diff --git a/docs/_deploy_aws_conductor_network_design.md b/docs/_deploy_aws_conductor_network_design.md new file mode 100644 index 0000000000..0550b9a914 --- /dev/null +++ b/docs/_deploy_aws_conductor_network_design.md @@ -0,0 +1,25 @@ + + +The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your environment. + +| Parameter | Example Value | Description | +|-----------|--------------|-------------| +| Authority Name | `Authority128` | Organizational authority name | +| Conductor Name | `Conductor` | Conductor system name | +| Conductor Node Name | `node0` | Conductor node name | +| Conductor Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Conductor VPC CIDR | `10.0.0.0/16` | AWS VPC for the conductor | +| Conductor Subnet CIDR | `10.0.1.0/24` | Control subnet within the conductor VPC | +| Conductor Private IP | `10.0.1.10` | Private IP assigned to the conductor ENI | +| Conductor Elastic IP | `203.0.113.10` | AWS Elastic IP — the address managed routers use to reach this conductor | +| SSR Version | `7.1.4` | SSR software version installed via BYOL | +| Tenant Name | `corp` | LAN-side user tenant | +| Service Name | `Internet-Traffic` | Internet breakout service | +| Service Address | `0.0.0.0/0` | All internet-bound traffic | +| Router Name | `aws-branch1` | Example router name | +| Router Node Name | `node0` | Router node name | +| Router Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Router WAN Subnet | `10.1.1.0/24` | WAN (public) subnet in the router VPC | +| Router LAN Subnet | `10.1.2.0/24` | LAN (private) subnet in the router VPC | +| Router WAN Elastic IP | `203.0.113.20` | Elastic IP on the router WAN ENI (external peering address) | +| Router LAN IP | `10.1.2.1` | Static LAN gateway address on the router | diff --git a/docs/deploy_appendix_aws_conductor.mdx b/docs/deploy_appendix_aws_conductor.mdx new file mode 100644 index 0000000000..0b47f7659e --- /dev/null +++ b/docs/deploy_appendix_aws_conductor.mdx @@ -0,0 +1,204 @@ +--- +title: "Appendix: AWS Configuration" +sidebar_label: "Appendix: AWS Configuration" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This appendix contains the complete SSR PCLI configuration for the `Conductor` and `aws-branch1` described in this guide. This configuration reflects the final state after completing all steps through [Step 5 — Configure the Router on the Conductor](deploy_aws_router_config.mdx). + +:::important +- Replace `203.0.113.10` with your actual conductor Elastic IP. +- Replace `203.0.113.20` with your actual router WAN Elastic IP. +- The PCI addresses `0000:00:06.0` (WAN) and `0000:00:07.0` (LAN) are the defaults for EC2 instances deployed with the BYOL CloudFormation template when a management subnet is provided. Verify these against your specific instance using `sudo dpdk-devbind.py --status` before applying the router configuration. +::: + +## Network Design Reference + + + +## Applying This Configuration + +This configuration can be applied to a freshly initialized conductor using the PCLI import function. + +1. Save the configuration below to a file — for example, `aws-conductor.cfg`. + +2. Copy the file to the conductor: + + ```bash + scp aws-conductor.cfg admin@203.0.113.10:/tmp/ + ``` + +3. Log in to the conductor PCLI: + + ```bash + ssh admin@203.0.113.10 + ``` + +4. Enter configuration mode and import: + + ```text + admin@node0.Conductor# import config /tmp/aws-conductor.cfg + ``` + +5. Review any validation warnings, then commit: + + ```text + admin@node0.Conductor (config)# commit + Are you sure you want to commit the candidate config? [y/N]: y + ``` + +Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode. + +## Complete Configuration + +```text +config + authority + name Authority128 + + conductor-address 203.0.113.10 + + tenant corp + name corp + exit + + service Internet-Traffic + name Internet-Traffic + scope public + security internal + + access-policy corp + source corp + exit + + address 0.0.0.0/0 + exit + + router Conductor + name Conductor + inter-node-security internal + + node node0 + name node0 + role conductor + + device-interface mgmt-dev + name mgmt-dev + type ethernet + pci-address 0000:00:05.0 + forwarding false + + network-interface mgmt-intf + name mgmt-intf + type management + + address 10.0.1.10 + ip-address 10.0.1.10 + prefix-length 24 + gateway 10.0.1.1 + exit + exit + exit + exit + exit + + router aws-branch1 + name aws-branch1 + inter-node-security internal + + node node0 + name node0 + role combo + + device-interface wan-dev + name wan-dev + type ethernet + pci-address 0000:00:06.0 + forwarding true + + network-interface wan1 + name wan1 + global-id 1 + type external + conductor true + management true + default-route true + source-nat true + dhcp v4 + + management-vector + name mgmt-vec-wan + priority 100 + exit + + neighborhood internet + name internet + topology spoke + external-nat-address 203.0.113.20 + exit + exit + exit + + device-interface lan-dev + name lan-dev + type ethernet + pci-address 0000:00:07.0 + forwarding true + + network-interface lan1 + name lan1 + global-id 2 + type external + tenant corp + source-nat true + dhcp disabled + + address 10.1.2.1 + ip-address 10.1.2.1 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-route + name internet-route + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + exit + exit + + dns-config static + address 1.1.1.1 + address 8.8.8.8 + exit + exit + exit +exit +``` + +## Interface Summary + +| Interface | Device Interface | PCI Address | Type | Configuration | +|-----------|-----------------|-------------|------|---------------| +| `wan1` | `wan-dev` | `0000:00:06.0` | External | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` with external-nat-address `203.0.113.20` | +| `lan1` | `lan-dev` | `0000:00:07.0` | External | tenant `corp`, static `10.1.2.1/24`, source-nat | + +## Service Route Summary + +| Service Route | Service | Type | Next Hop | +|--------------|---------|------|---------| +| `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` | + +## Design Notes + +**AWS NAT and External NAT Address** — AWS performs 1:1 NAT between each Elastic IP and the private IP assigned to the corresponding ENI. The `external-nat-address` setting in the `internet` neighborhood tells the SSR to advertise the Elastic IP (`203.0.113.20`) to peers rather than the private DHCP address. Without this, SVR peer connections cannot be established because the private IP is not routable from outside the VPC. + +**Management over Forwarding** — The `wan1` interface carries both internet traffic and conductor management sessions simultaneously. Management traffic originating from the host OS at `169.254.x.x` link-local addresses is source-NAT'd to the WAN DHCP address before leaving the interface. The `default-route: true` setting ensures Linux routes all outbound OS traffic through the SSR forwarding engine so the auto-generated `management-conductor` service route applies. + +**Management Interface (eth0)** — The first ENI (`eth0` / `ge-0-0`) is not configured in SSR. Linux manages it for out-of-band SSH access. This is the recommended pattern for AWS deployments, as it preserves SSH reachability when the SSR service is offline for maintenance or upgrades. + +**Source / Destination Check** — The WAN and LAN ENIs on the router EC2 instance must have source/destination checking disabled. This is an AWS-specific requirement that allows the SSR to forward packets where it is not the source or destination. diff --git a/docs/deploy_aws_conductor.mdx b/docs/deploy_aws_conductor.mdx new file mode 100644 index 0000000000..233d194bdf --- /dev/null +++ b/docs/deploy_aws_conductor.mdx @@ -0,0 +1,70 @@ +--- +title: AWS Conductor Deployment Guide +sidebar_label: Overview +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This guide walks a network engineer through deploying a **BYOL Session Smart Conductor on AWS EC2** and connecting it to a managed SSR router. When you have completed the steps in this guide, the conductor EC2 instance will be running SSR 7.1.4, configured with an authority name, conductor address, and the shared services needed to bring a branch router online with internet breakout over the router's WAN forwarding interface. + +## Guide Topics + +| Step | Topic | Description | +|------|-------|-------------| +| 1 | [Launch the Conductor EC2 Instance](deploy_aws_conductor_instance.mdx) | Create the AWS EC2 instance that will host the conductor | +| 2 | [Install SSR 7.1.4 and Initialize the Conductor](deploy_aws_conductor_install.mdx) | Wait for BYOL installation and verify access to the conductor GUI | +| 3 | [Configure the Conductor](deploy_aws_conductor_config.mdx) | Set the authority name, conductor address, tenant, and internet service | +| 4 | [Launch the Router EC2 Instance](deploy_aws_router_instance.mdx) | Create the AWS EC2 instance for the managed router | +| 5 | [Configure the Router on the Conductor](deploy_aws_router_config.mdx) | Define router interfaces, management over forwarding, and internet service route | +| — | [Appendix — AWS Configuration](deploy_appendix_aws_conductor.mdx) | Complete PCLI configuration reference for conductor and router | + +## Network Topology + +```mermaid +graph TD + Internet((Internet)) + subgraph AWS["Amazon Web Services"] + subgraph CondVPC["Conductor VPC — 10.0.0.0/16"] + ConductorEC2["SSR Conductor\n(Conductor)\nPrivate: 10.0.1.10\nElastic IP: 203.0.113.10\nc5.xlarge · SSR 7.1.4"] + end + subgraph RouterVPC["Router VPC — 10.1.0.0/16"] + RouterEC2["SSR Router\n(aws-branch1)\nWAN: DHCP / 203.0.113.20\nLAN: 10.1.2.1/24\nc5.xlarge · SSR 7.1.4"] + end + end + LAN["LAN Devices\n10.1.2.0/24\nTenant: corp"] + + Internet <-->|"HTTPS / GUI"| ConductorEC2 + RouterEC2 <-->|"Internet Breakout\n(Internet-Traffic)"| Internet + RouterEC2 <-->|"Management over Forwarding\nPorts 930 / 4505 / 4506"| ConductorEC2 + LAN <-->|"LAN"| RouterEC2 +``` + +## Roles + +| Device | Type | Role | +|--------|------|------| +| `Conductor` | AWS EC2 (`c5.xlarge`) | Standalone SSR Conductor — centralized management and provisioning | +| `aws-branch1` | AWS EC2 (`c5.xlarge`) | Conductor-managed SSR router with internet breakout | + +## Network Design Reference + + + +## Prerequisites + +Before beginning, ensure the following are available: + +- **AWS account** with permissions to launch EC2 instances, create VPCs and subnets, allocate Elastic IPs, and deploy CloudFormation stacks. +- **Juniper BYOL subscription** — access to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering in the AWS Marketplace. Accept the terms and conditions before deploying. +- **Artifactory credentials** — username and token for the Juniper software repository. These are required for BYOL software installation. + + :::note + Contact your Juniper account team if you do not have Artifactory credentials. + ::: + +- **IAM key pair** — an existing EC2 key pair in the target region for SSH access to both instances. +- **Networking** — a VPC and subnet for the conductor, and a separate VPC (or the same VPC with additional subnets) with at least two subnets for the router (WAN and LAN). The conductor subnet must be reachable from the router's WAN subnet on ports 930, 4505, and 4506. +- **Two Elastic IPs** allocated in your target region: one for the conductor and one for the router WAN interface. + +:::note +BYOL instances require the conductor to run SSR 6.3.0-R1 or later. This guide targets SSR 7.1.4, which meets that requirement. +::: diff --git a/docs/deploy_aws_conductor_config.mdx b/docs/deploy_aws_conductor_config.mdx new file mode 100644 index 0000000000..6de80839be --- /dev/null +++ b/docs/deploy_aws_conductor_config.mdx @@ -0,0 +1,87 @@ +--- +title: "Step 3: Configure the Conductor" +sidebar_label: "Configure the Conductor" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; +import AuthorityName from './_set_authority_name.md'; +import ConductorAuthority from './_conductor_to_authority.md'; + +This step configures the authority-level settings on the conductor: the authority name, conductor address, corporate tenant, and internet service. These objects are shared across all routers managed by this conductor. + +All steps are performed from the **Conductor GUI** at `https://203.0.113.10` unless otherwise noted. + +## Network Design Reference + + + +## 1. Assign the Conductor's Asset ID + + + +## 2. Set the Authority Name + + + +:::note +Use your organization's name as the authority name (for example, `Authority128`). The authority name cannot be changed after routers have been provisioned without re-onboarding them. +::: + +## 3. Set the Conductor Address + +The conductor address is the IP address that managed routers use to reach this conductor. For an AWS deployment, this must be the **Elastic IP** assigned to the conductor's control ENI — not the private IP — because routers connecting from outside the conductor VPC reach the conductor through the internet. + +1. From the **Authority Settings** page, scroll to **Conductor Addresses** and select **ADD**. +2. In the **New Conductor Address** window, enter `203.0.113.10`. +3. Click **SAVE**. +4. Select **VALIDATE** then **COMMIT**. + +:::important +You must use the Elastic IP (`203.0.113.10`) as the conductor address, not the private IP (`10.0.1.10`). Routers outside the conductor VPC connect to the conductor over the internet using the Elastic IP. +::: + +## 4. Create the Corporate Tenant + +Tenants logically partition the network. The `corp` tenant represents corporate LAN users and is referenced by the LAN interface configuration on each managed router. + +1. In the Conductor GUI, select **Configuration**. +2. Select **Authority**. +3. Scroll to **Tenants** and select **ADD**. +4. Enter the name `corp` and select **SAVE**. +5. Select **VALIDATE** then **COMMIT**. + +:::info +Tenants are authority-wide. A single `corp` tenant definition applies to all routers that assign it to a LAN interface. +::: + +## 5. Create the `Internet-Traffic` Service + +The service configuration element defines the IP destinations that the SSR routes. This step creates a service representing all internet-bound traffic from corporate LAN users. + +1. In the Conductor GUI, select **Configuration**. +2. Select **Authority** from the left panel. +3. Scroll down to **Services** and select **ADD**. +4. Enter the name `Internet-Traffic` and select **SAVE**. +5. On the Service screen, verify **Enabled** is set to `true`. +6. Scroll down to **Service Addresses** and select **ADD**. +7. Enter `0.0.0.0/0` and select **SAVE**. +8. Scroll down to **Access Policy** and select **ADD**. + - Set **Source** to `corp`. + - Select **SAVE**. +9. Select **VALIDATE** then **COMMIT**. + +## What Was Configured + +At the end of this step, your authority contains: + +| Object | Name | Value | +|--------|------|-------| +| Authority | `Authority128` | | +| Conductor Address | | `203.0.113.10` (Elastic IP) | +| Tenant | `corp` | LAN-side user population | +| Service | `Internet-Traffic` | `0.0.0.0/0`, access from `corp` | + +The conductor is now ready to accept router onboarding. + +## Next Step + +Proceed to [Step 4 — Launch the Router EC2 Instance](deploy_aws_router_instance.mdx). diff --git a/docs/deploy_aws_conductor_install.mdx b/docs/deploy_aws_conductor_install.mdx new file mode 100644 index 0000000000..c424b8d637 --- /dev/null +++ b/docs/deploy_aws_conductor_install.mdx @@ -0,0 +1,102 @@ +--- +title: "Step 2: Install SSR 7.1.4 and Initialize the Conductor" +sidebar_label: "Install and Initialize" +--- + +This step confirms that the BYOL SSR software installation has completed successfully and verifies access to the conductor GUI. If you deployed using the CloudFormation template with all required parameters (SSR version and Artifactory credentials), the software is installed and the conductor role is initialized automatically — no manual commands are required. + +## Wait for Software Installation + +After the CloudFormation stack reaches **CREATE_COMPLETE**, the EC2 instance downloads and installs SSR 7.1.4 via the BYOL process. This takes approximately **10–15 minutes**. + +You can monitor progress by connecting to the instance over SSH: + +1. SSH to the EC2 instance using the SSH command from the CloudFormation Outputs tab: + + ```bash + ssh -i t128@203.0.113.10 + ``` + +2. Follow the hardware bootstrapper log to observe installation progress: + + ```bash + sudo journalctl -u 128T-hardware-bootstrapper -f + ``` + +3. When you see output indicating that SSR installation is complete and the system is initializing, the instance will reboot automatically. Wait for it to come back online before proceeding. + +:::note +If the device does not initialize as expected within 20 minutes, SSH into the instance and examine `/var/log/128T-hardware-bootstrapper/hardware-bootstrapper-tech-support.zip` for diagnostic information. +::: + +## Verify the Conductor Is Running + +After the reboot, confirm that SSR is running: + +1. SSH back to the instance: + + ```bash + ssh -i t128@203.0.113.10 + ``` + +2. Enter the SSR CLI: + + ```bash + su admin + ``` + +3. Run `show system`. When **Status** returns `running`, the conductor is ready: + + ```text + admin@node0.Conductor# show system + ... + Status: running + ``` + +## Access the Conductor GUI + +1. Open a web browser and navigate to the HTTPS URL from the CloudFormation Outputs tab: + + ``` + https://203.0.113.10 + ``` + + Accept the self-signed certificate warning to proceed. + +2. Log in with the default credentials: + - **Username:** `admin` + - **Password:** `128Tadmin` + + :::important + Change the default password immediately after first login. Navigate to the account icon in the top-right corner and select **Change Password**. The new password must be at least 9 characters and include one uppercase letter, one lowercase letter, and one number. + ::: + +3. A successful login confirms the conductor is running and reachable on the network. + +## Manual Onboarding (Without CloudFormation) + +If you launched the EC2 instance without using the CloudFormation template, or without providing Artifactory credentials in the template, complete onboarding manually: + +1. SSH to the instance using `ec2-user` and your IAM key: + + ```bash + ssh -i ec2-user@203.0.113.10 + ``` + +2. Run the hardware bootstrapper configuration generator: + + ```bash + sudo /usr/libexec/hardwareBootstrapper128t config-generator + ``` + +3. Follow the interactive prompts. When asked, provide: + - Conductor name: `Conductor` + - SSR version: `7.1.4` + - Artifactory username and token + - Mode: `conductor` + +4. The instance reboots automatically after onboarding completes. + +## Next Step + +Proceed to [Step 3 — Configure the Conductor](deploy_aws_conductor_config.mdx). diff --git a/docs/deploy_aws_conductor_instance.mdx b/docs/deploy_aws_conductor_instance.mdx new file mode 100644 index 0000000000..a1a52c0185 --- /dev/null +++ b/docs/deploy_aws_conductor_instance.mdx @@ -0,0 +1,137 @@ +--- +title: "Step 1: Launch the Conductor EC2 Instance" +sidebar_label: "Launch the Conductor Instance" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This step launches the AWS EC2 instance that will host the SSR Conductor. The BYOL CloudFormation template creates the EC2 instance, its security group, and an Elastic IP association in a single stack. Once the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins automatically. + +## Network Design Reference + + + +## Conductor Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | Scale up for deployments with more than 25 managed routers | +| vCPUs | 4 | | +| Memory | 8 GB | | +| Storage | 128 GB | Default EBS volume provided by the CloudFormation template | +| Network Interfaces | 1 × ENI | Connected to the control subnet | + +:::note +Memory requirements should be adjusted based on your network scaling requirements. For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). +::: + +## Infrastructure Requirements + +The following AWS infrastructure must exist before deploying the conductor: + +- A **VPC** in your target region (`10.0.0.0/16` in this guide). +- A **subnet** within the VPC (`10.0.1.0/24`) that is reachable via SSH and HTTPS from your administrative workstation and reachable from the WAN interfaces of the routers this conductor will manage. +- An **Elastic IP** allocated in the same region. + +## Deploy the Conductor Using CloudFormation + +The BYOL CloudFormation template is the recommended deployment method. It creates the EC2 instance, attaches the security group, and installs SSR automatically. + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters using the following table as a guide: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `Conductor` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | Juniper repository access | + | Artifactory Token | _(your token)_ | Juniper repository access token | + | VPC ID | ID of the conductor VPC | | + | Control Subnet ID | ID of the `10.0.1.0/24` subnet | | + | Control Subnet Allowed CIDR | `0.0.0.0/0` | Restrict to known router WAN CIDRs after deployment | + | Admin Allowed CIDR | `/32` | Source IP(s) allowed for SSH and HTTPS | + | Key Name | Your EC2 key pair name | | + + For a full description of all template parameters, see [BYOL Conductor Template Parameters](intro_installation_byol_aws_conductor.md#launch-the-conductor-template). + + ![CloudFormation Template](/img/aws-byol-conductor-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +9. After the stack reaches **CREATE_COMPLETE**, open the **Outputs** tab and record: + - The **public IP address** of the control interface — this is the conductor Elastic IP (`203.0.113.10` in the network design example). + - The **HTTPS URL** for the conductor GUI. + - The **SSH command** to log in to the Linux instance. + + :::important + After deployment is complete, update the **Control Subnet Allowed CIDR** and **Admin Allowed CIDR** security group rules to restrict access to known source IP addresses. Leaving these open to `0.0.0.0/0` exposes the management interface to the internet. + ::: + +### Associate the Elastic IP + +If the CloudFormation template did not allocate a static Elastic IP, manually associate one now: + +1. In the EC2 console, navigate to **Elastic IPs** and allocate a new address. +2. Select the address and click **Actions → Associate Elastic IP Address**. +3. Select the conductor EC2 instance and click **Associate**. + +Record the Elastic IP. This is the conductor address that all managed routers use to connect (`203.0.113.10` in this guide). + +### AWS CLI (Optional) + +To launch the conductor template from the command line, follow the [AWS CLI deployment steps](intro_installation_byol_aws_conductor.md#using-the-aws-cli). + +### Cloud-Init Onboarding (Optional) + +If you are launching the instance outside of the CloudFormation template — for example, from a custom automation pipeline — you can supply the following user-data to automate conductor initialization: + +```yaml +#cloud-config +write_files: + - path: /etc/128T-hardware-bootstrapper/onboarding-config.json + content: | + { + "name": "Conductor", + "ssr-version": "7.1.4", + "mode": "conductor", + "artifactory-user": "", + "artifactory-password": "", + "node-name": "node0", + "cloud-provider": "aws" + } +``` + +| Option | Meaning | +|--------|---------| +| `name` | Name of the conductor instance. | +| `ssr-version` | SSR software version to install. | +| `mode` | Set to `conductor` for conductor deployments. | +| `artifactory-user` | User portion of your Artifactory credentials. | +| `artifactory-password` | Token portion of your Artifactory credentials. | +| `node-name` | Node name. Use `node0` for a standalone conductor. | +| `cloud-provider` | Set to `aws`. | + +## What Was Deployed + +After the CloudFormation stack completes, the following resources exist in your AWS account: + +| Resource | Description | +|----------|-------------| +| EC2 instance | `Conductor` — `c5.xlarge`, running the BYOL SSR image | +| Security group | Allows inbound SSH (22), HTTPS (443), and router management ports (930, 4505, 4506) | +| Elastic IP | Assigned to the conductor's control ENI (`203.0.113.10`) | + +The BYOL software installation begins immediately after the EC2 instance starts. The SSR 7.1.4 installation takes approximately **10–15 minutes** to complete. + +## Next Step + +Proceed to [Step 2 — Install SSR 7.1.4 and Initialize the Conductor](deploy_aws_conductor_install.mdx). diff --git a/docs/deploy_aws_router_config.mdx b/docs/deploy_aws_router_config.mdx new file mode 100644 index 0000000000..ef6419448c --- /dev/null +++ b/docs/deploy_aws_router_config.mdx @@ -0,0 +1,182 @@ +--- +title: "Step 5: Configure the Router on the Conductor" +sidebar_label: "Configure the Router" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +With the router EC2 instance deployed and ZTP-connected to the conductor, you can now configure the full router profile. All steps are performed from the **Conductor GUI** at `https://203.0.113.10`. + +:::note +Your conductor must already have the following objects configured before proceeding: + +- **Authority name** — set to your organization's name. +- **Conductor address** — set to `203.0.113.10`. +- **`corp` tenant** — the LAN-side user tenant. +- **`Internet-Traffic` service** — with address `0.0.0.0/0` and access policy permitting `corp`. + +If any of these are missing, complete [Step 3 — Configure the Conductor](deploy_aws_conductor_config.mdx) first. +::: + +## Network Design Reference + + + +## Create the Router and Associate the Pending Asset + +After the router EC2 finishes the BYOL installation and ZTPs to the conductor, a pending asset appears in the conductor GUI. Create the router configuration and associate the asset with it before configuring the interfaces. + +1. Log in to the Conductor GUI. +2. Select **Configuration → Authority**. +3. Scroll to **Routers** and select **ADD**. +4. Enter the name `aws-branch1` and select **SAVE**. +5. Set **Inter-node Security** to `internal`. +6. Under the new router, scroll to **Nodes** and select **ADD**. +7. Enter node name `node0` and select **SAVE**. +8. Set **Role** to `combo`. +9. Under **Associated Asset ID**, select the pending asset that appeared after the router ZTPed. +10. Select **SAVE**. + +:::note +The pending asset appears in the conductor GUI within 2–3 minutes of the ZTP connection being established. If no asset appears after 20 minutes, SSH into the router instance and examine the hardware bootstrapper logs for diagnostic information. See [Troubleshooting BYOL Installations](intro_installation_byol_aws_conductor.md#troubleshooting) for guidance. +::: + +## 1. Configure the WAN Interface + +The WAN interface (`eth1` / PCI `0000:00:06.0`) connects to the public subnet, obtains an IP address via DHCP from AWS, and carries both internet forwarding traffic and conductor management traffic via [Management over Forwarding](config_management_over_forwarding.md). + +### 1a. Create the WAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `wan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:06.0` | WAN ENI (`eth1`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 1b. Create the WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `v4` | AWS assigns private IPs via DHCP | + | Global-ID | `1` | | + | Conductor | `true` | Enables conductor connectivity over this interface | + | Management | `true` | Enables management over forwarding | + | Default Route | `true` | Routes Linux outbound traffic through the SSR forwarding engine | + | Source NAT | `true` | Required for management over forwarding | + +4. Scroll down to **Management Vector** and select **ADD**. + - Enter name `mgmt-vec-wan` and priority `100`. + - Select **SAVE**. + +5. Scroll down to **Neighborhoods** and select **ADD**. + - Enter the neighborhood name `internet`. + - Set **Topology** to `spoke`. + - Scroll to **External NAT Address** and enter `203.0.113.20` (the Elastic IP of the router WAN ENI). + - Select **SAVE**. + +:::important +**Why `external-nat-address` is required:** AWS maps the Elastic IP (`203.0.113.20`) to the private DHCP address on the WAN ENI via 1:1 NAT. Without the `external-nat-address` setting, the SSR advertises its private IP to peers — which is unreachable from the internet. Setting this field tells the SSR to advertise the Elastic IP instead. + +**Why `Conductor`, `Source NAT`, and `Default Route` must all be `true`:** Management traffic to the conductor originates from the host OS at `169.254.x.x` link-local addresses. Source NAT translates this to the WAN DHCP address before the packet leaves the interface. The default route ensures Linux routes all outbound traffic through the SSR forwarding engine so the management-conductor service routes apply. +::: + +## 2. Configure the LAN Interface + +The LAN interface (`eth2` / PCI `0000:00:07.0`) connects to the private subnet and assigns the `corp` tenant to all inbound traffic. + +### 2a. Create the LAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `lan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:07.0` | LAN ENI (`eth2`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 2b. Create the LAN Network Interface + +1. Under the LAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `lan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `disabled` | Use a static gateway address on the LAN | + | Global-ID | `2` | | + | Tenant | `corp` | Assigns all LAN traffic to the corp tenant | + | Source NAT | `true` | | + +4. Scroll down to **Interface Addresses** and select **ADD**. + - IP Address: `10.1.2.1` + - Prefix Length: `24` +5. Select **SAVE**. + +:::note +The LAN interface is configured with a static IP (`10.1.2.1`) so it can act as the default gateway for hosts on the `10.1.2.0/24` subnet. If the router is not acting as the LAN gateway and instead connects to an existing subnet, configure DHCP `v4` on the LAN interface and remove the static address. +::: + +## 3. Configure DNS + +Configure DNS so the router can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level (`aws-branch1`). +2. Scroll to **DNS Config** and select **ADD**. +3. Set **Mode** to `static` and enter the following DNS server addresses: `1.1.1.1` and `8.8.8.8`. +4. Select **SAVE**. + +## 4. Create the Internet Service Route + +The service route directs traffic matched by the `Internet-Traffic` service out through the WAN interface as a direct internet breakout. + +1. Return to the **Router** level. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-route` and select **SAVE**. +4. Set the following fields: + + | Field | Value | + |-------|-------| + | Service Name | `Internet-Traffic` | + | Service Route Type | `service-agent` | + +5. Scroll to **Next Hop** and select **ADD**. + - Node: `node0` + - Network Interface: `wan1` + - Select **SAVE**. + +6. Select **VALIDATE** and **COMMIT**. + +## Configuration Summary + +After committing, the conductor pushes the configuration to `aws-branch1`. The router applies the configuration and comes fully online within approximately 2–5 minutes. + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `aws-branch1` | combo node, associated pending asset | +| WAN Device Interface | `wan-dev` | PCI `0000:00:06.0`, forwarding enabled | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` with external-nat-address `203.0.113.20` | +| LAN Device Interface | `lan-dev` | PCI `0000:00:07.0`, forwarding enabled | +| LAN Network Interface | `lan1` | tenant `corp`, static `10.1.2.1/24` | +| DNS Config | | mode `static`, servers `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-route` | service `Internet-Traffic`, type `service-agent`, next-hop `node0 / wan1` | + +## Related Topics + +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Appendix — AWS Configuration](deploy_appendix_aws_conductor.mdx) +- [Troubleshooting BYOL Installations](intro_installation_byol_aws_conductor.md#troubleshooting) diff --git a/docs/deploy_aws_router_instance.mdx b/docs/deploy_aws_router_instance.mdx new file mode 100644 index 0000000000..1b6f656376 --- /dev/null +++ b/docs/deploy_aws_router_instance.mdx @@ -0,0 +1,130 @@ +--- +title: "Step 4: Launch the Router EC2 Instance" +sidebar_label: "Launch the Router Instance" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This step deploys the AWS EC2 instance for the SSR router. The BYOL CloudFormation template creates the instance with three network interfaces, installs SSR 7.1.4, and automatically onboards the router to the conductor via Zero Touch Provisioning (ZTP). + +## Network Design Reference + + + +## Router Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | | +| vCPUs | 4 | | +| Memory | 8 GB | | +| Storage | 128 GB | | +| Network Interfaces | 3 × ENI | Management (OOB), WAN (public), LAN (private) | +| Enhanced Networking | ENA required | Provides maximum throughput performance | + +## Infrastructure Requirements + +The following infrastructure must exist in your AWS account before deploying the router: + +- A **VPC** in your target region (`10.1.0.0/16` in this guide). +- Three **subnets** within the VPC: + + | Subnet | CIDR | Purpose | + |--------|------|---------| + | Management | _(any)_ | OOB SSH to the EC2 instance. Managed by Linux only — not configured in SSR. | + | WAN (public) | `10.1.1.0/24` | Internet-facing, carries both internet forwarding and conductor management over forwarding. | + | LAN (private) | `10.1.2.0/24` | Internal workloads. | + +- An **Elastic IP** allocated in the same region — this will be associated with the WAN ENI. Record it as `203.0.113.20` (your ``). +- **Enhanced networking** enabled on the instance. If deploying without the CloudFormation template, enable ENA support from your local machine: + + ```bash + aws ec2 modify-instance-attribute --instance-id --ena-support + ``` + +:::important +The WAN subnet must have a route to the internet and be able to reach the conductor Elastic IP (`203.0.113.10`) on ports 930, 4505, and 4506. +::: + +## Deploy the Router Using CloudFormation + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor Managed Router** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `aws-branch1` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | | + | Artifactory Token | _(your token)_ | | + | Primary Control IP | `203.0.113.10` | Conductor Elastic IP | + | VPC ID | ID of the router VPC | | + | Management Subnet ID | ID of the management subnet | | + | Public Subnet ID | ID of the WAN subnet (`10.1.1.0/24`) | | + | Public Subnet Allowed CIDR | `0.0.0.0/0` | Restrict after deployment | + | Private Subnet ID | ID of the LAN subnet (`10.1.2.0/24`) | | + | Private Subnet Allowed CIDR | `10.1.2.0/24` | | + | Admin Allowed CIDR | `/32` | | + | Key Name | Your EC2 key pair name | | + + For a full description of all template parameters, see [BYOL Router Template Parameters](intro_installation_byol_aws_conductor.md#launch-the-conductor-managed-template). + + ![CloudFormation Template](/img/aws-byol-conductor-managed-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +After the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins. Allow **10–15 minutes** for SSR 7.1.4 to install. The router then automatically contacts the conductor at `203.0.113.10` and appears as a pending asset in the conductor GUI. + +## Network Interface Layout + +The CloudFormation template attaches the ENIs to the EC2 instance in the following order when a management subnet is provided: + +| Network Interface | Subnet | PCI Address | Managed By | +|-------------------|--------|-------------|-----------| +| `eth0` / `ge-0-0` | Management | `0000:00:05.0` | Linux only — OOB SSH, not configured in SSR | +| `eth1` / `ge-0-1` | WAN (public) | `0000:00:06.0` | SSR — WAN forwarding with management over forwarding | +| `eth2` / `ge-0-2` | LAN (private) | `0000:00:07.0` | SSR — LAN forwarding | + +:::note +These PCI addresses are the default values for EC2 instances deployed with this template. Verify the actual addresses on your instance after SSR is installed by running `sudo dpdk-devbind.py --status` via SSH. See [Determining the Device Interface Layout](intro_installation_quickstart_aws.md#determine-the-device-interface-layout) for instructions. +::: + +## Disable Source / Destination Check + +AWS enables source/destination checking on all ENIs by default. This check drops packets where the EC2 instance is not the packet source or destination, which prevents the SSR from forwarding any transit traffic. You must disable this check on the **WAN and LAN ENIs**. + +1. In the EC2 console, navigate to **Instances** and select the `aws-branch1` instance. +2. Select the **Networking** tab. +3. Under **Network interfaces**, click on the WAN ENI (second interface, `eth1`). +4. Select **Actions → Change source/destination check**. +5. Select **Stop** and click **Save**. + + ![Source/Destination Check](/img/AWS-bootstrap2.png) + +6. Repeat steps 3–5 for the LAN ENI (`eth2`). + +:::important +Failing to disable source/destination checking prevents the SSR from forwarding any transit traffic. Complete this step before committing the router configuration in [Step 5](deploy_aws_router_config.mdx). +::: + +## Associate the Elastic IP with the WAN Interface + +1. In the EC2 console, navigate to **Elastic IPs**. +2. If you have not already done so, allocate a new Elastic IP. +3. Select the address and click **Actions → Associate Elastic IP Address**. +4. Select the router instance's WAN ENI (`eth1`) and click **Associate**. + +Record this Elastic IP as `203.0.113.20`. You will reference it when configuring the WAN interface neighborhood in [Step 5](deploy_aws_router_config.mdx). + +## Next Step + +Proceed to [Step 5 — Configure the Router on the Conductor](deploy_aws_router_config.mdx). diff --git a/docs/deploy_guides_overview.md b/docs/deploy_guides_overview.md index 3c94da380d..3f1547fc26 100644 --- a/docs/deploy_guides_overview.md +++ b/docs/deploy_guides_overview.md @@ -5,7 +5,7 @@ sidebar_label: Overview Conductor and Router Deployment Guides are provided to help walk a network engineer through the steps required to stand up a conductor-managed SSR network. -Conductor deployments currently include VMware ESXi. In this guide the conductor will have a configuration ready for a branch router to onboard and come online, managed by the conductor, forwarding internet traffic for LAN users, and reachable by the conductor over the same WAN interface used for internet breakout. +Conductor deployments include VMware ESXi and AWS EC2 (BYOL). Each guide walks through the conductor deployment from instance creation to a working configuration with a managed router that forwards internet traffic for LAN users and reaches the conductor over the same WAN interface used for internet breakout. Router deployments are currently under development. diff --git a/docs/deploy_vmware_conductor_vm.mdx b/docs/deploy_vmware_conductor_vm.mdx index 0642a736b1..c5391bd016 100644 --- a/docs/deploy_vmware_conductor_vm.mdx +++ b/docs/deploy_vmware_conductor_vm.mdx @@ -18,7 +18,7 @@ This step creates the VMware ESXi virtual machine that will host the SSR conduct | Boot Firmware | EFI | UEFI secure boot disabled | :::note -For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). +Memory requirements should be adjusted based on your network scaling requirements. For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). ::: diff --git a/docs/intro_system_reqs.md b/docs/intro_system_reqs.md index 89a9742355..fcbde1b954 100644 --- a/docs/intro_system_reqs.md +++ b/docs/intro_system_reqs.md @@ -24,7 +24,7 @@ Server grade CPU such as Intel Xeon or AMD EPYC must be used. Hyperthreading (Intel) or Symmetric Multi-Threading (AMD) must be enabled on Conductor platforms. -| Number of managed routers | Physical Cores | Threads | Memory | +| Number of Managed Routers | Physical Cores | Threads | Memory | | ------------------------- | -------------- | ------- | ------ | | 1 to 10 | 2 Xeon | 4 | 8 GB | | 1 to 25 | 4 Xeon | 8 | 8 GB | diff --git a/sidebars.js b/sidebars.js index 74477d9301..e325600ca2 100644 --- a/sidebars.js +++ b/sidebars.js @@ -207,6 +207,19 @@ module.exports = { "deploy_appendix_vmware_conductor", ], }, + { + "type": "category", + "label": "AWS Conductor", + "items": [ + "deploy_aws_conductor", + "deploy_aws_conductor_instance", + "deploy_aws_conductor_install", + "deploy_aws_conductor_config", + "deploy_aws_router_instance", + "deploy_aws_router_config", + "deploy_appendix_aws_conductor", + ], + }, ], }, {