thin provisioning allowed)
Imprivata Virtual Appliance Guide 5
Import the Virtual Machine
1. Log into the Hyper-V Manager.
2. Go to Actions > Import Virtual Machine.
3. Browse to the virtual machine folder that contains the following three sub-directories: o o
Snapshots
Virtual Hard Disks o
Virtual Machines
4. Select the folder that contains these three sub-directories and click Next. In Select Virtual Machine, the virtual machine to import is displayed (this is the VHD file in the Virtual Hard Disks folder).
Choose Import Type
1. In the Choose Import Type window, choose the type of import to perform: o o o
Register – You have an environment where you have already put all of the virtual machine files exactly where you want them, and you only need Hyper-V to begin using the virtual machine as is.
Restore – Your virtual machine files are stored on a file share, or removable drive, for example, and you want Hyper-V to move the files to the appropriate location for you, and then register the virtual machine.
Copy – You have a set of virtual machine files that you want to import multiple times (such as using them as a template for new virtual machines). This selection will copy the files to an appropriate location, give the virtual machine a new unique ID, and then register the virtual machine.
2. Click Next.
Choose Folders
1. In the Choose Folders for Virtual Machine Files window, select Store the virtual machines in a different
location.
2. The Virtual machine configuration, Checkpoint store, and Smart paging folders must all be located in one new folder. Create this folder and enter the location in all three fields. Click Next.
3. In the Choose Folders to Store Virtual Hard Disks window, select the same folder again as in Step 2. Click Next.
4. Review the Summary, and click Finish.
See
Configuring Imprivata Virtual Appliances
to continue configuring the virtual appliance.
Imprivata Virtual Appliance Guide 6
Using the Imprivata Virtual Appliance in a VMware
ESX Thin-Provisioned Environment
Imprivata virtual appliances can be deployed using VMware ESX thin-provisioning. Thin-provisioned virtual appliances have the same performance as thick-provisioned virtual appliances, as determined by the ESX infrastructure. Disk provisioning selection does not impact memory, CPU, and other Imprivata virtual appliance allocations; see
Deploying Imprivata Virtual Appliances .
NOTE: Thin-provisioned virtual appliances never shrink in size once space is allocated by the hypervisor. This is a limitation of ESX Thin Provisioning, and is not limited to the Imprivata virtual appliance. You may see significant increases in Imprivata virtual appliance disk sizes if an appliance is unreachable for replication traffic in a problem situation. The only way to recover disk space is to replace appliances (see
Replacing Imprivata Virtual Appliances with Thin-Provisioned Virtual
Appliances ).
Managing Thin-Provisioned Virtual Appliances
When your Imprivata appliances are thin-provisioned, you must carefully monitor the space where the virtual appliance is deployed, for both the hypervisor (datastore) and the storage device (local disk, SAN, NFS, and so forth). The initial thin-provisioned size of the virtual appliance is about 20 GB. The maximum thin-provisioned virtual appliance disk usage is 250 GB plus 8 GB of memory, the same as a thick-provisioned virtual appliance. The virtual appliance guest assumes it has a 250 GB disk available. If the storage device or datastore runs out of space, then the virtual appliance fails at the first event that requires more disk space. You can monitor virtual appliance disk usage in ESX, in the Imprivata Appliance Console System page Operations tab, or in the appliance logs.
WARNING: There are no notifications or warnings if the hypervisor cannot allocate more disk space for the Imprivata virtual appliance. The host and Imprivata continue to operate normally
without warning/notification until disk space runs out, and then unpredictable problems occur.
Assume that, in this case, Imprivata OneSign shuts down and does not provide service to users.
Replacing Existing Imprivata Virtual Appliances with Thin-
Provisioned Imprivata Virtual Appliances
To replace existing virtual appliances with thin-provisioned virtual appliances:
1. Remove the thick-provisioned Imprivata virtual appliance from the enterprise. Confirm that the virtual appliance is powered off.
2. Deploy the new thin-provisioned Imprivata virtual appliance.
3. Synchronize the enterprise database from the Imprivata Appliance Console System page > Operations tab.
4. Add the thin-provisioned virtual appliance to the enterprise.
5. Delete the thick-provisioned virtual appliance.
Deploying a Thin-Provisioned Imprivata Virtual Appliance
To deploy a virtual appliance to a thin-provisioned ESX disk:
Imprivata Virtual Appliance Guide 7
1. Log into VMware vSphere Client and Create a new virtual machine as you would for a thick-provisioned VM, but for Disk Format, select Thin provisioned format instead as shown in the following image:
2. Complete the process and deploy as you would for a thick-provisioned VM.
NOTE: As with all thin-provisioned VMs, the Used Storage grows over time and never diminishes of its own accord.
As the SAN fills up, you may want to recover some of that space. See
Replacing Existing Imprivata Virtual
Appliances with Thin-Provisioned Imprivata Virtual Appliances
Imprivata Virtual Appliance Guide 8
Replacing Hardware Appliances with Virtual
Appliances
This topic contains best practices for replacing Imprivata hardware appliances with virtual appliances with no or minimal server downtime.
NOTE: The following sections only provide a high-level overview of this process to outline general best practices. Refer to Adding an Appliance to the Enterprise for more information.
Preparing to Replace Your Hardware Appliances
Perform the following steps before adding or removing any appliances:
1. Consult with Imprivata Professional Services if you are working with a large enterprise.
2. Purchase licenses for your new virtual appliances.
3. Back up your current enterprise database.
4. Delete audit records if possible to decrease the size of the database. See "Managing and Maintaining Audit
Records" in the Imprivata Online Help for more information.
5. Back up your current enterprise database again.
Single-Site Enterprise
The following steps are recommended best practices for replacing hardware appliances with virtual appliances in a
single-site enterprise with no server downtime.
Scenario #1: the New Virtual Appliances Have Different IP Addresses Than the Deleted Hardware Appliances
This scenario applies to a typical enterprise configuration in which two hardware appliances are being replaced by two virtual appliances. The virtual appliances will have different IP addresses than the deleted hardware appliances.
To replace two Imprivata hardware appliances with two Imprivata virtual appliances:
1. Add the two virtual appliances to your enterprise while the hardware appliances are still running.
2. Make sure that the replication status of the new appliances is green (Up) on the Sites tab of the Properties page in the Imprivata Admin Console.
3. Shut down and delete the two hardware appliances from the enterprise.
NOTE: You can change the IP addresses of the virtual appliances in the virtual machine console; however, keep in mind that this will result in some server downtime.
Imprivata Virtual Appliance Guide 9
Scenario #2: the New Virtual Appliances Have the Same IP Addresses as the
Deleted Hardware Appliances
This scenario applies to a typical enterprise configuration in which two hardware appliances (SSO1 and SSO2) are being replaced by two virtual appliances (OVA1 and OVA2). The virtual appliances will have the same IP addresses as the deleted hardware appliances.
To replace two Imprivata hardware appliances with two Imprivata virtual appliances:
1. From SSO2, delete SSO1 from the enterprise.
2. From SSO2, add OVA1 to the enterprise. OVA1 must be configured with the same settings as SSO1.
3. From OVA1, delete SSO2 from the enterprise.
4. From OVA1, add OVA2 to the enterprise. OVA2 must be configured with the same settings as SSO2.
Multi-Site Enterprise
The following steps are best practices for switching from hardware appliances to virtual appliances in a multi-site
enterprise.
To replace Imprivata hardware appliances with Imprivata virtual appliances in a multi-site enterprise:
1. Add one Imprivata virtual appliance per site while the hardware appliances are still running. For example, if you have two sites, Site 1 and Site 2, that each contain one hardware appliance, then add one virtual appliance to Site 1 and one virtual appliance to Site 2.
2. Make sure that the replication status for the new virtual appliances is green (Up) on the Sites tab of the
Properties page in the Imprivata Admin Console.
3. One site at a time, shut down and delete each hardware appliance you want to remove. For example, if you added one virtual appliance each to Site 1 and Site 2, then delete one hardware appliance from Site 1 and one hardware appliance from Site 2.
4. Optional — If you want the virtual appliances to have the same IP addresses as the removed hardware appliances, then change the IP addresses in the virtual appliance console.
This step will result in a brief period of server downtime (typically a few minutes). If you do not want any server downtime, then only perform steps 1-3.
Imprivata Virtual Appliance Guide 10
