diff --git a/docs/_deploy_vmware_hub_router_network_design.md b/docs/_deploy_vmware_hub_router_network_design.md new file mode 100644 index 00000000000..351f9107859 --- /dev/null +++ b/docs/_deploy_vmware_hub_router_network_design.md @@ -0,0 +1,23 @@ + + +The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network. + +| Parameter | Example Value | Description | +|-----------|--------------|-------------| +| Authority Name | `Authority128` | Organizational authority name | +| Conductor Name | `Conductor` | Pre-existing conductor system name | +| Conductor IP Address | `192.168.100.10` | Conductor IP — must be reachable from the router WAN | +| Router Name | `Hub1` | VMware router system name | +| Router Node Name | `node0` | Router node name | +| Router Asset ID | `Hub1` | Asset ID reported after initialization; see [Step 2](deploy_vmware_router_install.mdx#asset-id) | +| WAN Device Interface | `wan-dev` | WAN device interface name | +| WAN Network Interface | `wan1` | WAN network interface name | +| WAN PCI Address | _(discovered in [Step 3](deploy_vmware_router_pci.mdx))_ | VMXNet3 WAN NIC PCI address | +| LAN Device Interface | `lan-dev` | LAN device interface name | +| LAN Network Interface | `lan1` | LAN network interface name | +| LAN PCI Address | _(discovered in [Step 3](deploy_vmware_router_pci.mdx))_ | VMXNet3 LAN NIC PCI address | +| Router LAN IP Address | `192.168.1.1/24` | LAN gateway address | +| Tenant Name | `corp` | LAN-side user tenant | +| Service Name | `Internet-Traffic` | Internet breakout service | +| Service Address | `0.0.0.0/0` | All internet-bound traffic | +| Neighborhood | `internet` | SVR neighborhood name | diff --git a/docs/_vmware_router_find_pci.md b/docs/_vmware_router_find_pci.md index 0ba85e3f0ef..e6965443817 100644 --- a/docs/_vmware_router_find_pci.md +++ b/docs/_vmware_router_find_pci.md @@ -22,5 +22,5 @@ The SSR router configuration requires the PCI address of each VMXNet3 NIC. Becau | LAN (`lan-dev`) | `ge-0-1` _(example)_ | `0000:13:00.0` _(example)_ | :::important - These are example values. Your actual PCI addresses will differ. Use the values you discover here in [Step 4 — Configure the Router on the Conductor](deploy_vmware_router_config.mdx). + These are example values. Your device names and PCI addresses will differ. Use the values you discover here when you configure the router on the conductor. ::: \ No newline at end of file diff --git a/docs/_vmware_router_vm_create_hub.md b/docs/_vmware_router_vm_create_hub.md new file mode 100644 index 00000000000..16d77809c81 --- /dev/null +++ b/docs/_vmware_router_vm_create_hub.md @@ -0,0 +1,132 @@ + + +## Log In to VMware ESXi + +Open a web browser and navigate to your ESXi host. Log in with administrative credentials. + + ![VMware ESXi Login](/img/vmware_login.png) + +## Upload the SSR ISO to the Datastore + +1. From the ESXi Navigator, select **Storage**. + + ![Storage](/img/dep-vmware-router-uploadssr1.png) + +2. Click the **Datastore Browser** button. + + ![Datastore Browser](/img/dep-vmware-router-uploadssr2.png) + +3. Click **Upload**, navigate to the SSR 7.1.4-3r2 ISO on your local workstation, and click **Open**. The ISO appears in the datastore. + + ![Upload SSR Software](/img/dep-vmware-router-uploadssr3.png) + +4. Click **Close**. + +## Create the Virtual Machine + +1. From the VMWare Navigator window, click on **Create/Register VM**. + + ![Create VM](/img/dep1-vm-create-vm.png) + +2. In the **Select creation type** window click **Create a new virtual machine** and then click **Next**. + + ![VM Type](/img/dep2-vm-creation-type.png) + +### Name and Guest OS + +Use the steps below to configure the following: + + | Field | Value | + |-------|-------| + | Name | A descriptive name, for example `Hub1` | + | Compatibility | `ESXi 7.0 U2 virtual machine` | + | Guest OS family | `Linux` | + | Guest OS version | Select the highest available Oracle Linux (64-bit) version | + +3. Name the Virtual Machine **Hub1**. + +4. Select **Linux** from the Guest OS family dropdown selection. + +5. Select the highest available Oracle Linux (64-bit) Guest OS version. Click **Next**. + + ![Name the VM](/img/dep3-vmrouter-hub-name-os.png) + +### Storage + +6. From the Storage screen, select **datastore1** and click **Next**. + + ![VM Storage](/img/dep4-vm-storage.png) + +### Virtual Hardware + +7. On the **Customize settings** screen, click **Virtual Hardware** and configure the following settings. + + These values meet the minimum router requirements: + + | Setting | Value | Notes | + |---------|-------|-------| + | CPUs | `4` | Minimum | + | Hardware virtualization | Select (checkbox) **Expose hardware assisited virtualization to the guest OS** | Set under CPU → expand | + | Memory | `8 GB` | Minimum | + | Hard Disk 1 | `62 GB` | Minimum | + | SCSI Controller 0 | `VMware Paravirtual` | | + + ![Storage Parameters](/img/dep5-vmrouter-params.png) + +### Boot Settings + +8. Click the **VM Options** tab. + + ![VM Options](/img/vmware_vmoptions1.png) + +9. Expand **Boot Options**. + +10. In the Firmware field, choose **BIOS** from the drop down. + + ![Boot Options](/img/vmware_router_vmoptions2.png) + +11. Click **Next**. + +### Network Adapters + +A VMware router requires at least two VMXNet3 network adapters: one for WAN and one for LAN. By default, one adapter is already in place. For the Hub router, we will create three additional network adapters, which will allow it to connect to multiple branch/spoke routers. + + ![Network Adapter Type](/img/dep6-vmrouter-hub-4nics.png) + +12. Set the existing adapter's **Adapter Type** to **VMXNET3** and select the appropriate **portgroup** name for the virtual network that will provide access to your WAN. + +13. Click **Add network adapter** to add a second adapter. Set its **Adapter Type** to **VMXNET3** and select the appropriate **portgroup** name for the virtual network that will provide access to your LAN. + + Repeat this step two more times to create a total of four network interfaces. + + :::note + If you need help creating portgroups and connecting them to your appropriate infrastructure, please consult your VMWare documentation. + ::: + + ![Add Network Adapter](/img/dep6-vmrouter-nics2.png) + + :::note + The order of the adapters (NIC 1 = WAN, NIC 2 = LAN) corresponds to the PCI addresses you will identify in [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx). + + Need to add information here for the other two NICs + ::: + +### CD/DVD Media - Software Selection + +14. Expand **CD/DVD Drive 1**. + + ![CD Drive 1](/img/dep-vmrouter-hub-image-select.png) + +15. Place a check next to **Connect at power on**. In the dropdown to the right, select **Datastore ISO file** and then click **Browse**. The Datastore Browser opens. + +16. Select the `SSR-7.1.4-3.r2.el9.x86_64.ibu-v1.iso` and click **Select**. + + ![CD ISO Selected](/img/dep7-vm-selectversion.png) + +17. Confirm the settings, and then click **Next**. + + ![Confirm Settings](/img/dep8-vm-hub-all-settings.png) + +18. Review the summary, then click **Finish**. + + ![VM Complete](/img/dep9-vmrouter-hub-summary.png) diff --git a/docs/deploy_appendix_vmware_hub_router.mdx b/docs/deploy_appendix_vmware_hub_router.mdx new file mode 100644 index 00000000000..be5f665458b --- /dev/null +++ b/docs/deploy_appendix_vmware_hub_router.mdx @@ -0,0 +1,216 @@ +--- +title: "Appendix: VMware Router Configuration" +sidebar_label: "Appendix: VMware Router Configuration" +--- +import NetworkDesign from './_deploy_vmware_router_network_design.md'; + +This appendix contains the complete SSR PCLI configuration for the `Spoke1` VMware router described in this guide. This configuration reflects the final state after completing all steps through [Step 4 — Configure the Router on the Conductor](deploy_vmware_router_config.mdx). + +:::important +This appendix uses **example** PCI addresses (`0000:0b:00.0` for WAN, `0000:13:00.0` for LAN). Replace these with the actual values discovered in [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx). +::: + +## Network Design Reference + + + +## Applying This Configuration + +This configuration can be applied to the conductor using the PCLI import function. + +1. Save the router configuration block below to a file — for example, `vmware-router-Spoke1.cfg`. + +2. Copy the file to the conductor: + + ```bash + scp vmware-router-Spoke1.cfg admin@192.168.100.10:/tmp/ + ``` + +3. Log in to the conductor PCLI: + + ```bash + ssh admin@192.168.100.10 + ``` + +4. Enter configuration mode and import: + + ```text + admin@node0.conductor1# import config /tmp/vmware-router-Spoke1.cfg + ``` + +5. Review any validation warnings, then commit: + + ```text + admin@node0.conductor1 (config)# commit + Are you sure you want to commit the candidate config? [y/N]: y + ``` + +Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode. + +:::note +The authority-level objects this router depends on (`Internet-Traffic` service, `corp` tenant, and conductor address) must already exist in the running configuration. For the complete authority-level configuration, see [Appendix — VMWare Conductor Configuration](deploy_appendix_vmware_conductor.mdx). +::: + +## Router Configuration + +![Spoke1 Config diagram](/img/dep-vmware-router-spoke1only.png) + +The following block shows the `Spoke1` router configuration as it appears within the authority configuration. + +``` +config + + authority + conductor-address 10.0.0.63 + + + + router Conductor + name Conductor + location-coordinates +38.7127105-077.0060152/ + + node node0 + name node0 + asset-id Conductor + platform-type "440BX Desktop Reference Platform" + exit + exit + + router hub1 + name hub1 + location-coordinates +40.741895-073.989308/ + inter-node-security internal + + node node0 + name node0 + asset-id Hub1 + role combo + platform-type "440BX Desktop Reference Platform" + + device-interface wan-dev + name wan-dev + pci-address 0000:0b:00.0 + + network-interface wan1 + name wan1 + global-id 3 + conductor true + default-route true + + neighborhood internet + name internet + topology hub + exit + inter-router-security internal + source-nat true + management true + + management-vector + name mgmt-vec-wan + priority 100 + exit + + address 10.0.128.128 + ip-address 10.0.128.128 + prefix-length 16 + gateway 10.0.0.127 + + host-service web + service-type web + exit + exit + dhcp disabled + exit + exit + + device-interface lan + name lan + pci-address 0000:13:00.0 + + network-interface lan + name lan + global-id 4 + tenant corp + source-nat true + + address 192.168.2.1 + ip-address 192.168.2.1 + prefix-length 24 + + host-service dhcp-server + service-type dhcp-server + + address-pool 192.168.2.2 + start-address 192.168.2.2 + end-address 192.168.2.20 + router 192.168.2.1 + domain-server 8.8.8.8 + exit + exit + exit + dhcp disabled + exit + exit + exit + + service-route internet-route + name internet-route + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + gateway-ip 10.0.0.1 + exit + exit + exit + + tenant corp + name corp + exit + + + + software-access + username (removed) + token (removed) + exit + + service internet + name internet + security internal + exit + + service Internet-Traffic + name Internet-Traffic + address 0.0.0.0/0 + + access-policy corp + source corp + exit + exit + exit +exit + +``` + +## Interface Summary + +| Interface | Device Interface | PCI Address | Type | Configuration | +|-----------|-----------------|-------------|------|---------------| +| `wan1` | `wan-dev` | `0000:0b:00.0` _(example)_ | External | DHCP, conductor, default-route, source-nat, management, neighborhood `internet` | +| `lan1` | `lan-dev` | `0000:13:00.0` _(example)_ | External | tenant `corp`, static `192.168.1.1/24` | + +## Service Route Summary + +| Service Route | Service | Type | Next Hop | +|--------------|---------|------|---------| +| `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` | + +## Design Notes + +**Management over Forwarding** — The `wan1` interface carries both internet traffic and conductor management sessions simultaneously. Management traffic from the `169.254.x.x` range is source-NAT'd to the WAN DHCP address before leaving the interface. This eliminates the need for a separate out-of-band management network at the branch site. + +**Internet Breakout** — The `internet-route` service route directs all `corp`-tenant traffic matching the `Internet-Traffic` service (destination `0.0.0.0/0`) out through `wan1` as a service-agent. The source NAT setting on `wan1` ensures LAN client traffic is translated to the WAN IP before it reaches the ISP. + +**PCI Address Binding** — VMware assigns PCI addresses based on the VM's hardware slot configuration. The example addresses in this appendix (`0000:0b:00.0`, `0000:13:00.0`) are illustrative only. Always use the values discovered by following [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx). diff --git a/docs/deploy_appendix_vmware_router.mdx b/docs/deploy_appendix_vmware_router.mdx index f60b4d5352d..c1e8d320c41 100644 --- a/docs/deploy_appendix_vmware_router.mdx +++ b/docs/deploy_appendix_vmware_router.mdx @@ -1,6 +1,6 @@ --- title: "Appendix: VMware Router Configuration" -sidebar_label: "Appendix: VMware Router Config" +sidebar_label: "Appendix: VMware Router Configuration" --- import NetworkDesign from './_deploy_vmware_router_network_design.md'; @@ -78,7 +78,7 @@ config router spoke1 name spoke1 - location-coordinates +40.741895-073.989308/ + location-coordinates +34.7127281-118.0060152/ inter-node-security internal node node0 diff --git a/docs/deploy_guides_overview.md b/docs/deploy_guides_overview.md index 3c94da380d6..d5ef53b2570 100644 --- a/docs/deploy_guides_overview.md +++ b/docs/deploy_guides_overview.md @@ -5,8 +5,8 @@ sidebar_label: Overview Conductor and Router Deployment Guides are provided to help walk a network engineer through the steps required to stand up a conductor-managed SSR network. -Conductor deployments currently include VMware ESXi. In this guide the conductor will have a configuration ready for a branch router to onboard and come online, managed by the conductor, forwarding internet traffic for LAN users, and reachable by the conductor over the same WAN interface used for internet breakout. +Conductor deployment guides currently include VMware ESXi. In this guide, we explain how to install and configure a conductor to be ready for a branch router to onboard and come online, managed by the conductor, forwarding internet traffic for LAN users, and reachable by the conductor over the same WAN interface used for internet breakout. -Router deployments are currently under development. +Router deployment guides include VMWare ESXi spoke and hub configurations. By the end of the guide, the VMware router VM will be running SSR 7.1.4-3.r2, managed by an existing SSR conductor, and forwarding internet traffic from LAN users with management traffic returning to the conductor over the same WAN interface used for internet breakout. The deployment guides are intended to be used independently of one another, allowing you to mix and match conductor and router platforms. \ No newline at end of file diff --git a/docs/deploy_vmware_hub_router_config.mdx b/docs/deploy_vmware_hub_router_config.mdx new file mode 100644 index 00000000000..e221c1bd804 --- /dev/null +++ b/docs/deploy_vmware_hub_router_config.mdx @@ -0,0 +1,230 @@ +--- +title: "Step 4: Configure the Hub Router on the Conductor" +sidebar_label: "Configure the Hub Router" +--- +import NetworkDesign from './_deploy_vmware_hub_router_network_design.md'; + +With the router VM initialized and connected to the conductor, you can now stage the full router configuration on the conductor. Once you commit the configuration, the conductor pushes it to the router and the router comes fully online. + +All steps are performed from the **Conductor GUI**. Complete all steps before committing. + +:::note +Your conductor must already have the following objects configured before proceeding: + +- **Authority name** — set to your organization's name. +- **Conductor address** — set to `192.168.100.10`. +- **`corp` tenant** — the LAN-side user tenant. +- **`Internet-Traffic` service** — with address `0.0.0.0/0` and access policy permitting `corp`. + +If any of these are missing, complete [Configure the Conductor](deploy_vmware_conductor_config.mdx) first. +::: + +## Network Design Reference + + + +## Complete the Router Configuration on the Conductor + +During the Initialization process for your router, some basic information was provided, including router name (`Hub1`), router location (Los Angeles), node name (`node0`), the inter-node security policy (`internal`), asset-id (`Hub1`), and role (`Combo`). All of this allows the router to connect with the Conductor and onboard successfully. + +This procedure configures network connections for the router. + +:::note +If you prefer to use the CLI to perform configuration tasks, the example configuration is available in the [Appendix](deploy_appendix_vmware_router.mdx). +::: + +1. Open a browser tab on your computer and navigate to your VMWare conductor; `https://192.168.100.10` and initiate a web session to the conductor GUI. + + ![Self signed Certificate warning](/img/dep11-vm-access-gui.png) + +2. Accept the self-signed certificate warning, and login. + +3. In the Conductor GUI, click on Authority. + + ![Conductor Authority](/img/dep-vmrouter-config-authority.png) + +4. Scroll to **Routers** and select the router `Hub1`. +5. Scroll down to **Nodes** and select `node0`. + +## 1. Configure the WAN Interface + +The WAN interface (NIC 1) connects to the ISP, obtains a DHCP address, and carries both internet forwarding and conductor management traffic via [Management over Forwarding](config_management_over_forwarding.md). + +### 1a. Create the WAN Device Interface + +1. Under the Node, scroll to **Device Interfaces** and select **ADD**. + +2. Enter the name `wan-dev` and select **SAVE**. + + :::note + To ensure successful onboarding, the `ge-0-0` interface MUST be configured as the WAN device interface. + ::: + + ![Name the WAN Interface](/img/dep-vmrouter-wandev1.png) + +3. In the Device Interface window, set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | _(WAN PCI address from [Step 3](deploy_vmware_hub_router_pci.mdx))_ | For example, `0000:0b:00.0` | + | Forwarding | `true` | | + + ![Device Interface window](/img/dep-vmrouter-wandev2.png) + +4. Select **SAVE**. + +### 1b. Create the WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. + + ![New Network Interface](/img/dep-vmrouter-wandev3.png) + +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `disabled` | | + | Global-ID | `3` | | + | Conductor | `true` | Marks this interface for conductor connectivity | + | Management | `true` | Enables management over forwarding on this interface | + | Default Route | `true` | Linux uses this interface as its default route | + | Source NAT | `true` | Required for management over forwarding | + + ![WAN Basic Info](/img/dep-vmrouter-wandev4.png) + +4. Scroll down to **Management Vector** and select **ADD**. + - Enter name `mgmt-vec-wan` and priority `100`. + - Select **SAVE**. + + ![Management Vector](/img/dep-vmrouter-wandev5.png) + +5. Scroll down to **Neighborhoods** and select **ADD**. + + ![Neighborhood Name](/img/dep-vmrouter-wandev6.png) + + - Select `internet` as the neighborhood name. + - Verify **Topology** is set to `spoke`. + + ![Topology](/img/dep-vmrouter-wandev7.png) + +6. Select **SAVE**. + +:::important +Conductor must be set to `true` or management traffic will not be able to reach the conductor. + +`Source NAT` and `Default Route` must both be set to `true` on the WAN management interface. Management traffic originates from the `169.254.x.x` range and must be source-NAT'd to a routable address before leaving the interface. The default route ensures Linux routes non-SVR traffic through the SSR forwarding engine. +::: + +## 2. Configure the LAN Interface + +The LAN interface (NIC 2) connects to the branch LAN and assigns the `corp` tenant to traffic arriving from that direction. + +### 2a. Create the LAN Device Interface + +1. From the Authority level in the Conductor GUI, click on `Hub1` to begin configuration. + +2. Click on `node0` and scroll to the bottom of the page. + +3. Select **Device Interfaces**, and **ADD**. + +4. In the New Device Interface window, add the LAN device name `lan`, and click **SAVE**. This adds a physical device name for you to assign your LAN interface. + + ![New LAN](/img/dep-vmrouter-wandev8.png) + +In the Device Interface window, set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | _(LAN PCI address from [Step 3](deploy_vmware_router_pci.mdx))_ | For example, `0000:13:00.0` | + | Forwarding | `true` | | + + ![PCI Fields](/img/dep-vmrouter-wandev8a.png) + +### 2b. Create the LAN Network Interface + +1. Under the LAN Device Interface, scroll to **Network Interfaces** and select **ADD**. + + +![Add LAN1](/img/dep-vmrouter-wandev9.png) + +2. Enter the name `lan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | Global-ID | `4` | | + | DHCP | `disabled` | | + | Tenant | `corp` | Assigns all LAN traffic to the corp tenant | + | Source-NAT | `true` | | + + ![External Corp](/img/dep-vmrouter-wandev10.png) + +4. Scroll down to **Interface Addresses** and select **ADD**. + - IP Address: `192.168.1.1` + - Prefix Length: `24` + +5. Select **SAVE**. + +## 3. Configure DNS + +Configure DNS so the router can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level. +2. Scroll to **DNS Config** and select **ADD**. +3. Set **Mode** to `manual` and enter DNS server addresses — for example, `1.1.1.1` and `8.8.8.8`. +4. Select **SAVE**. + + ![Interface and DNS addresses](/img/dep-vmrouter-wandev11.png) + +## 4. Create the Internet Service Route + +The service route directs traffic matched by the `Internet-Traffic` service out through the WAN interface as a direct internet breakout. + +1. Return to the **Router** level. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-route` and select **SAVE**. + + ![Service Route Name](/img/dep-vmrouter-wandev12.png) + +4. Set the following fields: + + | Field | Value | + |-------|-------| + | Service Name | `Internet-Traffic` | + | Service Route Type | `service-agent` | + + ![Service Route Details](/img/dep-vmrouter-wandev13.png) + +5. Scroll to **Next Hop** and select **ADD**. + - Node: `node0` + - Network Interface: `wan1` + - Select **SAVE**. + + ![New Next Hop](/img/dep-vmrouter-wandev14.png) + +6. Select **VALIDATE** and **COMMIT**. + +## Configuration Summary + +After committing, the conductor pushes the following configuration to `Hub1`. The router applies the configuration and comes fully online within approximately 2–5 minutes. + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `Hub1` | combo node, asset-id `Hub1` | +| WAN Device Interface | `wan-dev` | VMware WAN NIC PCI address, forwarding enabled | +| WAN Network Interface | `wan1` | DHCP, conductor, default-route, source-nat, management, neighborhood `internet` | +| LAN Device Interface | `lan-dev` | VMware LAN NIC PCI address, forwarding enabled | +| LAN Network Interface | `lan1` | tenant `corp`, address `192.168.1.1/24` | +| DNS Config | manual | servers `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-route` | service `Internet-Traffic`, type `service-agent`, next-hop `node0/wan1` | + +## Next Step + +Congratulations! At this point your router is ready for your testing and deployment! + + diff --git a/docs/deploy_vmware_hub_router_install.mdx b/docs/deploy_vmware_hub_router_install.mdx new file mode 100644 index 00000000000..86c2a760863 --- /dev/null +++ b/docs/deploy_vmware_hub_router_install.mdx @@ -0,0 +1,164 @@ +--- +title: "Step 2: Install SSR Software and Initialize the Hub Router" +sidebar_label: "Install and Initialize" +--- + +This step boots the router VM from the SSR ISO, installs the software, and uses the web-based initialization interface to configure the VM as a conductor-managed branch router. + +## Install SSR Software + +1. Select the new router VM in the ESXi Navigator and click the **Play** (Power On) button. + + ![Power On](/img/dep10-vmrouter-hub-start.png) + +2. At the Install menu, use the arrow keys to select **VGA Console**. + + ![Install Type](/img/dep10a-vm-vga.png) + +4. If you require FIPS mode, select Install Option 1 and press **Enter**. If FIPS is not required, press **Enter** without selecting an option. The download and installation begins. + + :::note + IDP is not compatible with systems running in FIPS 140-3 mode, including Common Criteria or JITC deployments. If you plan to enable IDP, do not enable FIPS mode. See [IDP Troubleshooting](ts_idp.md#fips-mode-and-idp) for information on disabling FIPS mode if needed. + + Additionally, please note that FIPS mode disables BGP MD5 authentication. + ::: + + ![Install Options](/img/deploy-vmware-cloud-init-enabled1.png) + +5. The installation runs to completion automatically. This may take approximately 15–20 minutes. + + ![Install Progress](/img/deploy-vmware-cloud-init-enabled2.png) + +6. When prompted to reboot, allow the VM to shutdown. + + ![Install Complete](/img/deploy-vmware-cloud-init-enabled3.png) + +## Apply VLANs to the Hub + +These steps configure VLANs on the router. + +1. In the VM in the ESXi Navigator, start the Hub1 Virtual Machine. + +2. Select **Console** and login using the root credentials. + +3. From the linux prompt run the command `su admin` to enter the SSR CLI. + + - Run `show network-interface | more`. This will display the DHCP IP addresses. + + ![show network interface](/img/dep-vmware-cli-show-ge-0-0.png) + + - Locate the ge-0-x interfaces, and make a note of the IP address. + Example: + ``` + ge-0-0 =00:0c:29:6c:32:c1 + ge-0-1 =00:0c:29:6c:32:a3 + ge-0-2 =00:0c:29:6c:32:cb + ge-0-3 =00:0c:29:6c:32:ad + ``` + +4. From the Hub VM in the ESXi Navigator, select **Actions** and then **Edit Settings**. + + ![Edit VM settings](/img/dep-hub-edit.png) + + In the Hardware Configuration window, expand each network adapter to see the MAC address associated with the Network adapter. + + ![Mac Addresses](/img/dep10-vmrouter-hub-mac-address.png) + +5. Use the diagram below and the interface names for each MAC address, to associate the correct network VLAN with each interface. Use the following VM VLANs: VLAN1 (ge-0-0, the management port), VLAN67 (ge-0-1), VLAN3 (ge-0-2), and VLAN4 (ge-0-3). The Network Adapter, MAC address and ge-0-x interface name(s) should match based on the MAC addresses previously determined. Save when complete. + + ![VLAN Identification](/img/dep-vlan-ident-hub1.png) + +Example: +``` +ge-0-0 =00:0c:29:6c:32:a3 = Adapter 1 (VLAN1) +ge-0-1 =00:0c:29:6c:32:ad = Adapter 2 (VLAN67) +ge-0-2 =00:0c:29:6c:32:b7 = Adapter 3 (VLAN3) +ge-0-3 =00:0c:29:6c:32:c1 = Adapter 4 (VLAN4) +``` + +6. Click **Save**. + +## Initialize the Router + +1. In the VM in the ESXi Navigator, select the Hub1 Virtual Machine, and click **Power On**. + +2. Click **Console** and login using the root credentials. + - Username: `root` + - Password: `128tRoutes` + + The system takes a few minutes to start up. + +3. Run the command `su admin `to enter the PCLI. + + ![Initial Login](/img/dep-vmrouter-hub-init-login.png) + +4. Enter the following command to connect the Hub1 router to the conductor: + + `initialize conductor-managed router-name Hub1 conductor-ip ` + + Wait for the device to show `Device successfully initialized`. This step may take several minutes to complete. + + ![Device Successflly Initialized](/img/dep-vmrouter-hub-init-suadmin.png) + + Let’s go to the Conductor GUI, add this router, and connect it for communication to the Conductor. + +5. Open a browser tab on your computer and navigate to your VMWare conductor; `https://192.168.100.10` and initiate a web session to the conductor GUI. + + ![Self signed Certificate warning](/img/dep11-vm-access-gui.png) + +6. Accept the self-signed certificate warning, and login using the username and the password you set earlier. + +7. In the Conductor GUI, click on Authority. + + ![Conductor Authority](/img/dep-vmrouter-config-authority.png) + +8. At the top of the list of Routers, select ADD. + + ![Add Router](/img/dep-vmrouter-addrouter.png) + +9. Enter the router `Hub1` and click **Save**. + + ![New Router](/img/dep-vmrouter-hub-newrouter.png) + +### Add a Location for the Router + +After adding the router name, let’s add the location of this router. For this example, we'll use New York. + +1. In the Router **Basic Information** screen, enter New York under **Location**. + + ![Basic Info](/img/dep-vmrouter-hub-basicinfo.png) + +2. If you have the location coordinates (for this example, enter the following exactly: `+40.7127281-074.0060152/`), you can enter them. + +3. Under **Inter-node Security Policy**, select `Internal`. + +4. Below the Basic Info screen, click ADD next to Nodes. + +5. The **New Node** dialog is displayed - enter `node0`. + + ![New Node](/img/dep-vmrouter-newnode.png) + +6. Click **Save**. The **Node** screen appears. + +### Set the Asset ID + +The Asset ID allows the hub and conductor to fully connect, and allows the conductor to configure and control the hub router. + +1. On the Node screen, verify the Node Name is `Node0`, set the Associated Asset ID to `Hub1`, and set the Role to `Combo`. + + ![Node Asset ID](/img/dep-vmrouter-hub-node-asset-id.png) + +2. Click **COMMIT**. + + If you see a Review Commit Warning, click **Proceed** and **Commit** . Your router is now bound to the conductor, sharing keys and trust. Connectivity will not be available for roughly 8-10 minutes, until full synchronization between the hub and conductor. When the **Routers** page displays `Synchronized`, the router is ready to be configured from the conductor. + +## Next Step + +Proceed to [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx). + + + + + + + diff --git a/docs/deploy_vmware_hub_router_pci.mdx b/docs/deploy_vmware_hub_router_pci.mdx new file mode 100644 index 00000000000..d9538d8f2ea --- /dev/null +++ b/docs/deploy_vmware_hub_router_pci.mdx @@ -0,0 +1,22 @@ +--- +title: "Step 3: Find VM Hub NIC PCI Addresses" +sidebar_label: "Find Hub NIC PCI Addresses" +--- +import FindPCI from './_vmware_router_find_pci.md'; + +The SSR router configuration binds each logical interface to a specific physical NIC using that NIC's PCI address. VMware assigns PCI addresses dynamically based on the VM's hardware slot configuration, so you must discover the actual values from the running router VM before configuring the device interface bindings on the conductor. + + + +## Record Your PCI Addresses + +Before proceeding to the next step, record the discovered PCI addresses. You will enter these values in [Configure the Hub Router on the Conductor](deploy_vmware_hub_router_config.mdx). + +| Interface | PCI Address | +|-----------|------------| +| WAN (`wan-dev`) | _(your value)_ | +| LAN (`lan-dev`) | _(your value)_ | + +## Next Step + +Proceed to [Configure the Hub Router on the Conductor](deploy_vmware_hub_router_config.mdx). diff --git a/docs/deploy_vmware_hub_router_vm.md b/docs/deploy_vmware_hub_router_vm.md new file mode 100644 index 00000000000..14df2ef0982 --- /dev/null +++ b/docs/deploy_vmware_hub_router_vm.md @@ -0,0 +1,24 @@ +--- +title: "Step 1: Create the Hub VMware Router VM" +sidebar_label: "Create the Hub VMware VM" +--- +import CreateHubVM from './_vmware_router_vm_create_hub.md'; + +This step creates the VMware ESXi virtual machine that will host the SSR hub router. The hub VM will use **four VMXNet3 network adapters**: NICs 1 and 2 connected to the WAN portgroup and NICs 3 and 4 connected to the LAN portgroup. + +## VM Minimum Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| vCPUs | `4` | | +| Scheduling Affinity | `0-3` | Set under CPU → expand | +| Memory | `8 GB` | | +| Disk | `62 GB` | | +| Network Adapters | 4 × VMXNet3 | NICs 1 and 2 = WAN portgroup, NICs 3 and 4 = LAN portgroup | +| Boot Firmware | BIOS | Secure boot disabled | + + + +## Next Step + +Proceed to [Step 2 — Install SSR Software and Initialize the Router](deploy_vmware_router_install.mdx). \ No newline at end of file diff --git a/docs/deploy_vmware_router_overview.mdx b/docs/deploy_vmware_router_overview.mdx index eb7145bfc8f..e322e00aeb6 100644 --- a/docs/deploy_vmware_router_overview.mdx +++ b/docs/deploy_vmware_router_overview.mdx @@ -5,7 +5,7 @@ sidebar_label: Overview import Mermaid from '@theme/Mermaid'; import NetworkDesign from './_deploy_vmware_router_network_design.md'; -This guide walks a network engineer through deploying a **VMware ESXi virtual machine as a conductor-managed SSR branch router**. By the end of the guide, the VMware router VM will be running SSR 7.1.4-3.r2, managed by an existing SSR conductor, and forwarding internet traffic from LAN users with management traffic returning to the conductor over the same WAN interface used for internet breakout. +This guide walks a network engineer through deploying a **VMware ESXi virtual machine as a conductor-managed SSR branch (or spoke) router and a conductor-managed Hub**. By the end of the guide, the VMware router VMs will be running SSR 7.1.4-3.r2, managed by an existing SSR conductor, and forwarding internet traffic from LAN users with management traffic returning to the conductor over the same WAN interface used for internet breakout. :::note This guide assumes a conductor is already installed and running SSR 7.1.4-3.r2. If you have not yet deployed a conductor, complete one of the conductor deployment guides first: @@ -17,17 +17,17 @@ This guide assumes a conductor is already installed and running SSR 7.1.4-3.r2. | Step | Topic | Description | |------|-------|-------------| -| 1 | [Create the VMware VM](deploy_vmware_router_vm.mdx) | Create and configure a VMware ESXi VM to host the branch router | -| 2 | [Install SSR Software and Initialize the Router](deploy_vmware_router_install.mdx) | Boot the ISO, install SSR software, and initialize the VM as a conductor-managed router | -| 3 | [Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx) | Identify the WAN and LAN VMXNet3 NIC PCI addresses required for the router configuration | -| 4 | [Configure the Router on the Conductor](deploy_vmware_router_config.mdx) | Stage the router configuration on the conductor so it can be applied after onboarding | -| — | [Appendix — Router Configuration](deploy_appendix_vmware_router.mdx) | Complete VMware router PCLI configuration example | +| 1 | Create each VMware VM | Create and configure a VMware ESXi VM to host the Hub or Spoke VM.
[Spoke VM](deploy_vmware_router_vm.mdx)
[Hub VM](deploy_vmware_hub_router_vm.md) | +| 2 | Install SSR Software and Initialize the Router | Boot the ISO, install SSR software, and initialize the VM as a conductor-managed router.
[Spoke Install](deploy_vmware_router_install.mdx)
[Hub Install](deploy_vmware_hub_router_install.mdx) | +| 3 | Find VM NIC PCI Addresses | Identify the WAN and LAN VMXNet3 NIC PCI addresses required for the router configuration.
[Spoke Router](deploy_vmware_router_pci.mdx)
[Hub Router](deploy_vmware_hub_router_pci.mdx) | +| 4 | Configure the Router on the Conductor (deploy_vmware_router_config.mdx) | Stage the router configuration on the conductor so it can be applied after onboarding.
[Spoke Router](deploy_vmware_router_pci.mdx)
[Hub Router](deploy_vmware_hub_router_pci.mdx) | +| — | Appendix — Router Configuration | PCLI configuration examples.
[Spoke Configuration](deploy_appendix_vmware_router.mdx)
[Hub Configuration](deploy_appendix_vmware_hub_router.mdx) | ## Network Topology The diagram below shows the logical network this guide builds. -![Spoke1 Config diagram](/img/dep-vmware-router-spoke1only.png) +![Spoke1 Config diagram](/img/dep-vmware-router-hub-spoke.png) ## Roles @@ -35,6 +35,7 @@ The diagram below shows the logical network this guide builds. |--------|------|------| | `Conductor` | VMware ESXi VM | Pre-existing conductor — centralized management and provisioning | | `Spoke1` | VMware ESXi VM (vSSR) | Conductor-managed branch router — internet breakout and LAN services | +| `Hub1` | VMware ESXi VM (vSSR) | Conductor-managed hub router — internet breakout and LAN services | ## Network Design Reference diff --git a/docs/deploy_vmware_router_vm.mdx b/docs/deploy_vmware_router_vm.mdx index 7bf64409c41..f137ed10ca3 100644 --- a/docs/deploy_vmware_router_vm.mdx +++ b/docs/deploy_vmware_router_vm.mdx @@ -1,6 +1,6 @@ --- -title: "Step 1: Create the VMware Router VM" -sidebar_label: "Create the VMware VM" +title: "Step 1: Create the Spoke VMware Router VM" +sidebar_label: "Create the Spoke VMware VM" --- import CreateVM from './_vmware_router_vm_create.md'; diff --git a/sidebars.js b/sidebars.js index c6654447b2c..fd402393772 100644 --- a/sidebars.js +++ b/sidebars.js @@ -31,16 +31,27 @@ module.exports = { "type": "category", "label": "Router Deployment Guides", "items": [ + "deploy_vmware_router_overview", { "type": "category", - "label": "VMware Router", + "label": "VMware Spoke Router", "items": [ - "deploy_vmware_router_overview", "deploy_vmware_router_vm", "deploy_vmware_router_install", "deploy_vmware_router_pci", "deploy_vmware_router_config", "deploy_appendix_vmware_router", + ], + }, + { + "type": "category", + "label": "VMware Hub Router", + "items": [ + "deploy_vmware_hub_router_vm", + "deploy_vmware_hub_router_install", + "deploy_vmware_hub_router_pci", + "deploy_vmware_hub_router_config", + "deploy_appendix_vmware_hub_router", ], }, ], diff --git a/static/img/dep-hub-edit.png b/static/img/dep-hub-edit.png new file mode 100644 index 00000000000..56a617da795 Binary files /dev/null and b/static/img/dep-hub-edit.png differ diff --git a/static/img/dep-vlan-ident-hub1.png b/static/img/dep-vlan-ident-hub1.png new file mode 100644 index 00000000000..7d14c0ab077 Binary files /dev/null and b/static/img/dep-vlan-ident-hub1.png differ diff --git a/static/img/dep-vmrouter-hub-basicinfo.png b/static/img/dep-vmrouter-hub-basicinfo.png new file mode 100644 index 00000000000..d41ef741f23 Binary files /dev/null and b/static/img/dep-vmrouter-hub-basicinfo.png differ diff --git a/static/img/dep-vmrouter-hub-image-select.png b/static/img/dep-vmrouter-hub-image-select.png new file mode 100644 index 00000000000..1be3eb4ea60 Binary files /dev/null and b/static/img/dep-vmrouter-hub-image-select.png differ diff --git a/static/img/dep-vmrouter-hub-init-login.png b/static/img/dep-vmrouter-hub-init-login.png new file mode 100644 index 00000000000..6e45527725c Binary files /dev/null and b/static/img/dep-vmrouter-hub-init-login.png differ diff --git a/static/img/dep-vmrouter-hub-init-suadmin.png b/static/img/dep-vmrouter-hub-init-suadmin.png new file mode 100644 index 00000000000..57768435f6f Binary files /dev/null and b/static/img/dep-vmrouter-hub-init-suadmin.png differ diff --git a/static/img/dep-vmrouter-hub-newrouter.png b/static/img/dep-vmrouter-hub-newrouter.png new file mode 100644 index 00000000000..d94a5728665 Binary files /dev/null and b/static/img/dep-vmrouter-hub-newrouter.png differ diff --git a/static/img/dep-vmrouter-hub-node-asset-id.png b/static/img/dep-vmrouter-hub-node-asset-id.png new file mode 100644 index 00000000000..c1da6e234b3 Binary files /dev/null and b/static/img/dep-vmrouter-hub-node-asset-id.png differ diff --git a/static/img/dep-vmrouter-wandev4.png b/static/img/dep-vmrouter-wandev4.png index 788f8569db2..3f9bf03cec2 100644 Binary files a/static/img/dep-vmrouter-wandev4.png and b/static/img/dep-vmrouter-wandev4.png differ diff --git a/static/img/dep-vmrouter-wandev5.png b/static/img/dep-vmrouter-wandev5.png index 5f7548e389a..f817ab341ba 100644 Binary files a/static/img/dep-vmrouter-wandev5.png and b/static/img/dep-vmrouter-wandev5.png differ diff --git a/static/img/dep-vmrouter-wandev8.png b/static/img/dep-vmrouter-wandev8.png index ed7e3ab03ae..34dc13014ad 100644 Binary files a/static/img/dep-vmrouter-wandev8.png and b/static/img/dep-vmrouter-wandev8.png differ diff --git a/static/img/dep-vmrouter-wandev8a.png b/static/img/dep-vmrouter-wandev8a.png new file mode 100644 index 00000000000..8c9455874e1 Binary files /dev/null and b/static/img/dep-vmrouter-wandev8a.png differ diff --git a/static/img/dep-vmrouter-wandev9.png b/static/img/dep-vmrouter-wandev9.png index 9c1df8da90c..a013bac4732 100644 Binary files a/static/img/dep-vmrouter-wandev9.png and b/static/img/dep-vmrouter-wandev9.png differ diff --git a/static/img/dep-vmware-router-hub-spoke.png b/static/img/dep-vmware-router-hub-spoke.png new file mode 100644 index 00000000000..33f23f244e4 Binary files /dev/null and b/static/img/dep-vmware-router-hub-spoke.png differ diff --git a/static/img/dep10-vmrouter-hub-mac-address.png b/static/img/dep10-vmrouter-hub-mac-address.png new file mode 100644 index 00000000000..b83d90beb09 Binary files /dev/null and b/static/img/dep10-vmrouter-hub-mac-address.png differ diff --git a/static/img/dep10-vmrouter-hub-start.png b/static/img/dep10-vmrouter-hub-start.png new file mode 100644 index 00000000000..b9716fc153e Binary files /dev/null and b/static/img/dep10-vmrouter-hub-start.png differ diff --git a/static/img/dep3-vmrouter-hub-name-os.png b/static/img/dep3-vmrouter-hub-name-os.png new file mode 100644 index 00000000000..aebdd6feb1e Binary files /dev/null and b/static/img/dep3-vmrouter-hub-name-os.png differ diff --git a/static/img/dep6-vmrouter-hub-4nics.png b/static/img/dep6-vmrouter-hub-4nics.png new file mode 100644 index 00000000000..fedb54c359a Binary files /dev/null and b/static/img/dep6-vmrouter-hub-4nics.png differ diff --git a/static/img/dep8-vm-hub-all-settings.png b/static/img/dep8-vm-hub-all-settings.png new file mode 100644 index 00000000000..e5952d7763f Binary files /dev/null and b/static/img/dep8-vm-hub-all-settings.png differ diff --git a/static/img/dep9-vmrouter-hub-summary.png b/static/img/dep9-vmrouter-hub-summary.png new file mode 100644 index 00000000000..b323c12a3e0 Binary files /dev/null and b/static/img/dep9-vmrouter-hub-summary.png differ