A10 Networks Thunder Azure vThunder Installation Guide
تبلیغات
تبلیغات
vThunder for Azure
July 11, 2016
INSTALLATION GUIDE
© 2016 A10 Networks, Inc. Confidential and Proprietary - All Rights Reserved
Information in this document is subject to change without notice.
Patent Protection
A10 Networks products are protected by patents in the U.S. and elsewhere. The following website is provided to satisfy the virtual patent marking provisions of various jurisdictions including the virtual patent marking provisions of the America Invents Act. A10 Networks' products, including all Thunder Series products, are protected by one or more of U.S. patents and patents pending listed at: https://www.a10networks.com/company/legal-notices/a10-virtual-patent-marking .
Trademarks
The A10 logo, A10 Harmony, A10 Lightning, A10 Networks, A10 Thunder, aCloud, ACOS, Affinity, aFleX, aFlow, aGalaxy, aGAPI, aVCS, AX, aXAPI, IDsentrie, IP-to-ID, SSL Insight, SSLi, Thunder, Thunder TPS, UASG, and vThunder are trademarks or registered trademarks of A10
Networks, Inc. in the United States and other countries. All other trademarks are property of their respective owners.
Confidentiality
This document contains confidential materials proprietary to A10 Networks, Inc. This document and information and ideas herein may not be disclosed, copied, rep ro duced or distributed to anyone outside A10 Networks, Inc. without prior written consent of
A10 Networks, Inc.
A10 Networks Inc. Software License and End User Agreement
Software for all A10 Networks products contains trade secrets of A10 Networks and its subsidiaries and Customer agrees to treat Software as confidential information.
Anyone who uses the Software does so only in compliance with the terms of the End User License Agreement (EULA), provided later in this document or available separately. Customer shall not:
1. reverse engineer, reverse compile, reverse de-assemble or otherwise translate the Software by any means
2. sublicense, rent or lease the Software.
Disclaimer
This document does not create any express or implied warranty about A10 Networks or about its products or services, including but not limited to fitness for a particular use and non-infringement. A10 Networks has made reasonable efforts to verify that the information contained herein is accurate, but A10 Networks assumes no responsibility for its use. All information is provided "as-is." The product specifications and features described in this publication are based on the latest information available; however, specifications are subject to change without notice, and certain features may not be available upon initial product release. Contact A10 Networks for current information regarding its products or services. A10 Networks’ products and services are subject to A10 Networks’ standard terms and conditions.
Environmental Considerations
Some electronic components may possibly contain dangerous substances. For information on specific component types, please contact the manufacturer of that component. Always consult local authorities for regulations regarding proper disposal of electronic components in your area.
Further Information
For additional information about A10 products, terms and conditions of delivery, and pricing, contact your nearest A10 Networks location, which can be found by visiting www.a10networks.com
.
Table of Contents
page 3 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Contents
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 4
Installation
Overview
This guide describes how to install the 64-bit vThunder virtual appliance in an Microsoft’s Azure cloud environment.
vThunder for Azure
vThunder for Azure is a fully operational, software-only version of the ACOS Series Server Load Balancer (SLB), or Application
Delivery Controller (ADC) device. vThunder is a virtual appliance, yet it retains most of the functionality available on the hardware-based ACOS appliances.
Managing vThunder is the same as managing a hardware-based ACOS device, and vThunder has the same CLI configurations and GUI presentation.
The networking configuration for vThunder is also similar to a hardware-based ACOS device. With the release of the 64-bit image, vThunder for Azure can support up to eight virtual CPUs.
Microsoft Azure
Microsoft Azure (formerly known as Windows Azure) is Microsoft’s cloud computing platform. Azure is an industry leader for both infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS). Azure offers a combination of managed and unmanaged services that lets customers deploy and manage their applications as they see fit.
The Azure cloud computing platform runs on Microsoft datacenters and is globally distributed across more than a dozen countries. Such global distribution helps ensure customers receive high performance, regardless of where they are located.
Azure is flexible and can support virtually any operating system, from Windows to Linux, any programming language, from
Java to C++, and any database, from SQL to Oracle.
Azure offers 99.95% uptime and is the platform that Microsoft uses to run many of its own popular services, such as Bing,
Skype, Xbox, and Office 365.
Azure enables businesses to move their network infrastructure to the cloud, so they can set up virtual servers (or “instances”), and other computing resources, in a virtual platform powered by Microsoft Azure hypervisors.
A10 Networks vThunder virtual device can be set up as an instance in Azure’s cloud, and can be used to provide a robust server load balancing (SLB) service.
page 5 | Document No.: VT-AZURE-003 - Jul 11, 2016
Figure 1 shows how vThunder fits into the Microsoft Azure infrastructure.
FIGURE 1 vThunder for Azure vThunder for Azure—Installation Guide
Overview
Prerequisites for Installing vThunder
Before installing vThunder, you must first set up an account with Microsoft Azure.
If you have not yet set up an Azure account, you can use your MSDN credentials, or you can open a free trial account here: http://azure.microsoft.com/en-us/pricing/free-trial/
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 6
vThunder for Azure—Installation Guide
Overview
Feature Support
vThunder for Azure supports many of the same features as the Thunder Series hardware-based models, but the exact set of supported features varies based on whether vThunder is running an ADC (SLB) release, CGN (IPv6 Migration) release, or a
DDoS release.
TABLE 1 Un-supported Features in Various ACOS Software Releases
ADC, CGNv6, or DDoS? Software Releases Numbers
ADC (SLB) ACOS 2.6.1
ACOS 2.7.1
ACOS 2.7.2
Features which are NOT supported
When vThunder is running an ADC (SLB) release, it supports most of the same features supported by the Thunder hardware-based models. However, the following features are not supported:
ACOS 4.x
1
CGN (IPv6 Migration) ACOS 2.6.6
ACOS 2.8.2
• High Availability (HA) and VRRP-A high availability (A10
Networks suggests using GSLB in cloud environments.)
For “simulated” HA, please refer to “Deploying
Global Server Load Balancing (GSLB) in Azure” on page 27
.
• CGN (IPv6 Migration) features (Large-scale NAT, DS-Lite,
NAT64/DNS64). SLB and CGN are mutually-exclusive.
Note: Although IPv6 (CGN) migration is not supported, some CGN commands may continue to appear in the
CLI menu. Please note that these commands cannot be successfully configured.
• Layer 3 Virtualization (L3V) private partitions are not supported. Only the shared partition is supported.
• Hardware-specific functions for SSL Insight, Forward
Proxy and Acceleration, HTTP/HTTPS compression
• Transparent (Layer 2) deployment
• Direct Server Return (DSR) configurations
• SmartNAT, which is typically used to automatically create NAT mappings using virtual protocol 20032-65535 when the standard NAT pools cannot support additional mappings
• Port mirroring
• Jumbo Frame
• Port-channels (may also be called “trunking”)
• VLAN (not supported in single-port mode)
Note: As of 5/6/2016, vThunder for Azure does not support
CGN releases.
DDoS
ACOS 4.x
ACOS 3.0.x
ACOS 3.1.x
ACOS 3.2.x
Note: As of 5/6/2016, vThunder for Azure does not support
DDoS releases.
1. ACOS 4.x offers both an ADC/SLB feature set and a CGN feature set, but the two feature sets are mutually exclusive.
This means that once ADC is enabled, the CGN configuration options are no longer displayed in the CLI or GUI.
The following CLI command can be used to enable the ADC or CGN feature sets: application-type {adc | cgnv6}
page 7 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Overview
Known Issues and Limitations
You may encounter the following known issues when using vThunder for Azure:
• When first launching a new vThunder instance in an Azure environment, you must Configure “ip address dhcp” before performing other configurations because there is no predefined DHCP in the start-up config file.
(A10 issue: 231956)
•
See “Configuring DHCP and the VIP in vThunder” on page 20 for details.
• If you change the endpoint port number in the Azure portal, make sure to clear your Internet browser's cache before attempting to navigate to the vThunder GUI. If not cleared, the browser will use the previously saved public port and will fail to access the vThunder GUI. (A10 issue: 231974)
•
See “Endpoint mapping” on page 17 for details.
• vThunder for Azure runs in single-interface mode. Therefore, both SLB and management traffic will be sent to the same interface. Virtual ports from 0–1023 can be used for data traffic, and virtual ports 1024 and higher can be used for management traffic.
• Once an IP is assigned to the vThunder management port, subsequent changes to this IP are not supported.
• For vThunder for Azure instances that have a pre-installed license, importing a new license is not supported. Therefore, starting with ACOS 4.x, you can no longer upgrade from a trial license to a standard license. (Bug 300539)
• Due to Azure limitations, SLB traffic and associated functions, (e.g., IP NAT, NAT range-list, and IP route) cannot pass traffic if the client and server are not on the same subnet. (Bug 294104)
• At the interface ethernet config level, the following commands are disabled:
• mtu command
• trunk-group
command
• IPsec VPN is not supported on vThunder for Azure. One ACOS device can send packets to another, and the other
ACOS device can receive the packet, but the reverse packet cannot be received by the VPN daemon on the first ACOS device. (Bug 307337)
• After installing a GLM license, you must reboot the vThunder instance before using the device. Otherwise, upon first logging in, the CLI commands will appear, but they cannot be configured without first rebooting the instance. (Bug
306338)
• vThunder for Azure does not support Layer 4 FTP passive mode and active mode. (Bug 300623)
• vThunder for Azure does not support Layer 2 multicast. This limitation means the following features that rely on L2 multicast are not supported: HA, STP BPDU, LACP PDU, LLDP, OSPF, OSPFv3, RIPv2, IS-IS. (Bug 289831)
• vThunder for Azure does not support wildcards, due to lack of support for “ip allow-promiscuous-vip”. (Bug 286280)
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 8
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
Configuring vThunder for Azure
This section describes the process of installing a vThunder instance in Microsoft’s Azure cloud environment. The first task before launching the vThunder instance is to set up an Azure account with Microsoft. To do so, navigate to the following link: https://azure.microsoft.com/en-us/ and select the management portal to access the login page.
Creating a Microsoft Azure Account
To set up an account with Microsoft Azure, follow the instructions below:
1. Access the Azure website at the following URL, and log in using your standard credentials, or create a new account: https://azure.microsoft.com/en-us/
The Microsoft Azure account subscription page appears, as shown below.
FIGURE 2 Microsoft Azure account subscription page
2. From the Azure account subscriptions page, click Portal to proceed to the Management Portal.
From the Azure Management Portal, you can set up web sites, manage databases, or monitor mobile services.
3. Next, proceed to “Creating a vThunder Instance on Azure” on page 10
to set up a cloud service.
page 9 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
Creating a vThunder Instance on Azure
The following steps detail how to set up a vThunder instance on Azure upon creation of a Microsoft Azure account.
1. From the Management Portal, navigate to the upper left-hand corner and click on the downward arrow to view the drop-down menu. Select Home to go to the Azure homepage.
2. Select Marketplace from the Azure homepage toolbar and search for “A10” under “Virtual Machines”.
3. Based upon your bandwidth needs, select the desired image to redirect to the VM creation page.
The list offers “10 Mbps” at the low end, up to “BYOL” at the high end.
NOTE: BYOL licensing is available for customers who have selected the permanent license model. You can load the BYOL license into your Azure account by choosing BYOL image
for step 3 above. If you wish to purchase a permanent license, rather than opting for the
hourly billing model, please contact [email protected]
.
NOTE: For additional information about installing a permanent license that you have already
purchased, see “License Installation for BYOL Licenses” on page 21 .
4. ) After selecting the desired image, click on “Create Virtual Machine” to be redirected to the Azure Preview Portal.
5. You are redirected to the Preview Portal and prompted to fill out a form ( Figure 3 on page 11
) to specify the properties for the virtual machine instance. This will also set up the respective cloud service and storage where the VM resides.
6. Enter the following information into the VM creation form:
• The desired name of the VM and cloud service in the Host Name field. This can only contain letters, numbers, and hyphens, and cannot contain special characters. Also, the first and last character must be a letter or number.
• Username and password for admin credentials to the VM. Password must contain an uppercase and lowercase letter, a number, and special character.
• Pricing tier (A10 offers the following standards A2-A4 for all images):
• A2 (2 cores, 3.5 GB mem)
• A3 (4 cores, 7 GB mem)
• A4 (8 cores, 14 GB mem)
• Resource group desired (by default, Azure will create a new resource group upon creation of a VM. The user can opt to use an older resource group by pulling down the drop-down menu in this field).
• Desired region from the Region or Affinity Group drop-down menu. A10 recommends selecting East US.
7. To complete the form, click Create a Virtual Machine.
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 10
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
FIGURE 3 Creating a VM on the Preview Portal
NOTE: The username and password set in the form above for the VM admin credentials are not the same as the credentials used to log into the VM in the CLI when you SSH into the instance. You will still have to use the default vThunder credentials:
Username: admin / Password: a10
This release doe not support the creation of multiple users for a single VM in Azure. NOTE:
page 11 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
8. To see the status of the VM, the user has two options.
• Navigate to the Notifications icon on the left task bar, and view a summary of all status updates.
• Go to the homepage of the Preview Portal and click on the icon titled Azure Portal to return back to the Management Portal. A new virtual machine will appear in the list of VMs, as shown below. The status column shows the VM is in the process of Starting (Provisioning).
FIGURE 4 Accessing the Management Portal from the Preview Portal
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 12
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
FIGURE 5 Viewing VM Status within the Management Portal
9. Wait until the Status column for the VM has changed to “Running”. When the status has changed to “Running”, you can establish a PuTTY session with the virtual machine.
page 13 | Document No.: VT-AZURE-003 - Jul 11, 2016
FIGURE 6 Find your SSH Details to be used for a PuTTY session vThunder for Azure—Installation Guide
Configuring vThunder for Azure
10. From the left-most pane in the management portal, select Compute and click the name of the virtual machine you just created.
11. Click Dashboard and scroll down to the SSH Details, as shown in
. You should see the name of the cloud service and the port. This is the information you will need to enter when establishing a PuTTY connection to the new vThunder virtual machine.
12. Launch a PuTTY session.
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 14
vThunder for Azure—Installation Guide
Configuring vThunder for Azure
FIGURE 7 Using PuTTY to establish SSH session
13. In the Host Name field, enter the path and port that appears in the SSH Details field in the Dashboard (similar to what
). In our example, the port number is 62356, but this will vary for each vThunder instance you create.
14. For the connection type, select the SSH radio button.
15. Click Open to establish an SSH connection with the new vThunder virtual machine.
NOTE: When using SSH to establish a CLI session with vThunder, the idle timeout value is set to
10 minutes. You will be logged out of your SSH session after 10 minutes of inactivity and will have to re-establish the connection to the vThunder instance.
page 15 | Document No.: VT-AZURE-003 - Jul 11, 2016
FIGURE 8 CLI session with new vThunder virtual machine vThunder for Azure—Installation Guide
Accessing vThunder with CLI or GUI
16. Log into the vThunder instance using the default credentials:
• Username: “admin”
• Password: “a10”
Accessing vThunder with CLI or GUI
To access the vThunder instance:
• Using the CLI – establish a PuTTY session using the SSH Details shown in
• Using the GUI – launch a Web browser and enter the following URL https://public IP: 8443
The public IP portion of this URL can be obtained by looking up the public VIP address, as shown under the “Public Virtual IP (VIP) Address” section of the Dashboard for this new vThunder instance. (See
.)
When accessing the Web GUI, the default value is port 80. In single-IP environments, such as Azure, you should specify port 8080 for HTTP or 8443 for HTTPS, as discussed below in
“Configuring vThunder for Web GUI Access in Single-IP
.
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 16
vThunder for Azure—Installation Guide
Accessing vThunder with CLI or GUI
Configuring vThunder for Web GUI Access in Single-IP Environments
Accessing the vThunder GUI in a single-IP environment, such as Azure’s cloud, requires some additional configuration of the network settings.
In ordinary environments where you are not limited to a single IP address, you could assign two or more separate IP addresses to the vThunder device to separate different types of traffic. One IP could be used for VIP traffic, and the other IP could be used for traffic to the Web GUI.
However, when deployed in the Azure cloud, vThunder can only support one IP interface. Therefore, you must configure the vThunder to use the primary interface IP to handle all different types of traffic (i.e., network traffic, management traffic, and
Web GUI traffic). Instead of routing traffic using separate IP addresses, the traffic can be sent to the proper destination by configure separate virtual ports.
Use the CLI commands below to configure the vThunder instance to use one port (such as port 80) for both VIP traffic and management traffic. You must configure a different virtual port to handle the Web-based GUI traffic (port 8080 for HTTP and port 8443 for HTTPS). web-service port 8080 web-service secure-port 8443
NOTE: It is crucial that the vThunder VIP uses a different port than the GUI interface. If the same port is used for both types of traffic, a port conflict will occur, and this could result in dropped packets.
Endpoint mapping
To access the Web GUI for configured VM images, it is essential that the user configure endpoint mapping in the Azure management portal. The public IP address for the Web GUI will NOT work unless this is set up per the procedure below.
To configure endpoint mapping:
1. In the Management Portal, go to Virtual Machines.
2. Click on the configured VM and select Endpoints.
3. Specify name as HTTPS, protocol as TCP, public and private port as 8443.
4. The private port number is the same number assigned in the CLI as the secure-port. The public port will be used when migrating to HTTP.
page 17 | Document No.: VT-AZURE-003 - Jul 11, 2016
FIGURE 9 Editing Endpoint Mapping within the Azure Management Portal vThunder for Azure—Installation Guide
Initial vThunder Configuration
Initial vThunder Configuration
This section describes how to configure IP connectivity on the vThunder management and data interfaces.
NOTE: To display a list of commands for a level of the CLI, enter a question mark ( ? ) and press
Enter. You can display the list separately for each level.
For syntax help, enter a command or keyword followed by a “space”, then enter ? then press Enter. This works for commands with sub-commands also.
Login via CLI
1. Log into vThunder with the default username admin and the key-pair associated with this instance.
2. Enable the Privileged EXEC level by typing enable and pressing the Enter key. There is no default password for
Privileged EXEC mode; just press Enter. vThunder>enable
Password:
(just press Enter on a new system)
vThunder#
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 18
vThunder for Azure—Installation Guide
Initial vThunder Configuration
3. Enable the configuration mode by typing config and pressing Enter.
vThunder#
config
vThunder(config)#
It is strongly suggested that a Privileged EXEC enable password be set up as follows: vThunder(config)#enable-password newpassword
Change the Admin Password
A10 Networks recommends that you change the admin password immediately for security. vThunder(config)#admin admin password newpassword vThunder(config-admin:admin)#
The vThunder is now network accessible for configuration under the new IP address and admin password.
Save the Configuration Changes – write memory
Configuration changes must be saved to system memory to take effect the next time the vThunder is powered on. Otherwise, the changes are lost if the vThunder virtual machine or its host machine are powered down.
To write the current configuration to system memory: vThunder(config)#write memory
Building configuration...
[OK]
Additional Resources – Where to go from here?
After you have logged into the vThunder GUI or CLI, you may be in need of some assistance to configure the device. More information can be found in the latest ACOS Release Notes. This document has a list of new features, known issues, and other information to help get you started.
It is also highly recommended to use the basic deployment instructions that appear in the System Configuration and Adminis-
tration Guide.
page 19 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Initial vThunder Configuration
Configuring DHCP and the VIP in vThunder
Configuring DHCP
1. SSH to the IP address of the vThunder instance.
2. Use the following CLI commands to force the interface to use the IP assigned by DHCP.
The following commands are required, and if not entered properly, other SLB-related commands may fail. interface ethernet 1
NOTE: Do not use the “no ip address dhcp” command or you will lose your SSH connection to vThunder. The workaround for a lost connection is to restart the vThunder instance.
3. Use the following commands to configure the vThunder instance to use the IP assigned by DHCP as the VIP: slb virtual-server v1 use-if-ip ethernet 1
port 80 tcp
service-group http-sg1
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 20
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
License Installation for BYOL Licenses
The maximum throughput of vThunder for Azure instance is variable and depends on which bandwidth you selected upon first launching the vThunder instance.
If you do not mind being charged the licensing fees on an hourly basis, you can simply select one of the available band-
tional effort to procure a vThunder license from A10 Networks. If you prefer this hourly billing route, then feel free to skip this section about buying and installing a permanent license.
However, if you would prefer to own the license outright, rather than being charged licensing fees on an hourly basis, then you must buy a permanent license (also referred to as a BYOL, or “Bring Your Own License”) from A10 Networks.
Purchasing the License
To purchase a vThunder license, please contact [email protected]
.
Upon purchasing the vThunder permanent license, the following events will happen:
1. The A10 sales representative will create a Global License Manager (GLM) account for you.
2. You will receive an auto-generated email from A10 containing the following:
• Instructions for downloading the software from the GLM server (ignore for AWS or Azure cloud environments).
• A unique License Entitlement Token which you will need to use to activate your vThunder license.
• Brief instructions for obtaining the UID (or “host ID”) from your vThunder instance, which you will need to activate your vThunder license. Full instructions appear here:
“Obtaining the Host ID/UID” on page 22
• An “activation link” which will take you to the GLM server.
3. Click the activation link that appears in the email. It should say something similar to “Click here to activate an appliance.”
4. Log into the GLM server using the credentials provided to you by the sales team when they set up your account.
5. Enter the Host ID and License Entitlement Token that were sent to you in the email mentioned above.
6. You will receive another automated email containing the activation key. Copy this activation key and paste it into the
vThunder GUI, as described here: “Entering the License” on page 23 .
7. Your vThunder instance should now be fully licensed and capable of running live traffic.
page 21 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
Obtaining the Host ID/UID
You can obtain the UID (also referred to as the “Host ID”) from the GUI or CLI.
From the GUI
1. From the ACOS GUI, navigate as follows:
• If you are running ACOS 2.7.x release: a. Select Config Mode > System > Maintenance > License. b. The Host ID field appears near the top o f the page. c. Copy the entire Host ID. (This is a hexadecimal string found near the Host ID field.) d. Paste the Host ID in the blank field of the GLM server, as described above in step 5 on page 21.
• If you are running ACOS 4.x release: a. Select System > Maintenance > Licenses. b. Click the Upgrade button. c. The Host ID field appears near the bottom o f the page, below the definition field. d. Copy the entire Host ID. (This is a hexadecimal string found in the Host ID field.) e. Paste the Host ID in the blank field of the GLM server, as described above in step 5 on page 21.
From the CLI
To obtain the Host ID/UID from the CLI:
1. Establish a connection to the ACOS device through the management interface.
2. Access the Privileged EXEC (enable) level or any configuration level of the CLI.
3. Enter the following command:
show license uid
4. Copy the entire UID, which is the hexadecimal string displayed by the CLI.
5. Paste the Host ID/UID in the blank field of the GLM server, as described above in step 5 on page 21.
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 22
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
Entering the License
Once you have obtained the license (or “activation key”), you can enter it from the ACOS GUI or CLI.
From the GUI
To enter the license from the ACOS GUI:
1. Establish a connection to the ACOS device through the management interface.
2. Navigate as follows:
• If you are running ACOS 2.7.x release: a. Config Mode > System > Maintenance > License. b. Click Install to expand the field. c. Paste the activation key that you copied during step 6 on page 21 into the License field. d. Click Update.
• If you are running ACOS 4.0.x release: a. System > Maintenance > Licenses. b. Click Upgrade. c. Paste the activation key that you copied during step 6 on page 21 into the Definition field. d. Click the Upgrade button.
From the CLI
To enter the license (or “activation key”) from the ACOS CLI:
1. Access the Privileged EXEC (enable) level or any configuration level of the CLI.
2. Paste the activation key into a file and save it on a server that can be locally accessed over the network by the vThunder.
3. Enter the following command to install the license:
import
license
file-name url
The file-name is the name of the file in which you saved the license. The url specifies the file transfer protocol, username
(if required), and directory path.
You can enter the entire URL on the command line or press Enter to display a prompt for each part of the URL. If you enter the entire URL and a password is required, you will still be prompted for the password. To enter the entire URL:
• tftp://host/file
• ftp://[user@]host[:port]/file
• scp://[user@]host/file
• sftp://[user@]host/file
page 23 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
4. Enter the following command to verify license installation:
show
license
CLI Example
The following commands log onto the CLI, access the Privileged EXEC level, and display the license host ID: login as: admin
Using keyboard-interactive authentication.
Password:***
Last login: Mon Aug 2 07:58:10 2010
[type ? for help] vThunder>enable
Password:******** <blank by default> vThunder#show license uid
5172DE29D49EE3C101C7A0CD54FB8A0B6EC92CEE
The following command installs the license: vThunder#import license softax-lic1.txt tftp://192.168.1.101/licenses/softax-lic1.txt
The following command verifies license installation: vThunder#show license
Feature Installed: bandwidth
: 200 Mbps
Version: 1.01
Exp date: permanent
Host ID: 5172DG29E49EE3C102C7A0CD54FB8A0B6EC92CEE
• If you are running ACOS 4.1.x release: a. Access the Privileged EXEC (enable) level or any configuration level of the CLI.
b. Save the activation key license file sent by A10 Networks onto a server that can be locally accessed over the network by your appliance.
c. Enter the following command to install the license:
import glm-license file-name url
The file-name is the name of the activation key license file received from A10 Networks. The url specifies the file transfer protocol, username (if required), and directory path.
You can enter the entire URL on the command line or press Enter to display a prompt for each part of the URL. If you enter the entire URL and a password is required, you will still be prompted for the password. To enter the entire URL:
• tftp://host/file
• ftp://[user@]host[:port]/file
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 24
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
• scp://[user@]host/file
• sftp://[user@]host/file d. Close your CLI session.
e. Open a new CLI session.
f.
Access the Privileged EXEC (enable) level or any configuration level of the CLI.
g. Enter the following command to verify the activation key license installation: show license-info
CLI Example
The following commands log onto the CLI, access the Privileged EXEC level, and display the license host ID: login as: admin
Using keyboard-interactive authentication.
Password:
Last login: Mon Feb 1 21:23:14 2016 from 172.17.2.158
ACOS system is ready now.
[type ? for help] vThunder>enable
Password: vThunder#show license uid
A0C774C33831F0A5FB9961EA5EDCF31330FB91A6
The following command installs the license: vThunder#import glm-license license_example.lic use-mgmt-port scp://[email protected]/home/user/license_example.lic
Close the existing CLI session and open a new CLI session. The following enhanced command verifies license installation and lists the set of licenses and information about them: vThunder(config)#show license-info
Host ID : 5BBB01EX264EXAMPLECB3C2FE42E02384EE8C527
USB ID : Not Available
Product : CFW
Platform : Thunder Series Unified Application Service Gateway
GLM Ping Interval In Hours : 24
------------------------------------------------------------------------------------
Enabled Licenses Expiry Date Notes
------------------------------------------------------------------------------------
SLB None
page 25 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
License Installation for BYOL Licenses
CGN None
GSLB None
RC None
DAF None
WAF None
SSLI None
DCFW None
GIFW None
URLF None
IPSEC None
AAM None
FP None
WEBROOT None Requires an additional Webroot license.
THREATSTOP None Requires an additional ThreatSTOP license.
More About the Global License Manager (GLM)
The Global License Manager (GLM) is the master licensing and billing system for A10 Networks’ appliances. The GLM is managed by A10 Networks and is the primary portal for customers to begin activation of purchased appliances, create trial licenses, manage existing assets, track license status, request Return Merchandise Authorizations (RMA), and access installation resources.
For information about using the GLM to get a license, please see the
Global Licensing Manager User Guide
. You can request a PDF of this document after you have created a GLM account, by clicking this URL: https://glm.a10networks.com/
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 26
vThunder for Azure—Installation Guide
Deploying Global Server Load Balancing (GSLB) in Azure
Deploying Global Server Load Balancing (GSLB) in Azure
Due to specific characteristics of the Azure environment, vThunder for Azure does not support High-Availability (HA). However, using four vThunder instances, users can “simulate” HA through dividing appliances into Global Server Load Balancing
(GSLB) controller and device “components.”
In this example, two instances, a10kkvth1 and a10kkvth2, are the GSLB controller components that forward client traffic to the a10testing.com domain. The user designates the DNS zone, “a10testing.com,” and adds the VIP addresses for the other two instances (a10kkvth3 and a10kkvth4) to be defined as GSLB devices. The GSLB instances only use SLB protocols for specifying the forwarding path to the two SLB devices.
For the GSLB device components, the user defines SLB configuration on the GSLB device instances to distribute client access traffic to the appropriate Web server. These characteristics include virtual IP address, service group, server, NAT pool, persistence.
FIGURE 10 GSLB Topology within Microsoft Azure
Using the CLI
To configure the vThunder appliances and set up the GSLB components:
1. Log onto Azure account, and provision four separate vThunder instances by purchasing four separate transactions on
Azure Marketplace. All VMs should be assigned to the same group number and cloud service.
page 27 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Deploying Global Server Load Balancing (GSLB) in Azure
2. Upon obtaining the SSH credentials of the vThunder appliance, log onto the device through launching an SSH Connection.
3. Follow the steps highlighted earlier to enable the device and enter Privileged EXEC mode.
Setting up the GSLB Controller
To begin setup, the user will need to first configure the GSLB controller instance with an ethernet hostname and two service
IPs. This example takes the GSLB controller with hostname ‘vth1’ and defines the GSLB path. Note that this configuration will also have to be used for the second controller instance, which, in this example, is hostname ‘vth2.’
1. Configure single IP and DHCP connection, as described in the prior section. This is common to every instance deployed on Azure.
hostname vth1 interface ethernet 1
enable
ip address dhcp ip nat pool nat1 use-if-ip ethernet 1
2. Set the health monitor to method PING to identify the GSLB device’s health monitor using ICMP.
health monitor PING
method icmp
3. Configure the virtual server and bind this to the initial IP set up in the first step. Enable GSLB protocol on this server.
slb virtual-server vip use-if-ip ethernet 1
port 53 udp
gslb-enable
4. Map the path of GSLB to the device instances. In this example, these are identified as instances ‘vth3’ and ‘vth4.’ The user will have to bind the health monitors configured earlier to this path.
terminal idle-timeout 0 gslb system auto-map module slb-server gslb service-ip vth3 10.0.1.6
health-check PING
health-check-protocol-disable
port 80 tcp
health-check-protocol-disable gslb service-ip vth4 10.0.1.7
health-check PING
health-check-protocol-disable
port 80 tcp
health-check-protocol-disable
5. Set the geo-location of the GSLB controller. This represents the physical location of its datacenter.
gslb geo-location Tokyo
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 28
vThunder for Azure—Installation Guide
Deploying Global Server Load Balancing (GSLB) in Azure gslb site site1
slb-dev vThunder3 10.0.1.6
admin-preference 200
vip-server vth3
slb-dev vThunder4 10.0.1.7
admin-preference 110
vip-server vth4
6. Define a GSLB policy that designates DNS protocol for logging purposes. gslb policy test1
admin-preference
dns action
no dns cname-detect
dns logging both
dns server any authoritative
geo-location Tokyo
7. Designate the GSLB zone as desired URL for the DNS zone. In this example, the DNS zone is at URL ‘a10testing.com.’ gslb zone a10testing.com
policy test1
service 80 www
dns-a-record vth3 static
dns-a-record vth4 static gslb protocol enable controller gslb protocol enable device
Setting up the GSLB Device
After initial setup of the controller instance, the user needs to set up the GSLB device. Note that this device will carry SLB-specific configuration and will be the same configuration required for the second device instance (in this example, this is device
‘vth4’).
1. In this example, the GSLB device is name ‘vth3.’ Begin with the standard IP configuration for all Azure instances.
hostname vth3 interface ethernet 1
enable
ip address dhcp ip nat pool nat1 use-if-ip ethernet 1
2. Set up the ICMP health monitor to interact with the GSLB controller.
health monitor ICMP
up-retry 3
interval 15
method icmp
page 29 | Document No.: VT-AZURE-003 - Jul 11, 2016
vThunder for Azure—Installation Guide
Deploying Global Server Load Balancing (GSLB) in Azure health monitor PING
retry 5
up-retry 3
interval 15
3. Configure the SLB commands required for coordinating the web service-- virtual and physical servers, service groups, and respective IPs and ports.
slb server ws1 10.0.1.8
health-check ICMP
port 80 tcp slb server ws2 10.0.1.9
health-check ICMP
port 80 tcp slb service-group http tcp
member ws1 80
member ws2 80 slb virtual-server vs1 use-if-ip ethernet 1
port 80 http
source-nat pool nat1
service-group http
4. Enable GSLB protocol to complete the communication path between the GSLB controller and devices.
terminal idle-timeout 0 gslb protocol enable device
Document No.: VT-AZURE-003 - Jul 11, 2016 | page 30
vThunder for Azure—Installation Guide
page 31 | Document No.: VT-AZURE-003 - Jul 11, 2016
3
Document No.: VT-AZURE-003 | Jul 11, 2016
دانلود
پیوند عمومی به روز شد
پیوند عمومی به چت شما به روز شده است. You may view and manage your chat links after registration here.
پیوند عمومی سند
تبلیغات
