diff --git a/docs/_deploy_aws_conductor_network_design.md b/docs/_deploy_aws_conductor_network_design.md new file mode 100644 index 0000000000..0550b9a914 --- /dev/null +++ b/docs/_deploy_aws_conductor_network_design.md @@ -0,0 +1,25 @@ + + +The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your environment. + +| Parameter | Example Value | Description | +|-----------|--------------|-------------| +| Authority Name | `Authority128` | Organizational authority name | +| Conductor Name | `Conductor` | Conductor system name | +| Conductor Node Name | `node0` | Conductor node name | +| Conductor Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Conductor VPC CIDR | `10.0.0.0/16` | AWS VPC for the conductor | +| Conductor Subnet CIDR | `10.0.1.0/24` | Control subnet within the conductor VPC | +| Conductor Private IP | `10.0.1.10` | Private IP assigned to the conductor ENI | +| Conductor Elastic IP | `203.0.113.10` | AWS Elastic IP — the address managed routers use to reach this conductor | +| SSR Version | `7.1.4` | SSR software version installed via BYOL | +| Tenant Name | `corp` | LAN-side user tenant | +| Service Name | `Internet-Traffic` | Internet breakout service | +| Service Address | `0.0.0.0/0` | All internet-bound traffic | +| Router Name | `aws-branch1` | Example router name | +| Router Node Name | `node0` | Router node name | +| Router Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Router WAN Subnet | `10.1.1.0/24` | WAN (public) subnet in the router VPC | +| Router LAN Subnet | `10.1.2.0/24` | LAN (private) subnet in the router VPC | +| Router WAN Elastic IP | `203.0.113.20` | Elastic IP on the router WAN ENI (external peering address) | +| Router LAN IP | `10.1.2.1` | Static LAN gateway address on the router | diff --git a/docs/_deploy_aws_hub_spoke_network_design.md b/docs/_deploy_aws_hub_spoke_network_design.md new file mode 100644 index 0000000000..f7d6692ceb --- /dev/null +++ b/docs/_deploy_aws_hub_spoke_network_design.md @@ -0,0 +1,34 @@ + + +The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your environment. + +| Parameter | Example Value | Description | +|-----------|--------------|-------------| +| Authority Name | `Authority128` | Organizational authority name | +| Conductor Name | `Conductor` | Pre-existing conductor system name | +| Conductor Elastic IP | `203.0.113.10` | AWS Elastic IP — the address managed routers use to reach this conductor | +| SSR Version | `7.1.4` | SSR software version installed via BYOL | +| Tenant Name | `corp` | LAN-side user tenant (authority-wide) | +| Service Name | `Internet-Traffic` | Internet breakout service (authority-wide) | +| Service Address | `0.0.0.0/0` | All internet-bound traffic | +| Neighborhood Name | `internet` | Shared SVR neighborhood name | +| Hub Router Name | `aws-hub1` | Hub router system name | +| Hub Node Name | `node0` | Hub router node name | +| Hub Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Hub VPC CIDR | `10.2.0.0/16` | AWS VPC for the hub router | +| Hub WAN Subnet | `10.2.1.0/24` | WAN (public) subnet in the hub VPC | +| Hub LAN Subnet | `10.2.2.0/24` | LAN (private) subnet in the hub VPC | +| Hub WAN Elastic IP | `203.0.113.30` | Elastic IP on the hub WAN ENI (external peering address) | +| Hub LAN IP | `10.2.2.1` | Static LAN gateway address on the hub | +| Hub WAN PCI Address | `0000:00:06.0` | PCI address of the hub WAN ENI (`eth1`) | +| Hub LAN PCI Address | `0000:00:07.0` | PCI address of the hub LAN ENI (`eth2`) | +| Spoke Router Name | `aws-spoke1` | Spoke router system name | +| Spoke Node Name | `node0` | Spoke router node name | +| Spoke Instance Type | `c5.xlarge` | AWS EC2 instance size | +| Spoke VPC CIDR | `10.1.0.0/16` | AWS VPC for the spoke router | +| Spoke WAN Subnet | `10.1.1.0/24` | WAN (public) subnet in the spoke VPC | +| Spoke LAN Subnet | `10.1.2.0/24` | LAN (private) subnet in the spoke VPC | +| Spoke WAN Elastic IP | `203.0.113.20` | Elastic IP on the spoke WAN ENI (external peering address) | +| Spoke LAN IP | `10.1.2.1` | Static LAN gateway address on the spoke | +| Spoke WAN PCI Address | `0000:00:06.0` | PCI address of the spoke WAN ENI (`eth1`) | +| Spoke LAN PCI Address | `0000:00:07.0` | PCI address of the spoke LAN ENI (`eth2`) | diff --git a/docs/_deploy_aws_router_instance_steps.md b/docs/_deploy_aws_router_instance_steps.md new file mode 100644 index 0000000000..a221b5323b --- /dev/null +++ b/docs/_deploy_aws_router_instance_steps.md @@ -0,0 +1,29 @@ + + + +## Disable Source / Destination Check + +AWS enables source/destination checking on all ENIs by default. This check drops packets where the EC2 instance is not the packet source or destination, which prevents the SSR from forwarding transit traffic. You must disable this check on the **WAN and LAN ENIs**. + +1. In the EC2 console, navigate to **Instances** and select the router instance. +2. Select the **Networking** tab. +3. Under **Network Interfaces**, click on the WAN ENI (second interface, `eth1`). +4. Select **Actions → Change Source/Destination Check**. +5. Select **Stop** and click **Save**. + + ![Source/Destination Check](/img/AWS-bootstrap2.png) + +6. Repeat steps 3–5 for the LAN ENI (`eth2`). + +:::important +Failing to disable source/destination checking prevents the SSR from forwarding any transit traffic. Complete this step before committing the router configuration. +::: + +## Associate the Elastic IP with the WAN Interface + +1. In the EC2 console, navigate to **Elastic IPs**. +2. If you have not already done so, allocate a new Elastic IP. +3. Select the address and click **Actions → Associate Elastic IP Address**. +4. Select the router instance's WAN ENI (`eth1`) and click **Associate**. + +Record this Elastic IP. You will reference it as the `external-nat-address` when configuring the WAN interface neighborhood in the router configuration step. diff --git a/docs/deploy_appendix_aws_conductor.mdx b/docs/deploy_appendix_aws_conductor.mdx new file mode 100644 index 0000000000..0b47f7659e --- /dev/null +++ b/docs/deploy_appendix_aws_conductor.mdx @@ -0,0 +1,204 @@ +--- +title: "Appendix: AWS Configuration" +sidebar_label: "Appendix: AWS Configuration" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This appendix contains the complete SSR PCLI configuration for the `Conductor` and `aws-branch1` described in this guide. This configuration reflects the final state after completing all steps through [Step 5 — Configure the Router on the Conductor](deploy_aws_router_config.mdx). + +:::important +- Replace `203.0.113.10` with your actual conductor Elastic IP. +- Replace `203.0.113.20` with your actual router WAN Elastic IP. +- The PCI addresses `0000:00:06.0` (WAN) and `0000:00:07.0` (LAN) are the defaults for EC2 instances deployed with the BYOL CloudFormation template when a management subnet is provided. Verify these against your specific instance using `sudo dpdk-devbind.py --status` before applying the router configuration. +::: + +## Network Design Reference + + + +## Applying This Configuration + +This configuration can be applied to a freshly initialized conductor using the PCLI import function. + +1. Save the configuration below to a file — for example, `aws-conductor.cfg`. + +2. Copy the file to the conductor: + + ```bash + scp aws-conductor.cfg admin@203.0.113.10:/tmp/ + ``` + +3. Log in to the conductor PCLI: + + ```bash + ssh admin@203.0.113.10 + ``` + +4. Enter configuration mode and import: + + ```text + admin@node0.Conductor# import config /tmp/aws-conductor.cfg + ``` + +5. Review any validation warnings, then commit: + + ```text + admin@node0.Conductor (config)# commit + Are you sure you want to commit the candidate config? [y/N]: y + ``` + +Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode. + +## Complete Configuration + +```text +config + authority + name Authority128 + + conductor-address 203.0.113.10 + + tenant corp + name corp + exit + + service Internet-Traffic + name Internet-Traffic + scope public + security internal + + access-policy corp + source corp + exit + + address 0.0.0.0/0 + exit + + router Conductor + name Conductor + inter-node-security internal + + node node0 + name node0 + role conductor + + device-interface mgmt-dev + name mgmt-dev + type ethernet + pci-address 0000:00:05.0 + forwarding false + + network-interface mgmt-intf + name mgmt-intf + type management + + address 10.0.1.10 + ip-address 10.0.1.10 + prefix-length 24 + gateway 10.0.1.1 + exit + exit + exit + exit + exit + + router aws-branch1 + name aws-branch1 + inter-node-security internal + + node node0 + name node0 + role combo + + device-interface wan-dev + name wan-dev + type ethernet + pci-address 0000:00:06.0 + forwarding true + + network-interface wan1 + name wan1 + global-id 1 + type external + conductor true + management true + default-route true + source-nat true + dhcp v4 + + management-vector + name mgmt-vec-wan + priority 100 + exit + + neighborhood internet + name internet + topology spoke + external-nat-address 203.0.113.20 + exit + exit + exit + + device-interface lan-dev + name lan-dev + type ethernet + pci-address 0000:00:07.0 + forwarding true + + network-interface lan1 + name lan1 + global-id 2 + type external + tenant corp + source-nat true + dhcp disabled + + address 10.1.2.1 + ip-address 10.1.2.1 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-route + name internet-route + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + exit + exit + + dns-config static + address 1.1.1.1 + address 8.8.8.8 + exit + exit + exit +exit +``` + +## Interface Summary + +| Interface | Device Interface | PCI Address | Type | Configuration | +|-----------|-----------------|-------------|------|---------------| +| `wan1` | `wan-dev` | `0000:00:06.0` | External | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` with external-nat-address `203.0.113.20` | +| `lan1` | `lan-dev` | `0000:00:07.0` | External | tenant `corp`, static `10.1.2.1/24`, source-nat | + +## Service Route Summary + +| Service Route | Service | Type | Next Hop | +|--------------|---------|------|---------| +| `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` | + +## Design Notes + +**AWS NAT and External NAT Address** — AWS performs 1:1 NAT between each Elastic IP and the private IP assigned to the corresponding ENI. The `external-nat-address` setting in the `internet` neighborhood tells the SSR to advertise the Elastic IP (`203.0.113.20`) to peers rather than the private DHCP address. Without this, SVR peer connections cannot be established because the private IP is not routable from outside the VPC. + +**Management over Forwarding** — The `wan1` interface carries both internet traffic and conductor management sessions simultaneously. Management traffic originating from the host OS at `169.254.x.x` link-local addresses is source-NAT'd to the WAN DHCP address before leaving the interface. The `default-route: true` setting ensures Linux routes all outbound OS traffic through the SSR forwarding engine so the auto-generated `management-conductor` service route applies. + +**Management Interface (eth0)** — The first ENI (`eth0` / `ge-0-0`) is not configured in SSR. Linux manages it for out-of-band SSH access. This is the recommended pattern for AWS deployments, as it preserves SSH reachability when the SSR service is offline for maintenance or upgrades. + +**Source / Destination Check** — The WAN and LAN ENIs on the router EC2 instance must have source/destination checking disabled. This is an AWS-specific requirement that allows the SSR to forward packets where it is not the source or destination. diff --git a/docs/deploy_appendix_aws_hub_spoke.mdx b/docs/deploy_appendix_aws_hub_spoke.mdx new file mode 100644 index 0000000000..3806908217 --- /dev/null +++ b/docs/deploy_appendix_aws_hub_spoke.mdx @@ -0,0 +1,261 @@ +--- +title: "Appendix: AWS Hub and Spoke Configuration" +sidebar_label: "Appendix: Hub and Spoke Config" +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; + +This appendix contains the complete SSR PCLI configuration for the `aws-hub1` and `aws-spoke1` routers described in this guide. This configuration reflects the final state after completing all steps through [Step 4 — Configure the Spoke Router on the Conductor](deploy_aws_spoke_router_config.mdx). + +:::important +Before applying this configuration: + +- Replace `203.0.113.10` with your actual conductor Elastic IP. +- Replace `203.0.113.30` with your actual hub WAN Elastic IP. +- Replace `203.0.113.20` with your actual spoke WAN Elastic IP. +- The PCI addresses `0000:00:06.0` (WAN) and `0000:00:07.0` (LAN) are the defaults for EC2 instances deployed with the BYOL CloudFormation template when a management subnet is provided. Verify these against your specific instances using `sudo dpdk-devbind.py --status` before applying the configuration. +- The authority-level objects (`Internet-Traffic` service, `corp` tenant, conductor address) must already exist in the running configuration. For the complete authority-level configuration, see the [AWS Conductor Deployment Guide appendix](deploy_appendix_aws_conductor.mdx). +::: + +## Network Design Reference + + + +## Applying This Configuration + +This configuration can be applied to a conductor that already has the authority-level objects in place (authority name, conductor address, `corp` tenant, `Internet-Traffic` service). + +1. Save the hub configuration block to a file — for example, `aws-hub1.cfg`. +2. Save the spoke configuration block to a file — for example, `aws-spoke1.cfg`. +3. Copy both files to the conductor: + + ```bash + scp aws-hub1.cfg aws-spoke1.cfg admin@203.0.113.10:/tmp/ + ``` + +4. Log in to the conductor PCLI: + + ```bash + ssh admin@203.0.113.10 + ``` + +5. Import the hub configuration: + + ```text + admin@node0.Conductor# import config /tmp/aws-hub1.cfg + ``` + +6. Review any validation warnings, then import the spoke configuration: + + ```text + admin@node0.Conductor# import config /tmp/aws-spoke1.cfg + ``` + +7. Commit both configurations: + + ```text + admin@node0.Conductor (config)# commit + Are you sure you want to commit the candidate config? [y/N]: y + ``` + +Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode. + +## Hub Router Configuration — `aws-hub1` + +```text +config + authority + router aws-hub1 + name aws-hub1 + inter-node-security internal + + node node0 + name node0 + role combo + + device-interface wan-dev + name wan-dev + type ethernet + pci-address 0000:00:06.0 + forwarding true + + network-interface wan1 + name wan1 + global-id 1 + type external + conductor true + management true + default-route true + source-nat true + dhcp v4 + + management-vector + name mgmt-vec-wan + priority 100 + exit + + neighborhood internet + name internet + topology hub + external-nat-address 203.0.113.30 + exit + exit + exit + + device-interface lan-dev + name lan-dev + type ethernet + pci-address 0000:00:07.0 + forwarding true + + network-interface lan1 + name lan1 + global-id 2 + type external + tenant corp + source-nat true + dhcp disabled + + address 10.2.2.1 + ip-address 10.2.2.1 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-route + name internet-route + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + exit + exit + + dns-config static + address 1.1.1.1 + address 8.8.8.8 + exit + exit + exit +exit +``` + +## Spoke Router Configuration — `aws-spoke1` + +```text +config + authority + router aws-spoke1 + name aws-spoke1 + inter-node-security internal + + node node0 + name node0 + role combo + + device-interface wan-dev + name wan-dev + type ethernet + pci-address 0000:00:06.0 + forwarding true + + network-interface wan1 + name wan1 + global-id 1 + type external + conductor true + management true + default-route true + source-nat true + dhcp v4 + + management-vector + name mgmt-vec-wan + priority 100 + exit + + neighborhood internet + name internet + topology spoke + external-nat-address 203.0.113.20 + exit + exit + exit + + device-interface lan-dev + name lan-dev + type ethernet + pci-address 0000:00:07.0 + forwarding true + + network-interface lan1 + name lan1 + global-id 2 + type external + tenant corp + source-nat true + dhcp disabled + + address 10.1.2.1 + ip-address 10.1.2.1 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-route + name internet-route + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + exit + exit + + dns-config static + address 1.1.1.1 + address 8.8.8.8 + exit + exit + exit +exit +``` + +## Interface Summary + +### Hub Router — `aws-hub1` + +| Interface | Device Interface | PCI Address | Type | Configuration | +|-----------|-----------------|-------------|------|---------------| +| `wan1` | `wan-dev` | `0000:00:06.0` | External | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` / topology `hub` / external-nat-address `203.0.113.30` | +| `lan1` | `lan-dev` | `0000:00:07.0` | External | tenant `corp`, static `10.2.2.1/24`, source-nat | + +### Spoke Router — `aws-spoke1` + +| Interface | Device Interface | PCI Address | Type | Configuration | +|-----------|-----------------|-------------|------|---------------| +| `wan1` | `wan-dev` | `0000:00:06.0` | External | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` / topology `spoke` / external-nat-address `203.0.113.20` | +| `lan1` | `lan-dev` | `0000:00:07.0` | External | tenant `corp`, static `10.1.2.1/24`, source-nat | + +## Service Route Summary + +Both routers perform local internet breakout. Each has an identical service route configuration: + +| Router | Service Route | Service | Type | Next Hop | +|--------|--------------|---------|------|---------| +| `aws-hub1` | `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` | +| `aws-spoke1` | `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` | + +## Design Notes + +**Hub-Spoke SVR Peering** — The conductor automatically generates the SVR peer relationship between hub and spoke when both routers are committed with matching neighborhood names (`internet`) and complementary topology roles (`hub` and `spoke`). No manual `peer` stanzas are required. The conductor distributes the hub's `external-nat-address` (`203.0.113.30`) to the spoke so the spoke can initiate SVR sessions toward the hub. + +**AWS NAT and External NAT Address** — AWS performs 1:1 NAT between each Elastic IP and the private IP assigned to the corresponding ENI. The `external-nat-address` setting in the `internet` neighborhood tells the SSR to advertise the Elastic IP to peers rather than the private DHCP address. Without this, SVR peer connections cannot be established because the private IP is not routable from outside the VPC. + +**Distributed Internet Breakout** — Both the hub and spoke perform local internet breakout from their own WAN interfaces. Internet-bound traffic from LAN hosts on the hub (`10.2.2.0/24`) exits through the hub WAN (`203.0.113.30`), and internet-bound traffic from LAN hosts on the spoke (`10.1.2.0/24`) exits through the spoke WAN (`203.0.113.20`). This design minimizes latency and avoids hairpinning internet traffic through a central hub. + +**Management over Forwarding** — Both routers carry conductor management sessions on the same WAN interface used for internet traffic. Management traffic originating from the host OS at `169.254.x.x` link-local addresses is source-NAT'd to the WAN DHCP address before leaving the interface. The `default-route: true` setting ensures Linux routes all outbound OS traffic through the SSR forwarding engine so the auto-generated `management-conductor` service route applies. diff --git a/docs/deploy_aws_conductor.mdx b/docs/deploy_aws_conductor.mdx new file mode 100644 index 0000000000..bfbe52da17 --- /dev/null +++ b/docs/deploy_aws_conductor.mdx @@ -0,0 +1,76 @@ +--- +title: AWS Conductor Deployment Guide +sidebar_label: Overview +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This guide walks a network engineer through deploying a **BYOL Session Smart Conductor on AWS EC2** and connecting it to a managed SSR router. When you have completed the steps in this guide, the conductor EC2 instance will be running SSR 7.1.4, configured with an authority name, conductor address, and the shared services needed to bring a branch router online with internet breakout over the router's WAN forwarding interface. + +## Guide Topics + +| Step | Topic | Description | +|------|-------|-------------| +| 1 | [Launch the Conductor EC2 Instance](deploy_aws_conductor_instance.mdx) | Create the AWS EC2 instance that will host the conductor | +| 2 | [Install SSR 7.1.4 and Initialize the Conductor](deploy_aws_conductor_install.mdx) | Wait for BYOL installation and verify access to the conductor GUI | +| 3 | [Configure the Conductor](deploy_aws_conductor_config.mdx) | Set the authority name, conductor address, tenant, and internet service | +| 4 | [Launch the Router EC2 Instance](deploy_aws_router_instance.mdx) | Create the AWS EC2 instance for the managed router | +| 5 | [Configure the Router on the Conductor](deploy_aws_router_config.mdx) | Define router interfaces, management over forwarding, and internet service route | +| — | [Appendix — AWS Configuration](deploy_appendix_aws_conductor.mdx) | Complete PCLI configuration reference for conductor and router | + +## Network Topology + +```mermaid +graph TD + Internet((Internet)) + subgraph AWS["Amazon Web Services"] + subgraph CondVPC["Conductor VPC — 10.0.0.0/16"] + ConductorEC2["SSR Conductor\n(Conductor)\nPrivate: 10.0.1.10\nElastic IP: 203.0.113.10\nc5.xlarge · SSR 7.1.4"] + end + subgraph RouterVPC["Router VPC — 10.1.0.0/16"] + RouterEC2["SSR Router\n(aws-branch1)\nWAN: DHCP / 203.0.113.20\nLAN: 10.1.2.1/24\nc5.xlarge · SSR 7.1.4"] + end + end + LAN["LAN Devices\n10.1.2.0/24\nTenant: corp"] + + Internet <-->|"HTTPS / GUI"| ConductorEC2 + RouterEC2 <-->|"Internet Breakout\n(Internet-Traffic)"| Internet + RouterEC2 <-->|"Management over Forwarding\nPorts 930 / 4505 / 4506"| ConductorEC2 + LAN <-->|"LAN"| RouterEC2 +``` + +## Roles + +| Device | Type | Role | +|--------|------|------| +| `Conductor` | AWS EC2 (`c5.xlarge`) | Standalone SSR Conductor — centralized management and provisioning | +| `aws-branch1` | AWS EC2 (`c5.xlarge`) | Conductor-managed SSR router with internet breakout | + +## Network Design Reference + + + +## Prerequisites + +Before beginning, ensure the following are available: + +- **AWS account** with permissions to launch EC2 instances, create VPCs and subnets, allocate Elastic IPs, and deploy CloudFormation stacks. +- **Juniper BYOL subscription** — access to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering in the AWS Marketplace. Accept the terms and conditions before deploying. +- **Artifactory credentials** — username and token for the Juniper software repository. These are required for BYOL software installation. + + :::note + Contact your Juniper account team if you do not have Artifactory credentials. + ::: + +- **IAM key pair** — an existing EC2 key pair in the target region for SSH access to both instances. +- **Networking** — a VPC and subnet for the conductor, and a separate VPC (or the same VPC with additional subnets) with at least two subnets for the router (WAN and LAN). The conductor subnet must be reachable from the router's WAN subnet on ports 930, 4505, and 4506. +- **Two Elastic IPs** allocated in your target region: one for the conductor and one for the router WAN interface. + +:::note +BYOL instances require the conductor to run SSR 6.3.0-R1 or later. This guide targets SSR 7.1.4, which meets that requirement. +::: + +## Related Documentation + +- [Deploying AWS Hub and Spoke Routers](deploy_aws_hub_spoke_overview.mdx) — extend your conductor to manage a hub router and one or more spoke routers with SVR peering +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Conductor Deployment Best Practices](bcp_conductor_deployment.md) diff --git a/docs/deploy_aws_conductor_config.mdx b/docs/deploy_aws_conductor_config.mdx new file mode 100644 index 0000000000..6de80839be --- /dev/null +++ b/docs/deploy_aws_conductor_config.mdx @@ -0,0 +1,87 @@ +--- +title: "Step 3: Configure the Conductor" +sidebar_label: "Configure the Conductor" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; +import AuthorityName from './_set_authority_name.md'; +import ConductorAuthority from './_conductor_to_authority.md'; + +This step configures the authority-level settings on the conductor: the authority name, conductor address, corporate tenant, and internet service. These objects are shared across all routers managed by this conductor. + +All steps are performed from the **Conductor GUI** at `https://203.0.113.10` unless otherwise noted. + +## Network Design Reference + + + +## 1. Assign the Conductor's Asset ID + + + +## 2. Set the Authority Name + + + +:::note +Use your organization's name as the authority name (for example, `Authority128`). The authority name cannot be changed after routers have been provisioned without re-onboarding them. +::: + +## 3. Set the Conductor Address + +The conductor address is the IP address that managed routers use to reach this conductor. For an AWS deployment, this must be the **Elastic IP** assigned to the conductor's control ENI — not the private IP — because routers connecting from outside the conductor VPC reach the conductor through the internet. + +1. From the **Authority Settings** page, scroll to **Conductor Addresses** and select **ADD**. +2. In the **New Conductor Address** window, enter `203.0.113.10`. +3. Click **SAVE**. +4. Select **VALIDATE** then **COMMIT**. + +:::important +You must use the Elastic IP (`203.0.113.10`) as the conductor address, not the private IP (`10.0.1.10`). Routers outside the conductor VPC connect to the conductor over the internet using the Elastic IP. +::: + +## 4. Create the Corporate Tenant + +Tenants logically partition the network. The `corp` tenant represents corporate LAN users and is referenced by the LAN interface configuration on each managed router. + +1. In the Conductor GUI, select **Configuration**. +2. Select **Authority**. +3. Scroll to **Tenants** and select **ADD**. +4. Enter the name `corp` and select **SAVE**. +5. Select **VALIDATE** then **COMMIT**. + +:::info +Tenants are authority-wide. A single `corp` tenant definition applies to all routers that assign it to a LAN interface. +::: + +## 5. Create the `Internet-Traffic` Service + +The service configuration element defines the IP destinations that the SSR routes. This step creates a service representing all internet-bound traffic from corporate LAN users. + +1. In the Conductor GUI, select **Configuration**. +2. Select **Authority** from the left panel. +3. Scroll down to **Services** and select **ADD**. +4. Enter the name `Internet-Traffic` and select **SAVE**. +5. On the Service screen, verify **Enabled** is set to `true`. +6. Scroll down to **Service Addresses** and select **ADD**. +7. Enter `0.0.0.0/0` and select **SAVE**. +8. Scroll down to **Access Policy** and select **ADD**. + - Set **Source** to `corp`. + - Select **SAVE**. +9. Select **VALIDATE** then **COMMIT**. + +## What Was Configured + +At the end of this step, your authority contains: + +| Object | Name | Value | +|--------|------|-------| +| Authority | `Authority128` | | +| Conductor Address | | `203.0.113.10` (Elastic IP) | +| Tenant | `corp` | LAN-side user population | +| Service | `Internet-Traffic` | `0.0.0.0/0`, access from `corp` | + +The conductor is now ready to accept router onboarding. + +## Next Step + +Proceed to [Step 4 — Launch the Router EC2 Instance](deploy_aws_router_instance.mdx). diff --git a/docs/deploy_aws_conductor_install.mdx b/docs/deploy_aws_conductor_install.mdx new file mode 100644 index 0000000000..c424b8d637 --- /dev/null +++ b/docs/deploy_aws_conductor_install.mdx @@ -0,0 +1,102 @@ +--- +title: "Step 2: Install SSR 7.1.4 and Initialize the Conductor" +sidebar_label: "Install and Initialize" +--- + +This step confirms that the BYOL SSR software installation has completed successfully and verifies access to the conductor GUI. If you deployed using the CloudFormation template with all required parameters (SSR version and Artifactory credentials), the software is installed and the conductor role is initialized automatically — no manual commands are required. + +## Wait for Software Installation + +After the CloudFormation stack reaches **CREATE_COMPLETE**, the EC2 instance downloads and installs SSR 7.1.4 via the BYOL process. This takes approximately **10–15 minutes**. + +You can monitor progress by connecting to the instance over SSH: + +1. SSH to the EC2 instance using the SSH command from the CloudFormation Outputs tab: + + ```bash + ssh -i t128@203.0.113.10 + ``` + +2. Follow the hardware bootstrapper log to observe installation progress: + + ```bash + sudo journalctl -u 128T-hardware-bootstrapper -f + ``` + +3. When you see output indicating that SSR installation is complete and the system is initializing, the instance will reboot automatically. Wait for it to come back online before proceeding. + +:::note +If the device does not initialize as expected within 20 minutes, SSH into the instance and examine `/var/log/128T-hardware-bootstrapper/hardware-bootstrapper-tech-support.zip` for diagnostic information. +::: + +## Verify the Conductor Is Running + +After the reboot, confirm that SSR is running: + +1. SSH back to the instance: + + ```bash + ssh -i t128@203.0.113.10 + ``` + +2. Enter the SSR CLI: + + ```bash + su admin + ``` + +3. Run `show system`. When **Status** returns `running`, the conductor is ready: + + ```text + admin@node0.Conductor# show system + ... + Status: running + ``` + +## Access the Conductor GUI + +1. Open a web browser and navigate to the HTTPS URL from the CloudFormation Outputs tab: + + ``` + https://203.0.113.10 + ``` + + Accept the self-signed certificate warning to proceed. + +2. Log in with the default credentials: + - **Username:** `admin` + - **Password:** `128Tadmin` + + :::important + Change the default password immediately after first login. Navigate to the account icon in the top-right corner and select **Change Password**. The new password must be at least 9 characters and include one uppercase letter, one lowercase letter, and one number. + ::: + +3. A successful login confirms the conductor is running and reachable on the network. + +## Manual Onboarding (Without CloudFormation) + +If you launched the EC2 instance without using the CloudFormation template, or without providing Artifactory credentials in the template, complete onboarding manually: + +1. SSH to the instance using `ec2-user` and your IAM key: + + ```bash + ssh -i ec2-user@203.0.113.10 + ``` + +2. Run the hardware bootstrapper configuration generator: + + ```bash + sudo /usr/libexec/hardwareBootstrapper128t config-generator + ``` + +3. Follow the interactive prompts. When asked, provide: + - Conductor name: `Conductor` + - SSR version: `7.1.4` + - Artifactory username and token + - Mode: `conductor` + +4. The instance reboots automatically after onboarding completes. + +## Next Step + +Proceed to [Step 3 — Configure the Conductor](deploy_aws_conductor_config.mdx). diff --git a/docs/deploy_aws_conductor_instance.mdx b/docs/deploy_aws_conductor_instance.mdx new file mode 100644 index 0000000000..0bd0ebb975 --- /dev/null +++ b/docs/deploy_aws_conductor_instance.mdx @@ -0,0 +1,137 @@ +--- +title: "Step 1: Launch the Conductor EC2 Instance" +sidebar_label: "Launch the Conductor Instance" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This step launches the AWS EC2 instance that will host the SSR Conductor. The BYOL CloudFormation template creates the EC2 instance, its security group, and an Elastic IP association in a single stack. Once the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins automatically. + +## Network Design Reference + + + +## Conductor Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | Scale up for deployments with more than 25 managed routers | +| vCPUs | 8 | | +| Memory | 64 GB | | +| Storage | 256 GB | Default EBS volume provided by the CloudFormation template | +| Network Interfaces | 1 × ENI | Connected to the control subnet | + +:::note +Memory requirements should be adjusted based on your network scaling requirements. For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). +::: + +## Infrastructure Requirements + +The following AWS infrastructure must exist before deploying the conductor: + +- A **VPC** in your target region (`10.0.0.0/16` in this guide). +- A **subnet** within the VPC (`10.0.1.0/24`) that is reachable via SSH and HTTPS from your administrative workstation and reachable from the WAN interfaces of the routers this conductor will manage. +- An **Elastic IP** allocated in the same region. + +## Deploy the Conductor Using CloudFormation + +The BYOL CloudFormation template is the recommended deployment method. It creates the EC2 instance, attaches the security group, and installs SSR automatically. + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters using the following table as a guide: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `Conductor` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | Juniper repository access | + | Artifactory Token | _(your token)_ | Juniper repository access token | + | VPC ID | ID of the conductor VPC | | + | Control Subnet ID | ID of the `10.0.1.0/24` subnet | | + | Control Subnet Allowed CIDR | `0.0.0.0/0` | Restrict to known router WAN CIDRs after deployment | + | Admin Allowed CIDR | `/32` | Source IP(s) allowed for SSH and HTTPS | + | Key Name | Your EC2 key pair name | | + + For a full description of all template parameters, see [BYOL Conductor Template Parameters](intro_installation_byol_aws_conductor.md#launch-the-conductor-template). + + ![CloudFormation Template](/img/aws-byol-conductor-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +9. After the stack reaches **CREATE_COMPLETE**, open the **Outputs** tab and record: + - The **public IP address** of the control interface — this is the conductor Elastic IP (`203.0.113.10` in the network design example). + - The **HTTPS URL** for the conductor GUI. + - The **SSH command** to log in to the Linux instance. + + :::important + After deployment is complete, update the **Control Subnet Allowed CIDR** and **Admin Allowed CIDR** security group rules to restrict access to known source IP addresses. Leaving these open to `0.0.0.0/0` exposes the management interface to the internet. + ::: + +### Associate the Elastic IP + +If the CloudFormation template did not allocate a static Elastic IP, manually associate one now: + +1. In the EC2 console, navigate to **Elastic IPs** and allocate a new address. +2. Select the address and click **Actions → Associate Elastic IP Address**. +3. Select the conductor EC2 instance and click **Associate**. + +Record the Elastic IP. This is the conductor address that all managed routers use to connect (`203.0.113.10` in this guide). + +### AWS CLI (Optional) + +To launch the conductor template from the command line, follow the [AWS CLI deployment steps](intro_installation_byol_aws_conductor.md#using-the-aws-cli). + +### Cloud-Init Onboarding (Optional) + +If you are launching the instance outside of the CloudFormation template — for example, from a custom automation pipeline — you can supply the following user-data to automate conductor initialization: + +```yaml +#cloud-config +write_files: + - path: /etc/128T-hardware-bootstrapper/onboarding-config.json + content: | + { + "name": "Conductor", + "ssr-version": "7.1.4", + "mode": "conductor", + "artifactory-user": "", + "artifactory-password": "", + "node-name": "node0", + "cloud-provider": "aws" + } +``` + +| Option | Meaning | +|--------|---------| +| `name` | Name of the conductor instance. | +| `ssr-version` | SSR software version to install. | +| `mode` | Set to `conductor` for conductor deployments. | +| `artifactory-user` | User portion of your Artifactory credentials. | +| `artifactory-password` | Token portion of your Artifactory credentials. | +| `node-name` | Node name. Use `node0` for a standalone conductor. | +| `cloud-provider` | Set to `aws`. | + +## What Was Deployed + +After the CloudFormation stack completes, the following resources exist in your AWS account: + +| Resource | Description | +|----------|-------------| +| EC2 instance | `Conductor` — `c5.xlarge`, running the BYOL SSR image | +| Security group | Allows inbound SSH (22), HTTPS (443), and router management ports (930, 4505, 4506) | +| Elastic IP | Assigned to the conductor's control ENI (`203.0.113.10`) | + +The BYOL software installation begins immediately after the EC2 instance starts. The SSR 7.1.4 installation takes approximately **10–15 minutes** to complete. + +## Next Step + +Proceed to [Step 2 — Install SSR 7.1.4 and Initialize the Conductor](deploy_aws_conductor_install.mdx). diff --git a/docs/deploy_aws_hub_router_config.mdx b/docs/deploy_aws_hub_router_config.mdx new file mode 100644 index 0000000000..9cc70188ef --- /dev/null +++ b/docs/deploy_aws_hub_router_config.mdx @@ -0,0 +1,210 @@ +--- +title: "Step 2: Configure the Hub Router on the Conductor" +sidebar_label: "Configure the Hub Router" +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; + +With the hub router EC2 instance deployed and ZTP-connected to the conductor, you can now configure the full hub router profile. All steps are performed from the **Conductor GUI** at `https://203.0.113.10`. + +:::note +Your conductor must already have the following objects configured before proceeding: + +- **Authority name** — set to your organization's name. +- **Conductor address** — set to `203.0.113.10`. +- **`corp` tenant** — the LAN-side user tenant. +- **`Internet-Traffic` service** — with address `0.0.0.0/0` and access policy permitting `corp`. + +If any of these are missing, complete [Step 3 — Configure the Conductor](deploy_aws_conductor_config.mdx) in the AWS Conductor Deployment Guide first. +::: + +## Network Design Reference + + + +## Create the Hub Router and Associate the Pending Asset + +After the hub router EC2 instance finishes the BYOL installation and ZTPs to the conductor, a pending asset appears in the conductor GUI. Create the router configuration and associate the asset before configuring the interfaces. + +1. Log in to the Conductor GUI. +2. Select **Configuration → Authority**. +3. Scroll to **Routers** and select **ADD**. +4. Enter the name `aws-hub1` and select **SAVE**. +5. Set **Inter-node Security** to `internal`. +6. Under the new router, scroll to **Nodes** and select **ADD**. +7. Enter node name `node0` and select **SAVE**. +8. Set **Role** to `combo`. +9. Under **Associated Asset ID**, select the pending asset that appeared after the hub ZTPed. +10. Select **SAVE**. + +:::note +The pending asset appears in the conductor GUI within 2–3 minutes of the ZTP connection being established. If no asset appears after 20 minutes, SSH into the hub instance and examine the hardware bootstrapper logs for diagnostic information. See [Troubleshooting BYOL Installations](intro_installation_byol_aws_conductor.md#troubleshooting) for guidance. +::: + +## 1. Configure the WAN Interface + +The WAN interface (`eth1` / PCI `0000:00:06.0`) connects to the public subnet, obtains an IP address via DHCP from AWS, and carries both internet forwarding and conductor management traffic via [Management over Forwarding](config_management_over_forwarding.md). The hub declares `topology: hub` in its neighborhood, making it the SVR anchor for the `internet` neighborhood. + +### 1a. Create the WAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `wan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:06.0` | WAN ENI (`eth1`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 1b. Create the WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `v4` | AWS assigns private IPs via DHCP | + | Global-ID | `1` | | + | Conductor | `true` | Enables conductor connectivity over this interface | + | Management | `true` | Enables management over forwarding | + | Default Route | `true` | Routes Linux outbound traffic through the SSR forwarding engine | + | Source NAT | `true` | Required for management over forwarding | + +4. Scroll down to **Management Vector** and select **ADD**. + - Enter name `mgmt-vec-wan` and priority `100`. + - Select **SAVE**. + +5. Scroll down to **Neighborhoods** and select **ADD**. + - Enter the neighborhood name `internet`. + - Set **Topology** to `hub`. + - Scroll to **External NAT Address** and enter `203.0.113.30` (the hub WAN Elastic IP). + - Select **SAVE**. + +:::important +**Topology must be set to `hub`** — this identifies `aws-hub1` as the SVR anchor for the `internet` neighborhood. When you later commit the spoke configuration with `topology: spoke` in the same neighborhood, the conductor automatically generates the SVR peer relationship between the hub and spoke and distributes the hub's external IP (`203.0.113.30`) to the spoke. + +**`external-nat-address` is required** — AWS maps the Elastic IP (`203.0.113.30`) to the private DHCP address on the WAN ENI via 1:1 NAT. Without this setting, the SSR advertises its private IP to peers, which is unreachable from outside the hub VPC. + +**`Conductor`, `Source NAT`, and `Default Route` must all be `true`** — management traffic to the conductor originates from the host OS at `169.254.x.x` link-local addresses. Source NAT translates this to the WAN DHCP address before the packet leaves the interface. The default route ensures Linux routes all outbound traffic through the SSR forwarding engine so the management-conductor service routes apply. +::: + +## 2. Configure the LAN Interface + +The LAN interface (`eth2` / PCI `0000:00:07.0`) connects to the private subnet and assigns the `corp` tenant to all inbound traffic. + +### 2a. Create the LAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `lan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:07.0` | LAN ENI (`eth2`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 2b. Create the LAN Network Interface + +1. Under the LAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `lan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `disabled` | Use a static gateway address on the LAN | + | Global-ID | `2` | | + | Tenant | `corp` | Assigns all LAN traffic to the corp tenant | + | Source NAT | `true` | | + +4. Scroll down to **Interface Addresses** and select **ADD**. + - IP Address: `10.2.2.1` + - Prefix Length: `24` +5. Select **SAVE**. + +## 3. Configure DNS + +Configure DNS so the hub can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level (`aws-hub1`). +2. Scroll to **DNS Config** and select **ADD**. +3. Set **Mode** to `static` and enter the following DNS server addresses: `1.1.1.1` and `8.8.8.8`. +4. Select **SAVE**. + +## 4. Create the Internet Service Route + +The service route directs traffic matched by the `Internet-Traffic` service out through the hub WAN interface as a direct local internet breakout. + +1. Return to the **Router** level. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-route` and select **SAVE**. +4. Set the following fields: + + | Field | Value | + |-------|-------| + | Service Name | `Internet-Traffic` | + | Service Route Type | `service-agent` | + +5. Scroll to **Next Hop** and select **ADD**. + - Node: `node0` + - Network Interface: `wan1` + - Select **SAVE**. + +6. Select **VALIDATE** and **COMMIT**. + +## Configuration Summary + +After committing, the conductor pushes the configuration to `aws-hub1`. The router applies the configuration and comes fully online within approximately 2–5 minutes. + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `aws-hub1` | combo node, associated pending asset | +| WAN Device Interface | `wan-dev` | PCI `0000:00:06.0`, forwarding enabled | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` / topology `hub` / external-nat-address `203.0.113.30` | +| LAN Device Interface | `lan-dev` | PCI `0000:00:07.0`, forwarding enabled | +| LAN Network Interface | `lan1` | tenant `corp`, static `10.2.2.1/24`, source-nat | +| DNS Config | | mode `static`, servers `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-route` | service `Internet-Traffic`, type `service-agent`, next-hop `node0 / wan1` | + +## Verify the Hub Router Is Online + +After committing, verify the hub is running and connected to the conductor. + +1. SSH to the hub instance: + + ```bash + ssh -i t128@203.0.113.30 + ``` + +2. Enter the SSR CLI: + + ```bash + su admin + ``` + +3. Run `show system`. Status should return `running`: + + ```text + admin@node0.aws-hub1# show system + ... + Status: running + ``` + +4. Verify the conductor connection: + + ```text + admin@node0.aws-hub1# show peers + ``` + + The conductor peer should appear with state `Up`. + +## Next Step + +Proceed to [Step 3 — Deploy the Spoke Router Instance](deploy_aws_spoke_router_instance.mdx). diff --git a/docs/deploy_aws_hub_router_instance.mdx b/docs/deploy_aws_hub_router_instance.mdx new file mode 100644 index 0000000000..5361408661 --- /dev/null +++ b/docs/deploy_aws_hub_router_instance.mdx @@ -0,0 +1,117 @@ +--- +title: "Step 1: Deploy the Hub Router Instance" +sidebar_label: "Deploy the Hub Instance" +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; +import PostDeploySteps from './_deploy_aws_router_instance_steps.md'; + +This step launches the AWS EC2 instance for the hub router (`aws-hub1`). The BYOL CloudFormation template creates the instance with three network interfaces, installs SSR 7.1.4, and automatically onboards the router to the conductor via Zero Touch Provisioning (ZTP). + +## Network Design Reference + + + +## Hub Router Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | Scale up for high-throughput hub deployments | +| vCPUs | 8 | | +| Memory | 64 GB | | +| Storage | 256 GB | | +| Network Interfaces | 3 × ENI | Management (OOB), WAN (public), LAN (private) | +| Enhanced Networking | ENA required | Provides maximum throughput performance | + +:::note +Memory requirements should be adjusted based on your network scaling requirements. For guidance on scaling for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). +::: + +## Infrastructure Requirements + +The following infrastructure must exist in your AWS account before deploying the hub router: + +- A **VPC** in your target region (`10.2.0.0/16` in this guide). +- Three **subnets** within the VPC: + + | Subnet | CIDR | Purpose | + |--------|------|---------| + | Management | _(any)_ | OOB SSH to the EC2 instance. Managed by Linux only — not configured in SSR. | + | WAN (public) | `10.2.1.0/24` | Internet-facing, carries both internet forwarding and conductor management over forwarding. | + | LAN (private) | `10.2.2.0/24` | Internal LAN workloads and SVR transit to spoke routers. | + +- An **Elastic IP** allocated in the same region — this is associated with the WAN ENI. Record it as `203.0.113.30` (your ``). + +:::important +The WAN subnet must have a route to the internet and be able to reach the conductor Elastic IP (`203.0.113.10`) on ports 930, 4505, and 4506. The WAN Elastic IP must also be reachable by spoke routers, since they initiate SVR sessions to the hub's external IP. +::: + +## Deploy the Hub Router Using CloudFormation + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor Managed Router** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters using the following table as a guide: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `aws-hub1` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | | + | Artifactory Token | _(your token)_ | | + | Primary Control IP | `203.0.113.10` | Conductor Elastic IP | + | VPC ID | ID of the hub VPC | | + | Management Subnet ID | ID of the management subnet | | + | Public Subnet ID | ID of the WAN subnet (`10.2.1.0/24`) | | + | Public Subnet Allowed CIDR | `0.0.0.0/0` | Restrict to known spoke WAN CIDRs after deployment | + | Private Subnet ID | ID of the LAN subnet (`10.2.2.0/24`) | | + | Private Subnet Allowed CIDR | `10.2.2.0/24` | | + | Admin Allowed CIDR | `/32` | | + | Key Name | Your EC2 key pair name | | + + ![CloudFormation Template](/img/aws-byol-conductor-managed-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +After the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins. Allow **10–15 minutes** for SSR 7.1.4 to install. The router then automatically contacts the conductor at `203.0.113.10` and appears as a pending asset in the conductor GUI. + +## Network Interface Layout + +The CloudFormation template attaches the ENIs to the EC2 instance in the following order when a management subnet is provided: + +| Network Interface | Subnet | PCI Address | Managed By | +|-------------------|--------|-------------|------------| +| `eth0` / `ge-0-0` | Management | `0000:00:05.0` | Linux only — OOB SSH, not configured in SSR | +| `eth1` / `ge-0-1` | WAN (public) | `0000:00:06.0` | SSR — WAN forwarding with management over forwarding | +| `eth2` / `ge-0-2` | LAN (private) | `0000:00:07.0` | SSR — LAN forwarding | + +:::note +These PCI addresses are the default values for EC2 instances deployed with this template. Verify the actual addresses on your instance after SSR is installed by running `sudo dpdk-devbind.py --status` via SSH. +::: + + + +:::note +Record the hub WAN Elastic IP (`203.0.113.30`). You will enter it as the `external-nat-address` in the hub neighborhood configuration in [Step 2](deploy_aws_hub_router_config.mdx). +::: + +## What Was Deployed + +After the CloudFormation stack completes and SSR installs, the following resources exist in your AWS account: + +| Resource | Description | +|----------|-------------| +| EC2 instance | `aws-hub1` — `c5.xlarge`, running the BYOL SSR image | +| Security group | Allows inbound SSH (22), router management ports (930, 4505, 4506), and SVR UDP/TCP (12800–12900) from spoke WAN CIDRs | +| Elastic IP | Assigned to the hub WAN ENI — `203.0.113.30` | + +## Next Step + +Proceed to [Step 2 — Configure the Hub Router on the Conductor](deploy_aws_hub_router_config.mdx). diff --git a/docs/deploy_aws_hub_spoke_overview.mdx b/docs/deploy_aws_hub_spoke_overview.mdx new file mode 100644 index 0000000000..97d8af0309 --- /dev/null +++ b/docs/deploy_aws_hub_spoke_overview.mdx @@ -0,0 +1,112 @@ +--- +title: "Deploying AWS Hub and Spoke Routers" +sidebar_label: Overview +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; + +This guide walks a network engineer through deploying two conductor-managed SSR routers in AWS — a **hub** router that anchors the SVR network and a **spoke** router that peers with the hub — using the Juniper BYOL CloudFormation templates. By the end of the guide, both routers will be running SSR 7.1.4, managed by an existing SSR conductor, peered over SVR in the `internet` neighborhood, and forwarding internet traffic from their local LAN subnets with management returning to the conductor over each router's WAN forwarding interface. + +:::note +This guide assumes a conductor is already installed and running SSR 7.1.4 with authority-level objects configured. If you have not yet deployed a conductor, complete the following guide first: + +- [AWS Conductor Deployment Guide](deploy_aws_conductor.mdx) +::: + +## Guide Topics + +| Step | Topic | Description | +|------|-------|-------------| +| 1 | [Deploy the Hub Router Instance](deploy_aws_hub_router_instance.mdx) | Launch the AWS EC2 instance for the hub router | +| 2 | [Configure the Hub Router on the Conductor](deploy_aws_hub_router_config.mdx) | Create the hub router configuration with hub-topology SVR neighborhood and internet breakout | +| 3 | [Deploy the Spoke Router Instance](deploy_aws_spoke_router_instance.mdx) | Launch the AWS EC2 instance for the spoke router | +| 4 | [Configure the Spoke Router on the Conductor](deploy_aws_spoke_router_config.mdx) | Create the spoke router configuration and verify SVR peering with the hub | +| — | [Appendix — Hub and Spoke Configuration](deploy_appendix_aws_hub_spoke.mdx) | Complete PCLI configuration for both routers | + +## Network Topology + +```mermaid +graph TD + Internet((Internet)) + subgraph AWS["Amazon Web Services"] + subgraph CondVPC["Conductor VPC — 10.0.0.0/16"] + ConductorEC2["SSR Conductor\n(Conductor)\nElastic IP: 203.0.113.10\nc5.xlarge · SSR 7.1.4"] + end + subgraph HubVPC["Hub VPC — 10.2.0.0/16"] + HubEC2["SSR Hub Router\n(aws-hub1)\nWAN EIP: 203.0.113.30\nLAN: 10.2.2.1/24\nc5.xlarge · SSR 7.1.4"] + end + subgraph SpokeVPC["Spoke VPC — 10.1.0.0/16"] + SpokeEC2["SSR Spoke Router\n(aws-spoke1)\nWAN EIP: 203.0.113.20\nLAN: 10.1.2.1/24\nc5.xlarge · SSR 7.1.4"] + end + end + HubLAN["Hub LAN\n10.2.2.0/24\nTenant: corp"] + SpokeLAN["Spoke LAN\n10.1.2.0/24\nTenant: corp"] + + Internet <-->|"HTTPS / GUI (443)"| ConductorEC2 + HubEC2 <-->|"Internet Breakout"| Internet + SpokeEC2 <-->|"Internet Breakout"| Internet + HubEC2 <-->|"Mgmt over Forwarding\n930 / 4505 / 4506"| ConductorEC2 + SpokeEC2 <-->|"Mgmt over Forwarding\n930 / 4505 / 4506"| ConductorEC2 + HubEC2 <-->|"SVR Peering\n(neighborhood: internet)"| SpokeEC2 + HubLAN <-->|"LAN"| HubEC2 + SpokeLAN <-->|"LAN"| SpokeEC2 +``` + +## Roles + +| Device | Type | Role | +|--------|------|------| +| `Conductor` | AWS EC2 (`c5.xlarge`) | Pre-existing conductor — centralized management and provisioning | +| `aws-hub1` | AWS EC2 (`c5.xlarge`) | Hub router — SVR network anchor, local internet breakout | +| `aws-spoke1` | AWS EC2 (`c5.xlarge`) | Spoke router — SVR peer of the hub, local internet breakout | + +## Network Design Reference + + + +## Prerequisites + +Before beginning, ensure the following are available: + +- **Pre-existing conductor** — running SSR 7.1.4 with the following authority-level objects configured: + - Authority name (for example, `Authority128`). + - Conductor address set to the conductor Elastic IP (`203.0.113.10` in this guide). + - `corp` tenant defined. + - `Internet-Traffic` service defined with address `0.0.0.0/0` and access policy permitting `corp`. + + Complete the [AWS Conductor Deployment Guide](deploy_aws_conductor.mdx) before proceeding if any of these are missing. + +- **AWS account** with permissions to launch EC2 instances, create VPCs and subnets, allocate Elastic IPs, and deploy CloudFormation stacks. +- **Juniper BYOL subscription** — access to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering in the AWS Marketplace. Accept the terms and conditions before deploying. +- **Artifactory credentials** — username and token for the Juniper software repository. +- **IAM key pair** — an existing EC2 key pair in the target region for SSH access. +- **Two Elastic IPs** allocated in your target region: one for the hub WAN interface (`203.0.113.30` in this guide) and one for the spoke WAN interface (`203.0.113.20` in this guide). +- **VPC and subnets for each router** — each router requires three subnets in its VPC: a management subnet (OOB SSH), a WAN subnet (public), and a LAN subnet (private). These can be in the same VPC or separate VPCs. + +:::note +BYOL instances require the conductor to run SSR 6.3.0-R1 or later. This guide targets SSR 7.1.4, which meets that requirement. +::: + +## Software Version Requirements + +This guide targets **SSR 7.1.4** on both the hub and spoke routers. + +:::note +The router software version cannot be higher than the conductor software version. Ensure the conductor is already running SSR 7.1.4 before deploying either router. +::: + +## SVR Hub and Spoke Overview + +Secure Vector Routing (SVR) hub-spoke topology is declared per neighborhood. Every router interface that participates in the `internet` neighborhood declares its role: + +- **Hub** — anchors the neighborhood. The hub's external IP is distributed by the conductor to all spoke routers in the same neighborhood so they can initiate SVR sessions toward it. +- **Spoke** — peers with one or more hubs. SVR sessions originate from the spoke toward the hub's external IP. + +The conductor automatically generates and distributes peer information based on the neighborhood topology — no manual peer stanzas are required in the GUI. Both routers must be committed to the same conductor for the conductor to generate the SVR peer relationship. + +In this guide, both the hub and spoke perform **local internet breakout** — each router sends internet-bound traffic out its own WAN interface. SVR peering is established automatically after both router configurations are committed to the conductor. + +## Related Documentation + +- [AWS Conductor Deployment Guide](deploy_aws_conductor.mdx) +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Conductor Deployment Best Practices](bcp_conductor_deployment.md) diff --git a/docs/deploy_aws_router_config.mdx b/docs/deploy_aws_router_config.mdx new file mode 100644 index 0000000000..aef4ff40b1 --- /dev/null +++ b/docs/deploy_aws_router_config.mdx @@ -0,0 +1,183 @@ +--- +title: "Step 5: Configure the Router on the Conductor" +sidebar_label: "Configure the Router" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +With the router EC2 instance deployed and ZTP-connected to the conductor, you can now configure the full router profile. All steps are performed from the **Conductor GUI** at `https://203.0.113.10`. + +:::note +Your conductor must already have the following objects configured before proceeding: + +- **Authority name** — set to your organization's name. +- **Conductor address** — set to `203.0.113.10`. +- **`corp` tenant** — the LAN-side user tenant. +- **`Internet-Traffic` service** — with address `0.0.0.0/0` and access policy permitting `corp`. + +If any of these are missing, complete [Step 3 — Configure the Conductor](deploy_aws_conductor_config.mdx) first. +::: + +## Network Design Reference + + + +## Create the Router and Associate the Pending Asset + +After the router EC2 finishes the BYOL installation and ZTPs to the conductor, a pending asset appears in the conductor GUI. Create the router configuration and associate the asset with it before configuring the interfaces. + +1. Log in to the Conductor GUI. +2. Select **Configuration → Authority**. +3. Scroll to **Routers** and select **ADD**. +4. Enter the name `aws-branch1` and select **SAVE**. +5. Set **Inter-node Security** to `internal`. +6. Under the new router, scroll to **Nodes** and select **ADD**. +7. Enter node name `node0` and select **SAVE**. +8. Set **Role** to `combo`. +9. Under **Associated Asset ID**, select the pending asset that appeared after the router ZTPed. +10. Select **SAVE**. + +:::note +The pending asset appears in the conductor GUI within 2–3 minutes of the ZTP connection being established. If no asset appears after 20 minutes, SSH into the router instance and examine the hardware bootstrapper logs for diagnostic information. See [Troubleshooting BYOL Installations](intro_installation_byol_aws_conductor.md#troubleshooting) for guidance. +::: + +## 1. Configure the WAN Interface + +The WAN interface (`eth1` / PCI `0000:00:06.0`) connects to the public subnet, obtains an IP address via DHCP from AWS, and carries both internet forwarding traffic and conductor management traffic via [Management over Forwarding](config_management_over_forwarding.md). + +### 1a. Create the WAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `wan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:06.0` | WAN ENI (`eth1`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 1b. Create the WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `v4` | AWS assigns private IPs via DHCP | + | Global-ID | `1` | | + | Conductor | `true` | Enables conductor connectivity over this interface | + | Management | `true` | Enables management over forwarding | + | Default Route | `true` | Routes Linux outbound traffic through the SSR forwarding engine | + | Source NAT | `true` | Required for management over forwarding | + +4. Scroll down to **Management Vector** and select **ADD**. + - Enter name `mgmt-vec-wan` and priority `100`. + - Select **SAVE**. + +5. Scroll down to **Neighborhoods** and select **ADD**. + - Enter the neighborhood name `internet`. + - Set **Topology** to `spoke`. + - Scroll to **External NAT Address** and enter `203.0.113.20` (the Elastic IP of the router WAN ENI). + - Select **SAVE**. + +:::important +**Why `external-nat-address` is required:** AWS maps the Elastic IP (`203.0.113.20`) to the private DHCP address on the WAN ENI via 1:1 NAT. Without the `external-nat-address` setting, the SSR advertises its private IP to peers — which is unreachable from the internet. Setting this field tells the SSR to advertise the Elastic IP instead. + +**Why `Conductor`, `Source NAT`, and `Default Route` must all be `true`:** Management traffic to the conductor originates from the host OS at `169.254.x.x` link-local addresses. Source NAT translates this to the WAN DHCP address before the packet leaves the interface. The default route ensures Linux routes all outbound traffic through the SSR forwarding engine so the management-conductor service routes apply. +::: + +## 2. Configure the LAN Interface + +The LAN interface (`eth2` / PCI `0000:00:07.0`) connects to the private subnet and assigns the `corp` tenant to all inbound traffic. + +### 2a. Create the LAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `lan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:07.0` | LAN ENI (`eth2`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 2b. Create the LAN Network Interface + +1. Under the LAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `lan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `disabled` | Use a static gateway address on the LAN | + | Global-ID | `2` | | + | Tenant | `corp` | Assigns all LAN traffic to the corp tenant | + | Source NAT | `true` | | + +4. Scroll down to **Interface Addresses** and select **ADD**. + - IP Address: `10.1.2.1` + - Prefix Length: `24` +5. Select **SAVE**. + +:::note +The LAN interface is configured with a static IP (`10.1.2.1`) so it can act as the default gateway for hosts on the `10.1.2.0/24` subnet. If the router is not acting as the LAN gateway and instead connects to an existing subnet, configure DHCP `v4` on the LAN interface and remove the static address. +::: + +## 3. Configure DNS + +Configure DNS so the router can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level (`aws-branch1`). +2. Scroll to **DNS Config** and select **ADD**. +3. Set **Mode** to `static` and enter the following DNS server addresses: `1.1.1.1` and `8.8.8.8`. +4. Select **SAVE**. + +## 4. Create the Internet Service Route + +The service route directs traffic matched by the `Internet-Traffic` service out through the WAN interface as a direct internet breakout. + +1. Return to the **Router** level. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-route` and select **SAVE**. +4. Set the following fields: + + | Field | Value | + |-------|-------| + | Service Name | `Internet-Traffic` | + | Service Route Type | `service-agent` | + +5. Scroll to **Next Hop** and select **ADD**. + - Node: `node0` + - Network Interface: `wan1` + - Select **SAVE**. + +6. Select **VALIDATE** and **COMMIT**. + +## Configuration Summary + +After committing, the conductor pushes the configuration to `aws-branch1`. The router applies the configuration and comes fully online within approximately 2–5 minutes. + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `aws-branch1` | combo node, associated pending asset | +| WAN Device Interface | `wan-dev` | PCI `0000:00:06.0`, forwarding enabled | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` with external-nat-address `203.0.113.20` | +| LAN Device Interface | `lan-dev` | PCI `0000:00:07.0`, forwarding enabled | +| LAN Network Interface | `lan1` | tenant `corp`, static `10.1.2.1/24` | +| DNS Config | | mode `static`, servers `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-route` | service `Internet-Traffic`, type `service-agent`, next-hop `node0 / wan1` | + +## Related Topics + +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Appendix — AWS Configuration](deploy_appendix_aws_conductor.mdx) +- [Troubleshooting BYOL Installations](intro_installation_byol_aws_conductor.md#troubleshooting) +- [Deploying AWS Hub and Spoke Routers](deploy_aws_hub_spoke_overview.mdx) — add a hub and spoke topology to this conductor diff --git a/docs/deploy_aws_router_instance.mdx b/docs/deploy_aws_router_instance.mdx new file mode 100644 index 0000000000..1b6f656376 --- /dev/null +++ b/docs/deploy_aws_router_instance.mdx @@ -0,0 +1,130 @@ +--- +title: "Step 4: Launch the Router EC2 Instance" +sidebar_label: "Launch the Router Instance" +--- +import NetworkDesign from './_deploy_aws_conductor_network_design.md'; + +This step deploys the AWS EC2 instance for the SSR router. The BYOL CloudFormation template creates the instance with three network interfaces, installs SSR 7.1.4, and automatically onboards the router to the conductor via Zero Touch Provisioning (ZTP). + +## Network Design Reference + + + +## Router Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | | +| vCPUs | 4 | | +| Memory | 8 GB | | +| Storage | 128 GB | | +| Network Interfaces | 3 × ENI | Management (OOB), WAN (public), LAN (private) | +| Enhanced Networking | ENA required | Provides maximum throughput performance | + +## Infrastructure Requirements + +The following infrastructure must exist in your AWS account before deploying the router: + +- A **VPC** in your target region (`10.1.0.0/16` in this guide). +- Three **subnets** within the VPC: + + | Subnet | CIDR | Purpose | + |--------|------|---------| + | Management | _(any)_ | OOB SSH to the EC2 instance. Managed by Linux only — not configured in SSR. | + | WAN (public) | `10.1.1.0/24` | Internet-facing, carries both internet forwarding and conductor management over forwarding. | + | LAN (private) | `10.1.2.0/24` | Internal workloads. | + +- An **Elastic IP** allocated in the same region — this will be associated with the WAN ENI. Record it as `203.0.113.20` (your ``). +- **Enhanced networking** enabled on the instance. If deploying without the CloudFormation template, enable ENA support from your local machine: + + ```bash + aws ec2 modify-instance-attribute --instance-id --ena-support + ``` + +:::important +The WAN subnet must have a route to the internet and be able to reach the conductor Elastic IP (`203.0.113.10`) on ports 930, 4505, and 4506. +::: + +## Deploy the Router Using CloudFormation + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor Managed Router** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `aws-branch1` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | | + | Artifactory Token | _(your token)_ | | + | Primary Control IP | `203.0.113.10` | Conductor Elastic IP | + | VPC ID | ID of the router VPC | | + | Management Subnet ID | ID of the management subnet | | + | Public Subnet ID | ID of the WAN subnet (`10.1.1.0/24`) | | + | Public Subnet Allowed CIDR | `0.0.0.0/0` | Restrict after deployment | + | Private Subnet ID | ID of the LAN subnet (`10.1.2.0/24`) | | + | Private Subnet Allowed CIDR | `10.1.2.0/24` | | + | Admin Allowed CIDR | `/32` | | + | Key Name | Your EC2 key pair name | | + + For a full description of all template parameters, see [BYOL Router Template Parameters](intro_installation_byol_aws_conductor.md#launch-the-conductor-managed-template). + + ![CloudFormation Template](/img/aws-byol-conductor-managed-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +After the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins. Allow **10–15 minutes** for SSR 7.1.4 to install. The router then automatically contacts the conductor at `203.0.113.10` and appears as a pending asset in the conductor GUI. + +## Network Interface Layout + +The CloudFormation template attaches the ENIs to the EC2 instance in the following order when a management subnet is provided: + +| Network Interface | Subnet | PCI Address | Managed By | +|-------------------|--------|-------------|-----------| +| `eth0` / `ge-0-0` | Management | `0000:00:05.0` | Linux only — OOB SSH, not configured in SSR | +| `eth1` / `ge-0-1` | WAN (public) | `0000:00:06.0` | SSR — WAN forwarding with management over forwarding | +| `eth2` / `ge-0-2` | LAN (private) | `0000:00:07.0` | SSR — LAN forwarding | + +:::note +These PCI addresses are the default values for EC2 instances deployed with this template. Verify the actual addresses on your instance after SSR is installed by running `sudo dpdk-devbind.py --status` via SSH. See [Determining the Device Interface Layout](intro_installation_quickstart_aws.md#determine-the-device-interface-layout) for instructions. +::: + +## Disable Source / Destination Check + +AWS enables source/destination checking on all ENIs by default. This check drops packets where the EC2 instance is not the packet source or destination, which prevents the SSR from forwarding any transit traffic. You must disable this check on the **WAN and LAN ENIs**. + +1. In the EC2 console, navigate to **Instances** and select the `aws-branch1` instance. +2. Select the **Networking** tab. +3. Under **Network interfaces**, click on the WAN ENI (second interface, `eth1`). +4. Select **Actions → Change source/destination check**. +5. Select **Stop** and click **Save**. + + ![Source/Destination Check](/img/AWS-bootstrap2.png) + +6. Repeat steps 3–5 for the LAN ENI (`eth2`). + +:::important +Failing to disable source/destination checking prevents the SSR from forwarding any transit traffic. Complete this step before committing the router configuration in [Step 5](deploy_aws_router_config.mdx). +::: + +## Associate the Elastic IP with the WAN Interface + +1. In the EC2 console, navigate to **Elastic IPs**. +2. If you have not already done so, allocate a new Elastic IP. +3. Select the address and click **Actions → Associate Elastic IP Address**. +4. Select the router instance's WAN ENI (`eth1`) and click **Associate**. + +Record this Elastic IP as `203.0.113.20`. You will reference it when configuring the WAN interface neighborhood in [Step 5](deploy_aws_router_config.mdx). + +## Next Step + +Proceed to [Step 5 — Configure the Router on the Conductor](deploy_aws_router_config.mdx). diff --git a/docs/deploy_aws_spoke_router_config.mdx b/docs/deploy_aws_spoke_router_config.mdx new file mode 100644 index 0000000000..b9c8daed30 --- /dev/null +++ b/docs/deploy_aws_spoke_router_config.mdx @@ -0,0 +1,208 @@ +--- +title: "Step 4: Configure the Spoke Router on the Conductor" +sidebar_label: "Configure the Spoke Router" +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; + +With the spoke router EC2 instance deployed and ZTP-connected to the conductor, you can now configure the full spoke router profile. All steps are performed from the **Conductor GUI** at `https://203.0.113.10`. + +:::note +The hub router (`aws-hub1`) must already be configured and committed before you commit the spoke configuration. The conductor uses the hub's `external-nat-address` (`203.0.113.30`) to generate the SVR peer relationship and distribute it to the spoke after commit. +::: + +## Network Design Reference + + + +## Create the Spoke Router and Associate the Pending Asset + +1. Log in to the Conductor GUI. +2. Select **Configuration → Authority**. +3. Scroll to **Routers** and select **ADD**. +4. Enter the name `aws-spoke1` and select **SAVE**. +5. Set **Inter-node Security** to `internal`. +6. Under the new router, scroll to **Nodes** and select **ADD**. +7. Enter node name `node0` and select **SAVE**. +8. Set **Role** to `combo`. +9. Under **Associated Asset ID**, select the pending asset for `aws-spoke1`. +10. Select **SAVE**. + +:::note +Two pending assets should be visible in the conductor GUI — one for `aws-hub1` (which you associated in Step 2) and one for `aws-spoke1`. Select the asset that appeared after deploying the spoke instance. If you are unsure which is which, check the asset's reported IP address against the spoke WAN Elastic IP (`203.0.113.20`). +::: + +## 1. Configure the WAN Interface + +The WAN interface (`eth1` / PCI `0000:00:06.0`) connects to the public subnet, obtains an IP address via DHCP from AWS, and carries both internet forwarding and conductor management traffic via [Management over Forwarding](config_management_over_forwarding.md). The spoke declares `topology: spoke` in the `internet` neighborhood, causing the conductor to generate an SVR peer relationship toward the hub. + +### 1a. Create the WAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `wan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:06.0` | WAN ENI (`eth1`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 1b. Create the WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `v4` | AWS assigns private IPs via DHCP | + | Global-ID | `1` | | + | Conductor | `true` | Enables conductor connectivity over this interface | + | Management | `true` | Enables management over forwarding | + | Default Route | `true` | Routes Linux outbound traffic through the SSR forwarding engine | + | Source NAT | `true` | Required for management over forwarding | + +4. Scroll down to **Management Vector** and select **ADD**. + - Enter name `mgmt-vec-wan` and priority `100`. + - Select **SAVE**. + +5. Scroll down to **Neighborhoods** and select **ADD**. + - Enter the neighborhood name `internet`. + - Set **Topology** to `spoke`. + - Scroll to **External NAT Address** and enter `203.0.113.20` (the spoke WAN Elastic IP). + - Select **SAVE**. + +:::important +**Topology must be set to `spoke`** and the neighborhood name must be `internet` — the same name used on the hub router. The conductor matches routers by neighborhood name to build the SVR peer relationship. When you commit this configuration, the conductor automatically generates the peer entry pointing the spoke at the hub's external IP (`203.0.113.30`). + +**`external-nat-address` is required** — AWS maps the spoke Elastic IP (`203.0.113.20`) to the private DHCP address on the WAN ENI via 1:1 NAT. Without this setting, the SSR advertises its private IP to the hub, which cannot reach it from outside the spoke VPC. +::: + +## 2. Configure the LAN Interface + +The LAN interface (`eth2` / PCI `0000:00:07.0`) connects to the private subnet and assigns the `corp` tenant to all inbound traffic. + +### 2a. Create the LAN Device Interface + +1. Under the node (`node0`), scroll to **Device Interfaces** and select **ADD**. +2. Enter the name `lan-dev` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `ethernet` | | + | PCI Address | `0000:00:07.0` | LAN ENI (`eth2`) | + | Forwarding | `true` | | + +4. Select **SAVE**. + +### 2b. Create the LAN Network Interface + +1. Under the LAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `lan1` and select **SAVE**. +3. Set the following fields: + + | Field | Value | Notes | + |-------|-------|-------| + | Type | `external` | | + | DHCP | `disabled` | Use a static gateway address on the LAN | + | Global-ID | `2` | | + | Tenant | `corp` | Assigns all LAN traffic to the corp tenant | + | Source NAT | `true` | | + +4. Scroll down to **Interface Addresses** and select **ADD**. + - IP Address: `10.1.2.1` + - Prefix Length: `24` +5. Select **SAVE**. + +## 3. Configure DNS + +Configure DNS so the spoke can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level (`aws-spoke1`). +2. Scroll to **DNS Config** and select **ADD**. +3. Set **Mode** to `static` and enter the following DNS server addresses: `1.1.1.1` and `8.8.8.8`. +4. Select **SAVE**. + +## 4. Create the Internet Service Route + +The service route directs traffic matched by the `Internet-Traffic` service out through the spoke's own WAN interface as a direct local internet breakout. + +1. Return to the **Router** level. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-route` and select **SAVE**. +4. Set the following fields: + + | Field | Value | + |-------|-------| + | Service Name | `Internet-Traffic` | + | Service Route Type | `service-agent` | + +5. Scroll to **Next Hop** and select **ADD**. + - Node: `node0` + - Network Interface: `wan1` + - Select **SAVE**. + +6. Select **VALIDATE** and **COMMIT**. + +## Configuration Summary + +After committing, the conductor pushes the configuration to `aws-spoke1` and generates the SVR peer relationship between `aws-hub1` and `aws-spoke1`. Both routers apply the updated configuration within approximately 2–5 minutes. + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `aws-spoke1` | combo node, associated pending asset | +| WAN Device Interface | `wan-dev` | PCI `0000:00:06.0`, forwarding enabled | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` / topology `spoke` / external-nat-address `203.0.113.20` | +| LAN Device Interface | `lan-dev` | PCI `0000:00:07.0`, forwarding enabled | +| LAN Network Interface | `lan1` | tenant `corp`, static `10.1.2.1/24`, source-nat | +| DNS Config | | mode `static`, servers `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-route` | service `Internet-Traffic`, type `service-agent`, next-hop `node0 / wan1` | + +## Verify SVR Peering Between Hub and Spoke + +After committing, confirm that the spoke has established an SVR session with the hub. + +1. SSH to the spoke instance: + + ```bash + ssh -i t128@203.0.113.20 + ``` + +2. Enter the SSR CLI: + + ```bash + su admin + ``` + +3. Verify the hub peer is reachable: + + ```text + admin@node0.aws-spoke1# show peers + ``` + + The `aws-hub1` peer should appear with state `Up`. + +4. Verify the BFD session is active: + + ```text + admin@node0.aws-spoke1# show bfd + ``` + + The `aws-hub1` entry should show state `Up` with an active BFD session. + +5. Optionally, generate test traffic from a host in the spoke LAN (`10.1.2.0/24`) and confirm internet connectivity: + + ```bash + ping 8.8.8.8 + ``` + + A successful reply confirms internet breakout through the spoke WAN is working. + +## Related Topics + +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Appendix — Hub and Spoke Configuration](deploy_appendix_aws_hub_spoke.mdx) diff --git a/docs/deploy_aws_spoke_router_instance.mdx b/docs/deploy_aws_spoke_router_instance.mdx new file mode 100644 index 0000000000..2d9f364685 --- /dev/null +++ b/docs/deploy_aws_spoke_router_instance.mdx @@ -0,0 +1,107 @@ +--- +title: "Step 3: Deploy the Spoke Router Instance" +sidebar_label: "Deploy the Spoke Instance" +--- +import NetworkDesign from './_deploy_aws_hub_spoke_network_design.md'; +import PostDeploySteps from './_deploy_aws_router_instance_steps.md'; + +This step launches the AWS EC2 instance for the spoke router (`aws-spoke1`). The process mirrors [Step 1 — Deploy the Hub Router Instance](deploy_aws_hub_router_instance.mdx), using the same BYOL CloudFormation template with spoke-specific parameter values. + +## Network Design Reference + + + +## Spoke Router Instance Requirements + +| Resource | Minimum Value | Notes | +|----------|---------------|-------| +| Instance Type | `c5.xlarge` | | +| vCPUs | 8 | | +| Memory | 64 GB | | +| Storage | 256 GB | | +| Network Interfaces | 3 × ENI | Management (OOB), WAN (public), LAN (private) | +| Enhanced Networking | ENA required | Provides maximum throughput performance | + +## Infrastructure Requirements + +The following infrastructure must exist in your AWS account before deploying the spoke router: + +- A **VPC** in your target region (`10.1.0.0/16` in this guide). This can be the same VPC as the hub or a separate one. +- Three **subnets** within the VPC: + + | Subnet | CIDR | Purpose | + |--------|------|---------| + | Management | _(any)_ | OOB SSH to the EC2 instance. Managed by Linux only — not configured in SSR. | + | WAN (public) | `10.1.1.0/24` | Internet-facing, carries both internet forwarding and conductor management over forwarding. SVR sessions to the hub originate from this interface. | + | LAN (private) | `10.1.2.0/24` | Internal workloads. | + +- An **Elastic IP** allocated in the same region — this is associated with the WAN ENI. Record it as `203.0.113.20` (your ``). + +:::important +The spoke WAN subnet must have a route to the internet, be able to reach the conductor Elastic IP (`203.0.113.10`) on ports 930, 4505, and 4506, and be able to reach the hub WAN Elastic IP (`203.0.113.30`) on UDP/TCP ports 12800–12900 for SVR sessions. +::: + +## Deploy the Spoke Router Using CloudFormation + +### AWS Console + +1. Navigate to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering. +2. Click **Continue to Subscribe** and accept the terms and conditions. +3. Click **Continue to Configuration**. +4. In the **Fulfillment Option** drop-down, select **CloudFormation Template**, then select the **Juniper Session Smart Conductor Managed Router** template. +5. Select your target AWS region and click **Continue to Launch**. +6. In the **Choose Action** box, select **Launch CloudFormation** and click **Launch**. +7. Fill in the template parameters using the following table as a guide: + + | Parameter | Example Value | Notes | + |-----------|---------------|-------| + | Name | `aws-spoke1` | EC2 instance name | + | Instance Type | `c5.xlarge` | | + | SSR Version | `7.1.4` | | + | Artifactory Username | _(your username)_ | | + | Artifactory Token | _(your token)_ | | + | Primary Control IP | `203.0.113.10` | Conductor Elastic IP | + | VPC ID | ID of the spoke VPC | | + | Management Subnet ID | ID of the management subnet | | + | Public Subnet ID | ID of the WAN subnet (`10.1.1.0/24`) | | + | Public Subnet Allowed CIDR | `0.0.0.0/0` | Restrict after deployment | + | Private Subnet ID | ID of the LAN subnet (`10.1.2.0/24`) | | + | Private Subnet Allowed CIDR | `10.1.2.0/24` | | + | Admin Allowed CIDR | `/32` | | + | Key Name | Your EC2 key pair name | | + + ![CloudFormation Template](/img/aws-byol-conductor-managed-template.png) + +8. Click **Next**, review the stack settings, then click **Create Stack**. + + ![Deployment Complete](/img/platforms_aws_deployment_complete.png) + +After the stack reaches **CREATE_COMPLETE**, the BYOL software installation begins. Allow **10–15 minutes** for SSR 7.1.4 to install. The router then automatically contacts the conductor at `203.0.113.10` and appears as a second pending asset in the conductor GUI. + +## Network Interface Layout + +| Network Interface | Subnet | PCI Address | Managed By | +|-------------------|--------|-------------|------------| +| `eth0` / `ge-0-0` | Management | `0000:00:05.0` | Linux only — OOB SSH, not configured in SSR | +| `eth1` / `ge-0-1` | WAN (public) | `0000:00:06.0` | SSR — WAN forwarding with management over forwarding | +| `eth2` / `ge-0-2` | LAN (private) | `0000:00:07.0` | SSR — LAN forwarding | + + + +:::note +Record the spoke WAN Elastic IP (`203.0.113.20`). You will enter it as the `external-nat-address` in the spoke neighborhood configuration in [Step 4](deploy_aws_spoke_router_config.mdx). +::: + +## What Was Deployed + +After the CloudFormation stack completes and SSR installs, the following resources exist in your AWS account: + +| Resource | Description | +|----------|-------------| +| EC2 instance | `aws-spoke1` — `c5.xlarge`, running the BYOL SSR image | +| Security group | Allows inbound SSH (22), router management ports (930, 4505, 4506), and SVR traffic from the hub WAN CIDR | +| Elastic IP | Assigned to the spoke WAN ENI — `203.0.113.20` | + +## Next Step + +Proceed to [Step 4 — Configure the Spoke Router on the Conductor](deploy_aws_spoke_router_config.mdx). diff --git a/docs/deploy_guides_overview.md b/docs/deploy_guides_overview.md index 3c94da380d..a57a04cf62 100644 --- a/docs/deploy_guides_overview.md +++ b/docs/deploy_guides_overview.md @@ -5,8 +5,8 @@ sidebar_label: Overview Conductor and Router Deployment Guides are provided to help walk a network engineer through the steps required to stand up a conductor-managed SSR network. -Conductor deployments currently include VMware ESXi. In this guide the conductor will have a configuration ready for a branch router to onboard and come online, managed by the conductor, forwarding internet traffic for LAN users, and reachable by the conductor over the same WAN interface used for internet breakout. +Conductor deployments include VMware ESXi and AWS EC2 (BYOL). Each guide walks through the conductor deployment from instance creation to a working configuration with a managed router that forwards internet traffic for LAN users and reaches the conductor over the same WAN interface used for internet breakout. -Router deployments are currently under development. +Router deployment guides are available for VMware ESXi and AWS EC2 (BYOL). The VMware Router guide covers a single conductor-managed branch router on ESXi. The AWS Hub and Spoke guide covers deploying a hub router and a spoke router in AWS EC2, with SVR peering between them and local internet breakout at each site. The deployment guides are intended to be used independently of one another, allowing you to mix and match conductor and router platforms. \ No newline at end of file diff --git a/docs/deploy_vmware_conductor_vm.mdx b/docs/deploy_vmware_conductor_vm.mdx index 0642a736b1..c5391bd016 100644 --- a/docs/deploy_vmware_conductor_vm.mdx +++ b/docs/deploy_vmware_conductor_vm.mdx @@ -18,7 +18,7 @@ This step creates the VMware ESXi virtual machine that will host the SSR conduct | Boot Firmware | EFI | UEFI secure boot disabled | :::note -For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). +Memory requirements should be adjusted based on your network scaling requirements. For guidance on scaling the conductor for larger deployments, see [Conductor Scaling Recommendations](intro_system_reqs.md#conductor-scaling-recommendations). ::: diff --git a/docs/intro_system_reqs.md b/docs/intro_system_reqs.md index 89a9742355..fcbde1b954 100644 --- a/docs/intro_system_reqs.md +++ b/docs/intro_system_reqs.md @@ -24,7 +24,7 @@ Server grade CPU such as Intel Xeon or AMD EPYC must be used. Hyperthreading (Intel) or Symmetric Multi-Threading (AMD) must be enabled on Conductor platforms. -| Number of managed routers | Physical Cores | Threads | Memory | +| Number of Managed Routers | Physical Cores | Threads | Memory | | ------------------------- | -------------- | ------- | ------ | | 1 to 10 | 2 Xeon | 4 | 8 GB | | 1 to 25 | 4 Xeon | 8 | 8 GB | diff --git a/sidebars.js b/sidebars.js index 74477d9301..c29125e8eb 100644 --- a/sidebars.js +++ b/sidebars.js @@ -207,6 +207,19 @@ module.exports = { "deploy_appendix_vmware_conductor", ], }, + { + "type": "category", + "label": "AWS Conductor", + "items": [ + "deploy_aws_conductor", + "deploy_aws_conductor_instance", + "deploy_aws_conductor_install", + "deploy_aws_conductor_config", + "deploy_aws_router_instance", + "deploy_aws_router_config", + "deploy_appendix_aws_conductor", + ], + }, ], }, { @@ -225,6 +238,18 @@ module.exports = { "deploy_appendix_vmware_router", ], }, + { + "type": "category", + "label": "AWS Hub and Spoke Routers", + "items": [ + "deploy_aws_hub_spoke_overview", + "deploy_aws_hub_router_instance", + "deploy_aws_hub_router_config", + "deploy_aws_spoke_router_instance", + "deploy_aws_spoke_router_config", + "deploy_appendix_aws_hub_spoke", + ], + }, ], }, ],