diff --git a/docs/_deploy_azure_conductor_to_authority.md b/docs/_deploy_azure_conductor_to_authority.md index 7fccf3c031..508c8c10fa 100644 --- a/docs/_deploy_azure_conductor_to_authority.md +++ b/docs/_deploy_azure_conductor_to_authority.md @@ -6,13 +6,11 @@ Take this opportunity to log into the Conductor GUI to complete the following op 1. Select the **Conductor** from the Authority menu on the left side of the GUI. - ![Configuration menu](/img/config_menu_gui.png) - -2. Select the **Configure** icon. +2. In the **Node** panel, select the **Configure** icon. ![Conductor Configuration Icon](/img/conductor_config_icon.png) -3. In the Node panel, under **Associated Asset ID**, select the hostname for the conductor. +3. In the Node Basic Information panel, under **Associated Asset ID**, enter the hostname for the conductor. ![Asset ID](/img/dep-conductor_asset-id.png) diff --git a/docs/_set_authority_name.md b/docs/_set_authority_name.md index 04c89a0f76..9bd0879773 100644 --- a/docs/_set_authority_name.md +++ b/docs/_set_authority_name.md @@ -6,7 +6,7 @@ The authority represents the complete set of all SSRs managed under a single org ![Up arrow](/img/deploy-up-arrow.png) -2. Select the Authority Settings. +2. Select the Authority tile. ![Authority Settings](/img/conductor_authority_name.png) diff --git a/docs/_set_conductor_ip.md b/docs/_set_conductor_ip.md index 2458064057..f6fee8c843 100644 --- a/docs/_set_conductor_ip.md +++ b/docs/_set_conductor_ip.md @@ -1,10 +1,10 @@ -1. Under Conductor Addresses, select ADD. +1. Under Authority Settings, scroll down to **Conductor Addresses** and select **ADD**. 2. In the **New Conductor Address** window, enter the conductor public IP address, `192.168.100.10`. ![Conductor Address](/img/conductor_address.png) -3. Click Validate and Commit. Warnings will appear, advising you of the change. +3. Select **VALIDATE** then **COMMIT**. Warnings will appear, advising you of the change. The steps during initialization setup the management IP. The conductor IP address is the public IP address to which the managed routers connect. It is not necessary to manually associate this IP address with a network interface; the interactions between the SSR software and Linux will identify and assign the IP address to the network interface. \ No newline at end of file diff --git a/docs/deploy_appendix_azure_hub_spoke.mdx b/docs/deploy_appendix_azure_hub_spoke.mdx new file mode 100644 index 0000000000..b6919f5bd5 --- /dev/null +++ b/docs/deploy_appendix_azure_hub_spoke.mdx @@ -0,0 +1,288 @@ +--- +title: "Appendix: Azure Hub and Spoke Configuration" +sidebar_label: "Appendix: Hub and Spoke Config" +--- +import NetworkDesign from './_deploy_azure_hub_spoke_network_design.md'; + +This appendix contains the complete SSR PCLI configuration for the `azure-hub-router` and `azure-spoke-router` deployments described in this guide. This configuration reflects the final state after completing all steps through [Step 4 — Configure Hub and Spoke Routers](deploy_azure_hub_spoke_config.mdx). + +:::important +Replace all placeholder values (shown in angle brackets) with values from your environment before applying: + +- `` — public IP of the conductor VM. +- `` — VMBus UUID of the conductor management interface (found in `devicemap.json` on the conductor VM). +- `` — VMBus UUID of the hub router WAN NIC (`ge-0-0`). +- `` — VMBus UUID of the hub router LAN NIC (`ge-0-1`). +- `` — VMBus UUID of the spoke router WAN NIC (`ge-0-0`). +- `` — VMBus UUID of the spoke router LAN NIC (`ge-0-1`). +::: + +## Network Design Reference + + + +## Applying This Configuration + +This configuration can be applied to the conductor using the PCLI import function. + +1. Save the configuration below to a file — for example, `azure-hub-spoke.cfg`. + +2. Copy the file to the conductor: + + ``` + scp -i azure-hub-spoke.cfg t128@:/tmp/ + ``` + +3. Log in to the conductor PCLI: + + ``` + ssh -i t128@ + su admin + ``` + +4. Enter configuration mode and import: + + ``` + admin@node0.Conductor# import config /tmp/azure-hub-spoke.cfg + ``` + +5. Review any validation warnings, then commit: + + ``` + admin@node0.Conductor (config)# commit + Are you sure you want to commit the candidate config? [y/N]: y + ``` + +Alternatively, you may copy and paste each block into the PCLI while in `configure` → `edit` mode. + +:::note +The authority-level objects the routers depend on (`hub-corp` tenant, `spoke-corp` tenant, `Internet-Traffic` service, authority name, and conductor address) are included in the configuration block below. If your conductor already has an `Internet-Traffic` service or other conflicting objects, reconcile those before importing. +::: + +## Complete Configuration + +``` +config + authority + conductor-address + + router conductor-1 + name conductor-1 + + node node0 + name node0 + asset-id conductor-1 + platform-type "Virtual Machine" + exit + exit + + router ssr-router-2 + name ssr-router-2 + inter-node-security internal + + dns-config static + mode static + address 1.1.1.1 + address 8.8.8.8 + exit + + node node0 + name node0 + asset-id ssr-router-2 + role combo + platform-type "Virtual Machine" + + device-interface wan-dev + name wan-dev + vmbus-uuid 00224879-yourvmbusuuidhere + + network-interface wan1 + name wan1 + global-id 1 + conductor true + default-route true + + neighborhood internet + name internet + exit + inter-router-security internal + source-nat true + + host-service ssh + service-type ssh + + access-policy 0.0.0.0/0 + source 0.0.0.0/0 + exit + exit + management true + + management-vector + name mgmt-vec-wan + priority 100 + exit + dhcp v4 + exit + exit + + device-interface lan-dev + name lan-dev + vmbus-uuid 00224879-yourvmbusuuidhere + + network-interface lan1 + name lan1 + global-id 2 + tenant spoke-corp + source-nat true + + address 10.8.2.5 + ip-address 10.8.2.5 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-via-hub + name internet-via-hub + service-name Internet-Traffic + peer ssr-hub-router-1 + exit + exit + + router ssr-hub-router-1 + name ssr-hub-router-1 + inter-node-security internal + + dns-config static + mode static + address 1.1.1.1 + address 8.8.8.8 + exit + + node node0 + name node0 + asset-id ssr-hub-router-1 + role combo + platform-type "Virtual Machine" + + device-interface wan-dev + name wan-dev + vmbus-uuid 002248be-yourvmbusuuidhere + + network-interface wan1 + name wan1 + global-id 3 + conductor true + default-route true + + neighborhood internet + name internet + topology hub + exit + inter-router-security internal + source-nat true + + host-service ssh + service-type ssh + + access-policy 0.0.0.0/0 + source 0.0.0.0/0 + exit + exit + management true + + management-vector + name mgmt-vec-wan + priority 100 + exit + dhcp v4 + exit + exit + + device-interface lan-dev + name lan-dev + vmbus-uuid 002248be-yourvmbusuuidhere + + network-interface lan1 + name lan1 + global-id 4 + tenant hub-corp + source-nat true + + address 10.8.6.4 + ip-address 10.8.6.4 + prefix-length 24 + exit + exit + exit + exit + + service-route internet-breakout + name internet-breakout + service-name Internet-Traffic + + next-hop node0 wan1 + node-name node0 + interface wan1 + exit + exit + exit + + tenant hub-corp + name hub-corp + exit + + tenant spoke-corp + name spoke-corp + exit + + service Internet-Traffic + name Internet-Traffic + security internal + address 0.0.0.0/0 + + access-policy hub-corp + source hub-corp + exit + + access-policy spoke-corp + source spoke-corp + exit + exit + exit +exit +``` + +## Interface Summary + +### Hub Router (`azure-hub-router`) + +| Interface | Device Interface | VMBus UUID | Type | Configuration | +|-----------|-----------------|-----------|------|---------------| +| `wan1` | `wan-dev` | `` | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood `internet` topology `hub` | +| `lan1` | `lan-dev` | `` | External | Tenant `hub-corp`, static `10.0.2.1/24`, source-nat | + +### Spoke Router (`azure-spoke-router`) + +| Interface | Device Interface | VMBus UUID | Type | Configuration | +|-----------|-----------------|-----------|------|---------------| +| `wan1` | `wan-dev` | `` | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood `internet` topology `spoke` | +| `lan1` | `lan-dev` | `` | External | Tenant `spoke-corp`, static `10.0.4.1/24`, source-nat | + +## Service Route Summary + +| Router | Service Route | Service | Type | Next Hop | Effect | +|--------|--------------|---------|------|---------|--------| +| `azure-hub-router` | `internet-breakout` | `Internet-Traffic` | `service-agent` | `node0/wan1` | Hub LAN and spoke SVR traffic breaks out directly to the internet. | +| `azure-spoke-router` | `internet-via-hub` | `Internet-Traffic` | `peer` | `azure-hub-router` | Spoke internet traffic is forwarded over the SVR peer path to the hub for breakout. | + +## Traffic Flow Reference + +The following table describes how internet traffic flows in the completed hub-and-spoke network. + +| Source | Destination | Path | +| --- | --- | --- | +| Hub LAN device (10.0.2.x) | Internet | Hub LAN → `hub-corp` tenant → `Internet-Traffic` service → `internet-breakout` route → hub `wan1` → internet | +| Spoke LAN device (10.0.4.x) | Internet | Spoke LAN → `spoke-corp` tenant → `Internet-Traffic` service → `internet-via-hub` peer route → SVR path → hub `wan1` → internet | +| Hub or spoke router | Conductor | Management over forwarding on `wan1` using port 930/4505/4506; management-vector priority 100 on each router's WAN interface | diff --git a/docs/deploy_azure_conductor_config.mdx b/docs/deploy_azure_conductor_config.mdx index 5768b0a832..90ac0788de 100644 --- a/docs/deploy_azure_conductor_config.mdx +++ b/docs/deploy_azure_conductor_config.mdx @@ -37,11 +37,19 @@ If all managed routers reside in the same Azure VNet and communicate over privat Tenants logically partition the network. The `corp` tenant represents corporate LAN users and is referenced by the LAN interface configuration on each managed router. -1. In the Conductor GUI, select **Configuration**. -2. Select **Authority**. -3. Scroll to **Tenants** and select **ADD**. -4. Enter the name `corp` and select **SAVE**. -5. Select **VALIDATE** then **COMMIT**. +1. Under **Configuration** in the left panel, select **Authority**. + +![Select Authority](/img/deploy-azure-select-authority.png) + +2. Scroll to **Tenants** and select **ADD**. + +![Add Tenant](/img/deploy-azure-select-tenant-add.png) + +3. Enter the name `corp` and select **SAVE**. + +![Name Tenant](/img/deploy-azure-newtenant.png) + +4. Select **VALIDATE** then **COMMIT**. :::info Tenants are authority-wide. A single `corp` tenant definition applies to all routers that assign it to a LAN interface. @@ -51,16 +59,40 @@ Tenants are authority-wide. A single `corp` tenant definition applies to all rou The *service* configuration element defines the IP destinations that the SSR routes. This step creates a single service representing all internet-bound traffic from corporate LAN users. -1. In the Conductor GUI, select **Configuration**. -2. Select **Authority** from the left panel. -3. Scroll down to **Services** and select **ADD**. +1. Under **Configuration** in the left panel, select **Authority**. + +![Select Authority](/img/deploy-azure-select-authority.png) + +3. Scroll to **Services** and select **ADD**. + +![Add Service](/img/deploy-azure-hs-services.png) + 4. Enter the name `Internet-Traffic` and select **SAVE**. -5. On the Service screen, verify **Enabled** is set to `true`. -6. Scroll down to **Service Addresses** and select **ADD**. + +![Add Internet Traffic Service](/img/deploy-azure-service-int-traf.png) + +5. Verify **Enabled** is set to `true`. + +![Internet Traffic Service True](/img/deploy-azure-service-int-traf2.png) + +6. Scroll to **Service Addresses** and select **ADD**. + +![Select Service Addresses](/img/deploy-azure-service-int-traf3.png) + 7. Enter `0.0.0.0/0` and select **SAVE**. -8. Scroll down to **Access Policies** and select **ADD**. + +![Address IP](/img/deploy-azure-service-address.png) + +8. Scroll to **Access Policies** and select **ADD**. + +![Add Access policy](/img/deploy-azure-hs-access-policies-select.png) + - Set **Source** to `corp`. + +![Corp Access Policy](/img/deploy-azure-access-policy-corp.png) + - Select **SAVE**. + 9. Select **VALIDATE** then **COMMIT**. ## What Was Configured diff --git a/docs/deploy_azure_hub_spoke_config.mdx b/docs/deploy_azure_hub_spoke_config.mdx new file mode 100644 index 0000000000..6b517aaf85 --- /dev/null +++ b/docs/deploy_azure_hub_spoke_config.mdx @@ -0,0 +1,594 @@ +--- +title: "Step 4: Configure Hub and Spoke Routers" +sidebar_label: "Configure Hub and Spoke Routers" +--- + +This step configures both hub and spoke routers on the conductor. You will first update the authority-level objects to support hub and spoke tenants, then configure each router's WAN interface, LAN interface, and service routes. The hub router provides direct internet breakout; the spoke router routes internet traffic to the hub over an SVR peer path. + +All steps are performed from the **Conductor GUI** at `https://` unless otherwise noted. + +:::note +If you prefer to apply configuration using the PCLI, the complete example configuration is available in the [Appendix](deploy_appendix_azure_hub_spoke.mdx). +::: + +## Part 1: Update Authority-Level Configuration + +The conductor must have the correct tenants and services configured before either router is activated. If you already completed the [Azure Conductor Deployment Guide](deploy_azure_conductor.mdx) and created a `corp` tenant and `Internet-Traffic` service, you can either rename those objects or create new ones as described below. This guide uses separate tenants for hub and spoke users. + +:::note +Your conductor must already have an authority name and conductor address set. If these are not yet configured, complete steps 1–3 of [Configure the Conductor](deploy_azure_conductor_config.mdx) before continuing. +::: + +### 1. Create the Hub Tenant + +The `hub-corp` tenant represents users on the hub router's LAN. + +1. Under **Configuration** in the left panel, select **Authority**. + +![Select Authority](/img/deploy-azure-select-authority.png) + +2. Scroll to **Tenants** and select **ADD**. + +![Add Tenant](/img/deploy-azure-select-tenant-add.png) + +3. Enter the name `hub-corp` and select **SAVE**. + +![Hub tenant](/img/deploy-azure-hs-hub-tenant.png) + +4. Select **VALIDATE** then **COMMIT**. + +### 2. Create the Spoke Tenant + +The `spoke-corp` tenant represents users on the spoke router's LAN. + +1. Return to **Tenants** (click the up arrow next to **Tenant**) and select **ADD**. +2. Enter the name `spoke-corp` and select **SAVE**. + +![Spoke tenant](/img/deploy-azure-hs-spoke-tenant.png) + +3. Select **VALIDATE** then **COMMIT**. + +### 3. Create or Update the `Internet-Traffic` Service + +The `Internet-Traffic` service matches all internet-bound traffic. Both tenants must be granted access so the hub can forward internet traffic for both hub LAN users and spoke LAN users arriving over SVR. + +1. Under **Configuration** in the left panel, select **Authority**. + +![Select Authority](/img/deploy-azure-select-authority.png) + +3. Scroll to **Services** and select **ADD** (or select the existing `Internet-Traffic` service if it already exists). + +![Add Service](/img/deploy-azure-hs-services.png) + +4. Enter the name `Internet-Traffic` and select **SAVE**. + +![Add Internet Traffic Service](/img/deploy-azure-service-int-traf.png) + +5. Verify **Enabled** is set to `true`. + +![Internet Traffic Service True](/img/deploy-azure-service-int-traf2.png) + +6. Scroll to **Service Addresses** and select **ADD**. + +![Select Service Addresses](/img/deploy-azure-service-int-traf3.png) + +7. Enter `0.0.0.0/0` and select **SAVE**. + +![Address IP](/img/deploy-azure-service-address.png) + +8. In the **Access Policy** field, add two entries: + + Scroll to **Access Policy** and select **ADD**. + + ![Add Access policy](/img/deploy-azure-hs-access-policies-select.png) + + - In the New Access Policy window, add **Source:** `hub-corp` and select **SAVE**. + + ![New Policy](/img/deploy-azure-hs-hubcorp-acc-policy.png) + + - Click the up arrow next to **Access Policy**. + - Select **ADD**. + - In the New Access Policy window, add **Source:** `spoke-corp` and select **SAVE**. + + ![New Policy](/img/deploy-azure-hs-spokecorp-acc-policy.png) + +8. Select **VALIDATE** then **COMMIT**. + +:::info +The `spoke-corp` access policy on the `Internet-Traffic` service allows traffic from spoke LAN users to be forwarded by the hub router when it arrives over the SVR peer path. Without this policy, the hub drops spoke-originated internet traffic. +::: + +## Part 2: Configure the Hub Router + +### Add the Hub Router to the Authority + +1. In the Conductor GUI, click on Authority. + + ![Conductor Authority](/img/dep-vmrouter-config-authority.png) + +2. At the top of the list of Routers, select **ADD**. + + ![Add Router](/img/dep-vmrouter-addrouter.png) + +3. Enter the router `azure-hub-router` and click **Save**. + + ![New Router](/img/deploy-azure-newhub-rtr.png) + +4. In the Basic Information screen, under **Inter-node Security Policy**, select `Internal`. + +5. Below the **Basic Info** screen, click **ADD** next to **Nodes**. + +6. The **New Node** dialog is displayed - enter `node0`. + + ![New Node](/img/dep-vmrouter-newnode.png) + +7. Click **Save**. The **Node** screen appears. + +### Assign the Hub Router's Asset ID + +The Asset ID allows the hub and conductor to fully connect, and allows the conductor to configure and control the hub router. + +On the Node screen: +- Under **Associated Asset ID**, select the asset ID reported by the hub router VM. +- Set the Role to `Combo`. + + ![Node Asset ID](/img/deploy-azure-node-basicinfo.png) + +Select **VALIDATE** then **COMMIT**. + +### 1. Configure the Hub WAN Interface + +The WAN interface `ge-0-0` / `ssr-hub-wan`) connects to the internet, obtains a DHCP address, and carries both internet forwarding and conductor management traffic. The neighborhood topology is set to `hub`, which makes this router the internet gateway for spoke routers in the same neighborhood. + +#### 1a. Create the Hub WAN Device Interface + +1. In the Conductor GUI, navigate to the `azure-hub-router` router, then to node `node0`. +2. Scroll to **Device Interfaces** and select **ADD**. +3. Enter the name `wan-dev` and select **SAVE**. + + :::note + To ensure successful onboarding, the `ge-0-0` interface MUST be configured as the WAN device interface. + ::: + + ![Name the WAN Interface](/img/deploy-azure-wan-dev-intf.png) + +4. In the Device Interface window, set the type to `ethernet`. When the **Identifier** field becomes visible, select VMBus UUID from the dropdown, and then enter the ID discovered in [Step 3](deploy_azure_hub_spoke_vmbus.mdx) + + ![Device Interface window](/img/deploy-azure-wan-dev-intf2.png) + +#### 1b. Create the Hub WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. + + ![New Network Interface](/img/deploy-azure-wan-dev-intf3.png) + +3. On the Basic Information screen, set the following fields: + + - Global-ID: `1` + - Type: `external` + - DHCP: `v4` - Azure assigns an IP via DHCP + - Security Policy: **internal** + + ![WAN Basic Info](/img/deploy-azure-wan-dev-intf4.png) + +4. Scroll to Management Traffic Settings and set: + + - Conductor: `true` - Marks the interface for conductor connectivity + - Management Enabled: `true` - Enables management over forwarding + - Management Vector Name: `mgmt-vec-wan` + - Management Vector Priority: `100` + - Default Route: `true` - Linux uses this interface as its default route + + ![Management Vector](/img/deploy-azure-wan-dev-intf5.png) + +5. Scroll down to Network Interface settings, and set **Source NAT** to `true`. This is required for management over forwarding. + + ![Set Source NAT](/img/deploy-azure-wan-dev-intf6.png) + +6. Scroll to **Neighborhoods** and select **ADD**. + - Enter neighborhood name `internet`. + + ![New Neighborhood](/img/deploy-azure-wan-dev-intf7.png) + + - Select **SAVE**. + - Verify **Topology** is set to `hub`. + + ![Topology](/img/deploy-azure-wan-dev-intf8.png) + +:::important +Setting **Topology** to `hub` on the hub router's neighborhood is what distinguishes it from a spoke. The conductor uses this topology to auto-generate adjacencies between the hub and any spoke routers that share the same neighborhood name with topology `spoke`. + +`Conductor`, `Source NAT`, and `Default Route` must all be `true` on the WAN management interface. Management traffic originates from the `169.254.x.x` range and must be source-NAT'd to a routable address before leaving the interface. +::: + +### 2. Configure the Hub LAN Interface + +The LAN interface (`ge-0-1` / `ssr-hub-lan`) connects to the hub private subnet and assigns the `hub-corp` tenant to inbound traffic. + +#### 2a. Create the Hub LAN Device Interface + +1. In the Conductor GUI, navigate to the `azure-hub-router` router, then to node `node0`. +2. Scroll down to **Device Interfaces** and select **ADD**. +3. Enter the name `lan-dev` and select **SAVE**. This adds a physical device name for you to assign your LAN interface. + + ![New LAN](/img/deploy-azure-lan-dev-intf1.png) + +5. In the Device Interface Type Settings window, set the type to `ethernet`. When the **Identifier** field becomes visible, select VMBus UUID from the dropdown, and then enter the ID discovered in [Step 3](deploy_azure_hub_spoke_vmbus.mdx). Set Forwarding to `true`. + +![Device Interface Type](/img/deploy-azure-lan-dev-intf2.png) + +#### 2b. Create the Hub LAN Network Interface + +1. Under the LAN Device Interface, scroll down to **Network Interfaces** and select **ADD**. + + ![Add LAN1](/img/deploy-azure-lan-dev-intf3.png) + +2. Enter the name `lan1` and select **SAVE**. + + ![New Dev Interface](/img/deploy-azure-lan-dev-intf4.png) + +3. On the Basic Information screen, set the following fields: + + - Type: `external` + - Global-ID: `2` + - DHCP: `disabled` + - Tenant: `hub-corp` - Assigns all inbound LAN traffic to the hub-corp tenant + - Security Policy: `internal` + + ![Network Interface](/img/deploy-azure-lan-dev-intf5.png) + +4. Scroll down to Network Interface settings, and set **Source NAT** to `true`. + +5. Scroll to **Interface Addresses** and select **ADD**. + +![Add Intf Address](/img/deploy-azure-lan-dev-intf6.png) + +6. Enter the following IP address and prefix. + + - IP Address: `10.0.2.1` + - Prefix Length: `24` + +![New Intf](/img/deploy-azure-lan-dev-intf7.png) + +### 3. Configure Hub DNS + +Configure DNS so the hub router can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level for `azure-hub-router`. You can either click the up arrow at the top of the screen until you reach the `azure-hub-router` level, or select the down arrow to the right of the Network Interface heading and select the `azure-hub-router`. + +![Navigation](/img/deploy-azure-lan-dev-intf8.png) + +2. Scroll to **DNS Config** and select **ADD**. + +![Interface and DNS addresses](/img/dep-vmrouter-wandev11.png) + +3. In the New DNS Config window, use the Mode dropdown to set the mode to **Static**, and click **SAVE**. + +![DNS Mode](/img/deploy-azure-lan-dev-intf9.png) + +4. In the DNS Server Address section, click ADD. +5. Enter 1.1.1.1 and click SAVE. + +![DNS Server Addresss](/img/deploy-azure-lan-dev-intf10.png) + +6. Click **ADD** again. +7. Enter 8.8.8.8 and click SAVE. + +![DNS Server Addresss List](/img/deploy-azure-lan-dev-intf11.png) + +### 4. Create the Hub Internet Service Route + +The hub routes internet-bound traffic (from both its own LAN users and spoke users arriving over SVR) directly out through its WAN interface. + +1. Return to the **Router** level for `azure-hub-router`. +2. Scroll down to **Service Routes** and select **ADD**. +3. Enter the name `internet-breakout` and select **SAVE**. + +![Service Route Name](/img/deploy-azure-lan-dev-intf12.png) + +4. Under Service Route Information, set the **Service Name** to `Internet-Traffic` + +![Service Route Info](/img/deploy-azure-lan-dev-intf13.png) + +5. Under Service Route Type, select **Service Agent** from the **Type** dropdown. + +![Service Route Details](/img/deploy-azure-lan-dev-intf14.png) + +5. Scroll to **Next Hops** and select **ADD**. + - Node Name: `node0` + - Interface: `wan1` +6. Select **SAVE**. + +![New Next Hop](/img/deploy-azure-lan-dev-intf15.png) + +7. Select **VALIDATE** then **COMMIT**. + +## Part 3: Configure the Spoke Router + +### Add the Spoke Router to the Authority + +1. In the Conductor GUI, click on Authority. + + ![Conductor Authority](/img/dep-vmrouter-config-authority.png) + +2. At the top of the list of Routers, select **ADD**. + + ![Add Router](/img/dep-vmrouter-addrouter.png) + +3. Enter the router `azure-spoke-router` and click **Save**. + + ![New Router](/img/deploy-azure-newspoke-rtr.png) + +4. In the Basic Information screen, under **Inter-node Security Policy**, select `Internal`. + +![Internode Security](/img/deploy-azure-spoke-basic.png) + +5. Below the **Basic Info** screen, click **ADD** next to **Nodes**. + +6. The **New Node** dialog is displayed - enter `node0`. + + ![New Node](/img/dep-vmrouter-newnode.png) + +7. Click **Save**. The **Node** screen appears. + +### Assign the Spoke Router's Asset ID + +The Asset ID allows the hub and conductor to fully connect, and allows the conductor to configure and control the hub router. + +On the Node screen: +- Under **Associated Asset ID**, select the asset ID reported by the spoke router VM. +- Set the Role to `Combo`. + + ![Node Asset ID](/img/deploy-azure-spk-node-basicinfo.png) + +Select **VALIDATE** then **COMMIT**. + +### 1. Configure the Spoke WAN Interface + +The spoke WAN interface (`ge-0-0` / `ssr-spoke-wan`) connects to the internet and carries both conductor management traffic and the SVR underlay path to the hub router. The neighborhood topology is set to `spoke`. + +#### 1a. Create the Spoke WAN Device Interface + +1. Navigate to the `azure-spoke-router` router, then to node `node0`. +2. Scroll to **Device Interfaces** and select **ADD**. +3. Enter the name `wan-dev` and select **SAVE**. + + ![Name the WAN Interface](/img/deploy-azure-wan-dev-intf.png) + +4. In the Device Interface window, set the type to `ethernet`. When the **Identifier** field becomes visible, select VMBus UUID from the dropdown, and then enter the ID discovered in [Step 3](deploy_azure_hub_spoke_vmbus.mdx) + + ![Device Interface window](/img/deploy-azure-wan-dev-intf2.png) + +#### 1b. Create the Spoke WAN Network Interface + +1. Under the WAN Device Interface, scroll to **Network Interfaces** and select **ADD**. +2. Enter the name `wan1` and select **SAVE**. + + ![New Network Interface](/img/deploy-azure-wan-dev-intf3.png) + +3. On the Basic Information screen, set the following fields: + + - Global-ID: `2` + - Type: `external` + - DHCP: `v4` - Azure assigns an IP via DHCP + - Security Policy: **internal** + + ![WAN Basic Info](/img/deploy-azure-spoke-wan-dev-intf4.png) + +4. Scroll to Management Traffic Settings and set: + + - Conductor: `true` - Marks the interface for conductor connectivity + - Management Enabled: `true` - Enables management over forwarding + - Management Vector Name: `mgmt-vec-wan` + - Management Vector Priority: `100` + - Default Route: `true` - Linux uses this interface as its default route + + ![Management Vector](/img/deploy-azure-wan-dev-intf5.png) + +5. Scroll down to Network Interface settings, and set **Source NAT** to `true`. This is required for management over forwarding. + + ![Set Source NAT](/img/deploy-azure-wan-dev-intf6.png) + +6. Scroll to **Neighborhoods** and select **ADD**. + - Enter neighborhood name `internet`. + + ![New Neighborhood](/img/deploy-azure-wan-dev-intf7.png) + + - Select **SAVE**. + - Verify **Topology** is set to `spoke`. + + ![Topology](/img/deploy-azure-spoke-wan-dev-intf8.png) + +6. Select **SAVE**. + +:::important +Setting **Topology** to `spoke` pairs this router with the hub router in the `internet` neighborhood. The conductor auto-generates adjacencies between the two routers when both are committed, enabling the SVR peer path used by the spoke's internet service route. +::: + +### 2. Configure the Spoke LAN Interface + +The LAN interface (`ge-0-1` / `ssr-spoke-lan`) connects to the spoke private subnet and assigns the `spoke-corp` tenant to inbound traffic. + +#### 2a. Create the Spoke LAN Device Interface + +1. In the Conductor GUI, navigate to the `azure-spoke-router` router, then to node `node0`. +2. Scroll down to **Device Interfaces** and select **ADD**. +3. Enter the name `lan-dev` and select **SAVE**. This adds a physical device name for you to assign your LAN interface. + + ![New LAN](/img/deploy-azure-lan-dev-intf1.png) + +5. In the Device Interface Type Settings window, set the type to `ethernet`. When the **Identifier** field becomes visible, select VMBus UUID from the dropdown, and then enter the ID discovered in [Step 3](deploy_azure_hub_spoke_vmbus.mdx). Set Forwarding to `true`. + +![Device Interface Type](/img/deploy-azure-lan-dev-intf2.png) + +#### 2b. Create the Spoke LAN Network Interface + +1. Under the LAN Device Interface, scroll down to **Network Interfaces** and select **ADD**. + + ![Add LAN1](/img/deploy-azure-lan-dev-intf3.png) + +2. Enter the name `lan1` and select **SAVE**. + + ![New Dev Interface](/img/deploy-azure-lan-dev-intf4.png) + +3. On the Basic Information screen, set the following fields: + + - Global-ID: `3` + - Type: `external` + - DHCP: `disabled` + - Tenant: `spoke-corp` - Assigns all inbound LAN traffic to the spoke-corp tenant + + ![Network Interface](/img/deploy-azure-spoke-lan-dev-intf5.png) + +5. Scroll down to Network Interface settings, and set **Source NAT** to `true`. This is required for management over forwarding. + + ![External Corp](/img/deploy-azure-spoke-lan-dev-intf5a.png) + +6. Scroll to **Interface Addresses** and select **ADD**. + +![Add Intf Address](/img/deploy-azure-lan-dev-intf6.png) + +7. Enter the following IP address and prefix. + + - IP Address: `10.0.4.1` + - Prefix Length: `24` + +![New Intf](/img/deploy-azure-spoke-lan-dev-intf7.png) + +### 3. Configure Spoke DNS + +Configure DNS so the spoke router can resolve FQDNs for conductor connectivity and software downloads. + +1. Return to the **Router** level for `azure-spoke-router`. You can either click the up arrow at the top of the screen until you reach the `azure-spoke-router` level, or select the down arrow to the right of the Network Interface heading and select the `azure-spoke-router`. + +![Navigation](/img/deploy-azure-lan-dev-intf8.png) + +2. Scroll to **DNS Config** and select **ADD**. + +![Interface and DNS addresses](/img/dep-vmrouter-wandev11.png) + +3. In the New DNS Config window, use the Mode dropdown to set the mode to **Static**, and click **SAVE**. + +![DNS Mode](/img/deploy-azure-lan-dev-intf9.png) + +4. In the DNS Server Address section, click ADD. +5. Enter 1.1.1.1 and click **SAVE**. + +![DNS Server Addresss](/img/deploy-azure-lan-dev-intf10.png) + +6. Click **ADD** again. +7. Enter 8.8.8.8 and click **SAVE**. + +### 4. Create the Spoke Internet Service Route + +The spoke router does not break out internet traffic directly. Instead, it forwards internet-bound traffic to the hub router over the SVR peer path established by the shared `internet` neighborhood. + +1. Return to the **Router** level for `azure-spoke-router`. +2. Scroll to **Service Routes** and select **ADD**. +3. Enter the name `internet-via-hub` and select **SAVE**. + +![Service Route Name](/img/deploy-azure-spoke-lan-dev-intf12.png) + +4. Under Service Route Information, set the **Service Name** to `Internet-Traffic` + +![Service Route Info](/img/deploy-azure-spoke-lan-dev-intf13.png) + +5. Under Service Route Type, select **Peer Service Route** from the **Type** dropdown. This routes internet traffic to a peer router via SVR. + +6. Under **Peer**, add `azure-hub-router`. The hub router provides internet breakout for the spoke. + +![Service Route Details](/img/deploy-azure-spoke-lan-dev-intf14.png) + +7. Select **VALIDATE** then **COMMIT**. + +:::info +The `peer service route` type directs matched traffic over the SVR path to the named peer router. The hub's `internet-breakout` service route then forwards that traffic to the internet. This is the SSR hub-and-spoke internet breakout pattern. +::: + +## Verify Connectivity + +After committing all configuration, all nodes must reach the `synchronized` state. From the Conductor GUI, select **Routers** to view their status. Once reached, verify both routers are online and forwarding traffic correctly. + +### Verify Both Routers Are Connected to the Conductor + +From the Conductor GUI, select **Routers**. Select the individual routers to see their status. + +Both `azure-hub-router` and `azure-spoke-router` should show a **Connected** status within 2–5 minutes of the commit. + +Both routers should appear with status `Up`. + +### Verify SVR Peering Between Hub and Spoke + +To view peering information, select **Routers** from the Conductor GUI (as above) and select an individual router. Scroll down to the **Peer Paths** section to view peering details. + +From the hub router, the spoke router should appear as an SVR peer with status `Up`. + +From the spoke router, the hub router should appear with status `Up`. + +After SVR adjacencies form, a third entry for the hub-to-spoke peer should also appear. + +### Verify ARP on the WAN Interfaces + +Azure gateways do not respond to ICMP ping. You can use the ARP table from the PCLI to verify WAN connectivity on each router: + +``` +admin@node0.azure-hub-router# show arp +admin@node0.azure-spoke-router# show arp +``` + +Look for **valid** ARP entries on the `wan1` interface of each router. + +### Verify Internet Reachability + +Optionally, generate test traffic to confirm internet connectivity: + +From the hub router: + +``` +admin@node0.azure-hub-router# ping 8.8.8.8 +``` + +From the spoke router: + +``` +admin@node0.azure-spoke-router# ping 8.8.8.8 +``` + +Both routers should reach the internet. Spoke internet traffic traverses the SVR peer path to the hub before being forwarded to the internet. + +If the ping fails, begin troubleshooting by reviewing your configuration for incorrect addresses, typos, or other issues. + + +## Configuration Summary + +### Hub Router + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `azure-hub-router` | combo node | +| WAN Device Interface | `wan-dev` | VMBus UUID, forwarding `true` | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, source-nat, default-route, neighborhood `internet` topology `hub` | +| LAN Device Interface | `lan-dev` | VMBus UUID, forwarding `true` | +| LAN Network Interface | `lan1` | Tenant `hub-corp`, static `10.0.2.1/24`, source-nat | +| DNS | manual | `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-breakout` | `Internet-Traffic` → `node0/wan1` (direct breakout) | + +### Spoke Router + +| Object | Name | Key Settings | +|--------|------|-------------| +| Router | `azure-spoke-router` | combo node | +| WAN Device Interface | `wan-dev` | VMBus UUID, forwarding `true` | +| WAN Network Interface | `wan1` | DHCP v4, conductor, management, source-nat, default-route, neighborhood `internet` topology `spoke` | +| LAN Device Interface | `lan-dev` | VMBus UUID, forwarding `true` | +| LAN Network Interface | `lan1` | Tenant `spoke-corp`, static `10.0.4.1/24`, source-nat | +| DNS | manual | `1.1.1.1`, `8.8.8.8` | +| Service Route | `internet-via-hub` | `Internet-Traffic` → peer `azure-hub-router` (via SVR) | + +## Related Documentation + +- [Appendix — Complete Configuration](deploy_appendix_azure_hub_spoke.mdx) +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Configuring a Device Interface with VMBus UUID](intro_installation_azure.md#configuring-a-device-interface-with-vmbus-uuid) +- [Conductor Deployment Best Practices](bcp_conductor_deployment.md) diff --git a/docs/deploy_azure_hub_spoke_hub_vm.mdx b/docs/deploy_azure_hub_spoke_hub_vm.mdx new file mode 100644 index 0000000000..b90a576fae --- /dev/null +++ b/docs/deploy_azure_hub_spoke_hub_vm.mdx @@ -0,0 +1,119 @@ +--- +title: "Step 1: Create the Hub Router VM" +sidebar_label: "Create the Hub Router VM" +--- + +This step deploys the BYOL SSR VM from the Azure Marketplace as a Hub Router. The deployment template creates the VM, attaches it to the hub WAN and LAN subnets, installs SSR 7.1.4 and configures the node as a conductor-managed router automatically. + +## Requirements + +The following infrastructure must exist in your Azure subscription before deploying the hub router: + +- The `SSR-VNet` VNet with the `ssr-hub-wan` and `ssr-hub-lan` subnets already created. +- A **Managed Identity** assigned the following minimum read permissions: + + ``` + Microsoft.Compute/virtualMachines/read + Microsoft.Network/virtualNetworks/read + Microsoft.Network/networkInterfaces/read + ``` + +- The conductor's public IP address from the [Azure Conductor Deployment Guide](deploy_azure_conductor.mdx). + +:::note +A dedicated management subnet is not required. Management traffic travels over the WAN forwarding interface using [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md). If an out-of-band management interface is not used, management traffic travels over the WAN forwarding interface using [management over forwarding](config_management_over_forwarding.md). +::: + +## Recommended VM Sizes + +| Azure VM Size | Max vNICs | vCPU Cores | Memory | +|---------------|-----------|-----------|--------| +| Standard_F8s_v2 | 4 | 8 | 16 GB | +| Standard_F16s_v2 | 4 | 16 | 32 GB | +| Standard_F32s_v2 | 8 | 32 | 64 GB | +| Standard_D8s_v5 | 4 | 8 | 32 GB | + +For guidance on sizing for larger deployments, see [System Requirements](intro_system_reqs.md). + +## What the Template Creates + +When you deploy the hub router using the BYOL conductor-managed router template, Azure automatically creates: + +- A VM using the BYOL Session Smart image from the Marketplace, running SSR software and a basic configuration. +- Two network interfaces: WAN/public (`ge-0-0`) and LAN/private (`ge-0-1`). +- A network security group associated with each interface. +- A unique public IP address assigned to the WAN interface. + +The router template supports an additional dedicated management interface. This is not used in this guide; in this example, management traffic travels over the WAN forwarding interface. + +## Select the BYOL Plan + +1. Go to the [**Session Smart Networking Platform**](https://marketplace.microsoft.com/en-us/product/juniper-networks.session-smart-networking-payg) in the Azure Marketplace. + +2. Select the **Plans + Pricing** tab. + + ![Select a Plan](/img/dep-azure-plan-pricing.png) + +3. Scroll down to the bottom of the **BYOL** section. + +4. Next to **Juniper Session Smart Conductor-managed Router**, click **Launch**. + + ![Launch the Router Template](/img/dep-azure-router-launch.png) + + ![Router ARM Template](/img/azure-byol-conductor-managed-template.png) + +## Deploy via Azure Portal + +1. Fill in the template parameters using the following table. + + | Parameter | Example Value | Notes | + |-----------|--------------|-------| + | Subscription | _(your subscription)_ | Subscription for the deployment. | + | Resource Group | `SSR-RG` | Select an existing Resource Group. | + | Region | `eastus` | The Azure location where the VNet exists. One word, all lowercase (for example, `eastus`, `westus`, `westeurope`). See [Azure locations](https://azure.microsoft.com/en-us/global-infrastructure/locations). | + | Instance Size | `Standard_F8s_v2` | The Azure VM size to use for the router. | + | Instance Name | `azure-hub-router` | Display name for the VM. | + | SSR Version | `7.1.4` | The BYOL version to install. | + | Primary Control IP | `` | Public IP of the conductor. | + | Secondary Control IP | _(leave blank)_ | Only required for HA conductor deployments. | + | Artifactory Username | _(your username)_ | User portion of the Juniper access credentials. | + | Artifactory Token | _(your token)_ | Token portion of the Juniper access credentials. | + | Managed Identity | _(your managed identity)_ | Must have the permissions listed in [Requirements](#requirements) | + | Virtual Network Name | `SSR-VNet` | Select an existing VNet name. | + | Public Subnet Name | `ssr-hub-wan` | Hub WAN subnet. | + | Public Subnet Allowed CIDR | `0.0.0.0/0` If the value is known at deployment time, it should be restricted. | Source IP address range of the routers to be allowed for SVR traffic. | + | Admin Allowed CIDR | CIDR range allowed for SSH/HTTPS. This should be restricted at deployment time. | Ingress rule allows SSH and HTTPs access from this IP address range. | + | Private Subnet Name | `ssr-hub-lan` | Hub LAN subnet. | + | Private Subnet Allowed CIDR | `0.0.0.0/0` If the value is known at deployment time, it should be restricted.| Source IP address range of the internal workloads to allow access. | + | Admin Public Key Data | _(contents of your SSH public key)_ | If you have an existing public key, select the appropriate response and provide the key. If not, generate a new one the first time, and reuse the same key subsequent times. | + + :::caution + `Public Subnet Allowed CIDR` and `Admin Allowed CIDR` default to `0.0.0.0/0` for initial deployment. After the deployment completes and your environment is stable, update the associated NSG rules to restrict access for `Public Subnet Allowed CIDR` to known source addresses. + ::: + +3. Click Next. Azure will validate the input. + + ![Next button](/img/dep-azure-portal-step3.png) + +4. After reviewing the Terms, click **Create**. + +5. When the deployment completes, open the **Outputs** tab. + + ![Deployment complete](/img/platforms_azure_deployment_complete.png) + + Make a note of the following value — you will need them in later steps: + + - **Public IP address:** The router's Azure assigned public IP. + +## Network Interface Layout + +Use the following interface information to assign the LAN and WAN interfaces later in this process. + +| Linux Interface | Azure NIC Name | Subnet | +|-----------------|---------------|--------| +| ge-0-0 | azure-hub-router-public | ssr-hub-wan | +| ge-0-1 | azure-hub-router-private | ssr-hub-lan | + +## Next Step + +Proceed to [Step 2 — Create the Spoke Router VM](deploy_azure_hub_spoke_spoke_vm.mdx). diff --git a/docs/deploy_azure_hub_spoke_overview.mdx b/docs/deploy_azure_hub_spoke_overview.mdx new file mode 100644 index 0000000000..1ed950714f --- /dev/null +++ b/docs/deploy_azure_hub_spoke_overview.mdx @@ -0,0 +1,101 @@ +--- +title: "Deploying Azure Hub and Spoke Routers" +sidebar_label: Overview +--- +import NetworkDesign from './_deploy_azure_hub_spoke_network_design.md'; + +This guide walks you through deploying a **hub router and a spoke router on Azure** as conductor-managed SSR instances using the Bring Your Own License (BYOL) plan. When you complete this guide, both routers will be running SSR 7.1.4, connected to a pre-existing SSR conductor, and forwarding traffic with the following behavior: + +- **Hub router** — provides direct internet breakout for hub LAN users and acts as the internet gateway for the spoke router over an SVR peer path. +- **Spoke router** — provides LAN services for spoke users and routes internet-bound traffic through the hub router via SVR. +- **Both routers** — reach the conductor using management over forwarding on their WAN interfaces. + +:::note +This guide assumes a conductor is already installed and running SSR 7.1.4. If you have not yet deployed a conductor, complete the [Azure Conductor Deployment Guide](deploy_azure_conductor.mdx) first. +::: + +## Guide Topics + +| Step | Topic | Description | +|------|-------|-------------| +| 1 | [Create the Hub Router VM](deploy_azure_hub_spoke_hub_vm.mdx) | Deploy the BYOL Hub Router VM from the Azure Marketplace | +| 2 | [Create the Spoke Router VM](deploy_azure_hub_spoke_spoke_vm.mdx) | Deploy the BYOL Spoke Router VM from the Azure Marketplace | +| 3 | [Verify Installation and Discover VMBus UUIDs](deploy_azure_hub_spoke_vmbus.mdx) | Wait for SSR 7.1.4 installation to complete and identify NIC VMBus UUIDs for both routers | +| 4 | [Configure Hub and Spoke Routers](deploy_azure_hub_spoke_config.mdx) | Configure both routers on the conductor with WAN, LAN, and internet routing | +| — | [Appendix — Hub and Spoke Configuration](deploy_appendix_azure_hub_spoke.mdx) | Complete PCLI configuration reference for both routers | + +## Network Topology + +The diagram below shows the logical network this guide builds. + +```mermaid +graph TD + Internet((Internet)) + subgraph Azure["Azure — eastus"] + subgraph VNet["SSR-VNet 10.0.0.0/16"] + Conductor["SSR Conductor\nPrivate: 10.0.0.10/24\nSubnet: ssr-conductor-subnet"] + HubRouter["Hub Router\n(azure-hub-router)\nWAN: 10.0.1.x/24 — DHCP\nLAN: 10.0.2.1/24"] + SpokeRouter["Spoke Router\n(azure-spoke-router)\nWAN: 10.0.3.x/24 — DHCP\nLAN: 10.0.4.1/24"] + HubLAN["Hub LAN Devices\nhub-corp\n10.0.2.0/24"] + SpokeLAN["Spoke LAN Devices\nspoke-corp\n10.0.4.0/24"] + end + end + ISP(["Azure Internet Gateway"]) + + Internet <-->|"Internet"| ISP + ISP <-->|"WAN — DHCP"| HubRouter + ISP <-->|"WAN — DHCP\n(management + SVR underlay)"| SpokeRouter + HubRouter <-->|"Internet Breakout\nInternet-Traffic"| Internet + HubLAN <-->|"LAN"| HubRouter + SpokeLAN <-->|"LAN"| SpokeRouter + SpokeRouter <-->|"SVR — Internet-Traffic\ntopology: spoke → hub"| HubRouter + HubRouter <-->|"Management Port 930/4505/4506"| Conductor + SpokeRouter <-->|"Management Port 930/4505/4506"| Conductor +``` + +## Roles + +| Device | Type | Role | +|--------|------|------| +| `Conductor` | Azure VM (BYOL) | Pre-existing conductor — centralized management and provisioning | +| `azure-hub-router` | Azure VM (BYOL) | Hub router — internet breakout for hub LAN and spoke SVR traffic | +| `azure-spoke-router` | Azure VM (BYOL) | Spoke router — LAN services, routes internet via hub SVR peer | + +:::note +This guide uses an Azure deployed conductor in the examples. However, any type of SSR conductor can be used, hardware or virtual. +::: + +## Network Design Reference + + + +## Prerequisites + +Before beginning, ensure the following are available: + +- **Pre-existing SSR conductor** — running SSR 7.1.4 with a static public IP reachable from the hub and spoke WAN interfaces. This guide uses the conductor from the [Azure Conductor Deployment Guide](deploy_azure_conductor.mdx). +- **Azure subscription** — with permission to create VMs, VNets, network security groups, and managed identities. +- **Azure VNet** — `SSR-VNet` with at least the following subnets already created: + - `ssr-hub-wan` — hub router WAN subnet; must have internet egress. + - `ssr-hub-lan` — hub router LAN subnet. + - `ssr-spoke-wan` — spoke router WAN subnet; must have internet egress. + - `ssr-spoke-lan` — spoke router LAN subnet. +- **Azure Managed Identity** — with the minimum read permissions listed in [Step 1](deploy_azure_hub_spoke_hub_vm.mdx#requirements). +- **Juniper software access credentials** — Artifactory username and token for SSR software downloads. + +## Software Version Requirements + +This guide installs **SSR 7.1.4** on both routers. The conductor must be running SSR 7.1.4 or newer before deploying the routers. + +:::note +The router software version must be lower than or equal to the conductor software version. +::: + +## Related Documentation + +- [Azure Conductor Deployment Guide](deploy_azure_conductor.mdx) +- [Management Traffic over Forwarding Interfaces](config_management_over_forwarding.md) +- [Conductor Deployment Best Practices](bcp_conductor_deployment.md) +- [Onboard an SSR Device to a Conductor](onboard_ssr_to_conductor.md) +- [Installing a BYOL Conductor-managed Router in Azure](intro_installation_byol_azure_conductor.md) +- [System Requirements](intro_system_reqs.md) diff --git a/docs/deploy_azure_hub_spoke_spoke_vm.mdx b/docs/deploy_azure_hub_spoke_spoke_vm.mdx new file mode 100644 index 0000000000..9a5a03a50d --- /dev/null +++ b/docs/deploy_azure_hub_spoke_spoke_vm.mdx @@ -0,0 +1,87 @@ +--- +title: "Step 2: Create the Spoke Router VM" +sidebar_label: "Create the Spoke Router VM" +--- + +This step deploys the BYOL SSR VM from the Azure Marketplace as a Spoke Router. The deployment template creates the VM, attaches it to the spoke WAN and LAN subnets, installs SSR 7.1.4, and configures the node as a conductor-managed router automatically. + +## Requirements + +The following infrastructure must exist in your Azure subscription before deploying the spoke router: + +- The `SSR-VNet` VNet with the `ssr-spoke-wan` and `ssr-spoke-lan` subnets already created. +- The same **Managed Identity** used for the hub router, or a separate identity with the same minimum read permissions. +- A conductor where the Spoke Router will onboard. +- A Hub Router. Note the Spoke Router can be deployed while the hub installation completes. + +## Select the BYOL Plan + +1. Go to the [**Session Smart Networking Platform**](https://marketplace.microsoft.com/en-us/product/juniper-networks.session-smart-networking-payg) in the Azure Marketplace. + +2. Select the **Plans + Pricing** tab. + + ![Select a Plan](/img/dep-azure-plan-pricing.png) + +3. Scroll down to the bottom of the **BYOL** section. + +4. Next to **Juniper Session Smart Conductor-managed Router**, click **Launch**. + + ![Launch the Router Template](/img/dep-azure-router-launch.png)) + + ![Router ARM Template](/img/azure-byol-conductor-managed-template.png) + +## Deploy via Azure Portal + +1. Fill in the template parameters using the following table. + + | Parameter | Example Value | Notes | + |-----------|--------------|-------| + | Subscription | _(your subscription)_ | Subscription for the deployment. | + | Resource Group | `SSR-RG` | Select an existing Resource Group | + | Region | `eastus` | The Azure location where the VNet exists. One word, all lowercase (for example, `eastus`, `westus`, `westeurope`). See [Azure locations](https://azure.microsoft.com/en-us/global-infrastructure/locations). | + | Instance Size | `Standard_F8s_v2` | The Azure VM size to use for the router. | + | Instance Name | `azure-spoke-router` | Display name for the VM. | + | SSR Version | `7.1.4` | The BYOL version to install | + | Primary Control IP | `` | Public IP of the conductor | + | Secondary Control IP | _(leave blank)_ | Only required for HA conductor deployments | + | Artifactory Username | _(your username)_ | User portion of the Juniper access credentials. | + | Artifactory Token | _(your token)_ | Token portion of the Juniper access credentials. | + | Managed Identity | _(your managed identity)_ | Must have the permissions listed in [Requirements](#requirements) | + | Virtual Network Name | `SSR-VNet` | Select an existing VNet name. | + | Public Subnet Name | `ssr-spoke-wan` | Hub WAN subnet | + | Public Subnet Allowed CIDR | `0.0.0.0/0` | This should be restricted at deployment time to the IP address for SSH/HTTPS | + | Admin Allowed CIDR | CIDR range allowed for SSH/HTTPS | Source IP CIDR range `x.x.x.x/32` to reach the conductor for administration. | + | Private Subnet Name | `ssr-spoke-lan` | Hub LAN subnet | + | Private Subnet Allowed CIDR | `0.0.0.0/0` If the value is known at deployment time, it should be restricted. | Source IP address range of the internal workloads to allow access. | + | Admin Public Key Data | _(contents of your SSH public key)_ | If you have an existing public key, select the appropriate response and provide the key. If not, generate a new one the first time, and reuse the same key subsequent times. | + + :::caution + `Public Subnet Allowed CIDR` and `Admin Allowed CIDR` default to `0.0.0.0/0` for initial deployment. After the deployment completes and your environment is stable, update the associated NSG rules to restrict access for `Public Subnet Allowed CIDR` to known source addresses. + ::: + +3. Click Next. Azure will validate the input. + + ![Next button](/img/dep-azure-portal-step3.png) + +4. After reviewing the Terms, click **Create**. + +5. When the deployment completes, open the **Outputs** tab. + + ![Deployment complete](/img/platforms_azure_deployment_complete.png) + + Make a note of the following value — you will need them in later steps: + + - **Public IP address:** The router's Azure assigned Public IP. + +## Network Interface Layout + +Use the following interface information to assign the LAN and WAN interfaces later in this process. + +| Linux Interface | Azure NIC Name | Subnet | +|-----------------|---------------|--------| +| ge-0-0 | azure-hub-router-public | ssr-hub-wan | +| ge-0-1 | azure-hub-router-private | ssr-hub-lan | + +## Next Step + +After both the Hub and Spoke VMs are deployed, proceed to [Step 3 — Verify Installation and Discover VMBus UUIDs](deploy_azure_hub_spoke_vmbus.mdx). diff --git a/docs/deploy_azure_hub_spoke_vmbus.mdx b/docs/deploy_azure_hub_spoke_vmbus.mdx new file mode 100644 index 0000000000..cf9feaaf66 --- /dev/null +++ b/docs/deploy_azure_hub_spoke_vmbus.mdx @@ -0,0 +1,122 @@ +--- +title: "Step 3: Verify Installation and Discover VMBus UUIDs" +sidebar_label: "Verify and Discover VMBus UUIDs" +--- + +This step waits for SSR 7.1.4 to finish installing on both VMs, confirms both routers appear on the conductor, and discovers the VMBus UUIDs for the WAN and LAN interfaces on each router. You must record these UUIDs before configuring the routers on the conductor. + +## Wait for Installation to Complete + +The BYOL software installs SSR 7.1.4 automatically after each VM is deployed. This process takes approximately **20 minutes** after the VM first starts. Both VMs install in parallel, so you do not need to wait for one to finish before checking the other. + +The installation is complete when both routers appear in show assets on the conductor. + +## Verify the Routers Are Running + +On each router, enter the SSR PCLI and confirm the system is running: + +``` +su admin +``` + +Enter your password at the prompt. + +``` +admin@node0.azure-hub-router# show system +``` + +The status should return `running`. Repeat for the spoke router: + +``` +admin@node0.azure-spoke-router# show system +``` + +## Verify the Routers Appear on the Conductor + +After installation, each router contacts the conductor and appears as a pending asset. + +1. In the Conductor GUI, select **Configuration**. +2. Select **Authority** and look under **Routers**. +3. Both `azure-hub-router` and `azure-spoke-router` should appear with pending associations. + +If a router does not appear within 15 minutes of installation completing, verify that: +- The conductor's public IP is reachable from the router WAN subnet over ports 930, 4505, and 4506. +- The correct conductor IP was supplied in the deployment template or cloud-init block. + +## Network Interface Layout + +The BYOL conductor-managed router template deploys a VM with network interfaces attached in the following order: + +| Linux Interface | Azure NIC Name | Subnet | +|-----------------|---------------|--------| +| ge-0-0 | azure-spoke-router-public | ssr-spoke-wan | +| ge-0-1 | azure-spoke-router-private | ssr-spoke-lan | + +## Discover VMBus UUIDs + +In Azure, device interfaces are identified by **VMBus UUID** rather than PCI address. You must discover the VMBus UUID for each WAN and LAN interface before configuring the routers on the conductor. + +Perform the following steps on **each router** separately. Record the UUIDs — you will need them in [Step 4](deploy_azure_hub_spoke_config.mdx). + +### Identify VMBus UUIDs From the Router VM + +Open the devicemap to see the VMBus UUID mapping for the attached interfaces. + +`cat /var/lib/128technology/devicemap.json | jq` + +Exit the CLI and run `sudo` from the linux shell before opening the devicemap. + +``` +admin@node.router# quit +[t128@ssr-hub-router-1 ~]$ sudo cat /var/lib/128technology/devicemap.json | jq + +{ + "source": "bootstrapper", + "ethernet": [ + { + "type": "WAN", + "name": "ge-0-0", + "description": "", + "bcpNetwork": { + "standaloneBranch": { + "name": "wan1" + } + }, + + "pciAddress": null, + "vmbusId": "002248be-be61-0022-48be-be61002248be" + }, + { + "type": "LAN", + "name": "ge-0-1", + "description": "", + "bcpNetwork": { + "standaloneBranch": { + "name": "lan2" + } + }, + + "pciAddress": null, + "vmbusId": "002248be-bb15-0022-48be-bb15002248be" + } + ], + "lte": [] +} +``` + +Take note of the device names and associated VMBus ID. + +### VMBus UUID Reference Table + +Record your discovered UUIDs using the following table. You will substitute these values throughout [Step 4](deploy_azure_hub_spoke_config.mdx). + +| Router | Interface | Role | Subnet | VMBus UUID | +| --- | --- | --- | --- | --- | +| `azure-hub-router` | `ge-0-0` | WAN | `ssr-hub-wan` | `` | +| `azure-hub-router` | `ge-0-1` | LAN | `ssr-hub-lan` | `` | +| `azure-spoke-router` | `ge-0-0` | WAN | `ssr-spoke-wan` | `` | +| `azure-spoke-router` | `ge-0-1` | LAN | `ssr-spoke-lan` | `` | + +## Next Step + +Proceed to [Step 4 — Configure Hub and Spoke Routers](deploy_azure_hub_spoke_config.mdx). diff --git a/sidebars.js b/sidebars.js index 1eff00626f..b5a59d073a 100644 --- a/sidebars.js +++ b/sidebars.js @@ -233,9 +233,9 @@ module.exports = { "deploy_vmware_hub_router_pci", "deploy_vmware_hub_router_config", "deploy_appendix_vmware_hub_router", - ], - }, - { + ], + }, + { "type": "category", "label": "VMware Spoke Router", "items": [ @@ -245,8 +245,20 @@ module.exports = { "deploy_vmware_router_pci", "deploy_vmware_router_config", "deploy_appendix_vmware_router", - ], - }, + ], + }, + { + "type": "category", + "label": "Azure Hub and Spoke Routers", + "items": [ + "deploy_azure_hub_spoke_overview", + "deploy_azure_hub_spoke_hub_vm", + "deploy_azure_hub_spoke_spoke_vm", + "deploy_azure_hub_spoke_vmbus", + "deploy_azure_hub_spoke_config", + "deploy_appendix_azure_hub_spoke", + ], + }, ], }, ], diff --git a/static/img/conductor_config_icon.png b/static/img/conductor_config_icon.png index f5dece36dc..6a01de7cd6 100644 Binary files a/static/img/conductor_config_icon.png and b/static/img/conductor_config_icon.png differ diff --git a/static/img/deploy-azure-access-policy-corp.png b/static/img/deploy-azure-access-policy-corp.png new file mode 100644 index 0000000000..99194a0833 Binary files /dev/null and b/static/img/deploy-azure-access-policy-corp.png differ diff --git a/static/img/deploy-azure-conf-access-policies.png b/static/img/deploy-azure-conf-access-policies.png new file mode 100644 index 0000000000..b3a5067287 Binary files /dev/null and b/static/img/deploy-azure-conf-access-policies.png differ diff --git a/static/img/deploy-azure-hs-access-policies-select.png b/static/img/deploy-azure-hs-access-policies-select.png new file mode 100644 index 0000000000..db6ce8cbfe Binary files /dev/null and b/static/img/deploy-azure-hs-access-policies-select.png differ diff --git a/static/img/deploy-azure-hs-hub-tenant.png b/static/img/deploy-azure-hs-hub-tenant.png new file mode 100644 index 0000000000..fbbdc170ef Binary files /dev/null and b/static/img/deploy-azure-hs-hub-tenant.png differ diff --git a/static/img/deploy-azure-hs-hubcorp-acc-policy.png b/static/img/deploy-azure-hs-hubcorp-acc-policy.png new file mode 100644 index 0000000000..51cda2bb63 Binary files /dev/null and b/static/img/deploy-azure-hs-hubcorp-acc-policy.png differ diff --git a/static/img/deploy-azure-hs-services.png b/static/img/deploy-azure-hs-services.png new file mode 100644 index 0000000000..e0aaaf1591 Binary files /dev/null and b/static/img/deploy-azure-hs-services.png differ diff --git a/static/img/deploy-azure-hs-spoke-tenant.png b/static/img/deploy-azure-hs-spoke-tenant.png new file mode 100644 index 0000000000..947f8afa45 Binary files /dev/null and b/static/img/deploy-azure-hs-spoke-tenant.png differ diff --git a/static/img/deploy-azure-hs-spokecorp-acc-policy.png b/static/img/deploy-azure-hs-spokecorp-acc-policy.png new file mode 100644 index 0000000000..e12890824e Binary files /dev/null and b/static/img/deploy-azure-hs-spokecorp-acc-policy.png differ diff --git a/static/img/deploy-azure-lan-dev-intf1.png b/static/img/deploy-azure-lan-dev-intf1.png new file mode 100644 index 0000000000..d2ef063de8 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf1.png differ diff --git a/static/img/deploy-azure-lan-dev-intf10.png b/static/img/deploy-azure-lan-dev-intf10.png new file mode 100644 index 0000000000..cae63ba0dd Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf10.png differ diff --git a/static/img/deploy-azure-lan-dev-intf11.png b/static/img/deploy-azure-lan-dev-intf11.png new file mode 100644 index 0000000000..031b8daf42 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf11.png differ diff --git a/static/img/deploy-azure-lan-dev-intf12.png b/static/img/deploy-azure-lan-dev-intf12.png new file mode 100644 index 0000000000..4ad648c2c6 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf12.png differ diff --git a/static/img/deploy-azure-lan-dev-intf13.png b/static/img/deploy-azure-lan-dev-intf13.png new file mode 100644 index 0000000000..0db1bd259a Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf13.png differ diff --git a/static/img/deploy-azure-lan-dev-intf14.png b/static/img/deploy-azure-lan-dev-intf14.png new file mode 100644 index 0000000000..2abff8a4d9 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf14.png differ diff --git a/static/img/deploy-azure-lan-dev-intf15.png b/static/img/deploy-azure-lan-dev-intf15.png new file mode 100644 index 0000000000..86cc5fcaba Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf15.png differ diff --git a/static/img/deploy-azure-lan-dev-intf2.png b/static/img/deploy-azure-lan-dev-intf2.png new file mode 100644 index 0000000000..2862da0e16 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf2.png differ diff --git a/static/img/deploy-azure-lan-dev-intf3.png b/static/img/deploy-azure-lan-dev-intf3.png new file mode 100644 index 0000000000..e8262df860 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf3.png differ diff --git a/static/img/deploy-azure-lan-dev-intf4.png b/static/img/deploy-azure-lan-dev-intf4.png new file mode 100644 index 0000000000..00cdc88624 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf4.png differ diff --git a/static/img/deploy-azure-lan-dev-intf5.png b/static/img/deploy-azure-lan-dev-intf5.png new file mode 100644 index 0000000000..2cfb67fd33 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf5.png differ diff --git a/static/img/deploy-azure-lan-dev-intf6.png b/static/img/deploy-azure-lan-dev-intf6.png new file mode 100644 index 0000000000..e2d3377f56 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf6.png differ diff --git a/static/img/deploy-azure-lan-dev-intf7.png b/static/img/deploy-azure-lan-dev-intf7.png new file mode 100644 index 0000000000..dd0fd61435 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf7.png differ diff --git a/static/img/deploy-azure-lan-dev-intf8.png b/static/img/deploy-azure-lan-dev-intf8.png new file mode 100644 index 0000000000..9c23057c35 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf8.png differ diff --git a/static/img/deploy-azure-lan-dev-intf9.png b/static/img/deploy-azure-lan-dev-intf9.png new file mode 100644 index 0000000000..4520731b19 Binary files /dev/null and b/static/img/deploy-azure-lan-dev-intf9.png differ diff --git a/static/img/deploy-azure-newhub-rtr.png b/static/img/deploy-azure-newhub-rtr.png new file mode 100644 index 0000000000..c079060319 Binary files /dev/null and b/static/img/deploy-azure-newhub-rtr.png differ diff --git a/static/img/deploy-azure-newspoke-rtr.png b/static/img/deploy-azure-newspoke-rtr.png new file mode 100644 index 0000000000..7054955eae Binary files /dev/null and b/static/img/deploy-azure-newspoke-rtr.png differ diff --git a/static/img/deploy-azure-newtenant.png b/static/img/deploy-azure-newtenant.png new file mode 100644 index 0000000000..4fd5d212bf Binary files /dev/null and b/static/img/deploy-azure-newtenant.png differ diff --git a/static/img/deploy-azure-node-basicinfo.png b/static/img/deploy-azure-node-basicinfo.png new file mode 100644 index 0000000000..4330ea0717 Binary files /dev/null and b/static/img/deploy-azure-node-basicinfo.png differ diff --git a/static/img/deploy-azure-select-authority.png b/static/img/deploy-azure-select-authority.png new file mode 100644 index 0000000000..8893a3d56d Binary files /dev/null and b/static/img/deploy-azure-select-authority.png differ diff --git a/static/img/deploy-azure-select-tenant-add.png b/static/img/deploy-azure-select-tenant-add.png new file mode 100644 index 0000000000..51c7186797 Binary files /dev/null and b/static/img/deploy-azure-select-tenant-add.png differ diff --git a/static/img/deploy-azure-service-address.png b/static/img/deploy-azure-service-address.png new file mode 100644 index 0000000000..9de1e7a843 Binary files /dev/null and b/static/img/deploy-azure-service-address.png differ diff --git a/static/img/deploy-azure-service-int-traf.png b/static/img/deploy-azure-service-int-traf.png new file mode 100644 index 0000000000..7f714d6fac Binary files /dev/null and b/static/img/deploy-azure-service-int-traf.png differ diff --git a/static/img/deploy-azure-service-int-traf2.png b/static/img/deploy-azure-service-int-traf2.png new file mode 100644 index 0000000000..1ff8100e99 Binary files /dev/null and b/static/img/deploy-azure-service-int-traf2.png differ diff --git a/static/img/deploy-azure-service-int-traf3.png b/static/img/deploy-azure-service-int-traf3.png new file mode 100644 index 0000000000..03a6566539 Binary files /dev/null and b/static/img/deploy-azure-service-int-traf3.png differ diff --git a/static/img/deploy-azure-spk-node-basicinfo.png b/static/img/deploy-azure-spk-node-basicinfo.png new file mode 100644 index 0000000000..7082b881f1 Binary files /dev/null and b/static/img/deploy-azure-spk-node-basicinfo.png differ diff --git a/static/img/deploy-azure-spoke-basic.png b/static/img/deploy-azure-spoke-basic.png new file mode 100644 index 0000000000..e80314091a Binary files /dev/null and b/static/img/deploy-azure-spoke-basic.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf12.png b/static/img/deploy-azure-spoke-lan-dev-intf12.png new file mode 100644 index 0000000000..eebca0bc9e Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf12.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf13.png b/static/img/deploy-azure-spoke-lan-dev-intf13.png new file mode 100644 index 0000000000..478a2a3ef0 Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf13.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf14.png b/static/img/deploy-azure-spoke-lan-dev-intf14.png new file mode 100644 index 0000000000..d9b1d24111 Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf14.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf5.png b/static/img/deploy-azure-spoke-lan-dev-intf5.png new file mode 100644 index 0000000000..821d00745b Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf5.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf5a.png b/static/img/deploy-azure-spoke-lan-dev-intf5a.png new file mode 100644 index 0000000000..e26fe1f711 Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf5a.png differ diff --git a/static/img/deploy-azure-spoke-lan-dev-intf7.png b/static/img/deploy-azure-spoke-lan-dev-intf7.png new file mode 100644 index 0000000000..5f99f42269 Binary files /dev/null and b/static/img/deploy-azure-spoke-lan-dev-intf7.png differ diff --git a/static/img/deploy-azure-spoke-wan-dev-intf4.png b/static/img/deploy-azure-spoke-wan-dev-intf4.png new file mode 100644 index 0000000000..dba96e8801 Binary files /dev/null and b/static/img/deploy-azure-spoke-wan-dev-intf4.png differ diff --git a/static/img/deploy-azure-spoke-wan-dev-intf8.png b/static/img/deploy-azure-spoke-wan-dev-intf8.png new file mode 100644 index 0000000000..7f91d01295 Binary files /dev/null and b/static/img/deploy-azure-spoke-wan-dev-intf8.png differ diff --git a/static/img/deploy-azure-wan-dev-intf.png b/static/img/deploy-azure-wan-dev-intf.png new file mode 100644 index 0000000000..e605b1f305 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf.png differ diff --git a/static/img/deploy-azure-wan-dev-intf2.png b/static/img/deploy-azure-wan-dev-intf2.png new file mode 100644 index 0000000000..a01ad1897e Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf2.png differ diff --git a/static/img/deploy-azure-wan-dev-intf3.png b/static/img/deploy-azure-wan-dev-intf3.png new file mode 100644 index 0000000000..7c938b52d8 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf3.png differ diff --git a/static/img/deploy-azure-wan-dev-intf4.png b/static/img/deploy-azure-wan-dev-intf4.png new file mode 100644 index 0000000000..484cfba979 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf4.png differ diff --git a/static/img/deploy-azure-wan-dev-intf5.png b/static/img/deploy-azure-wan-dev-intf5.png new file mode 100644 index 0000000000..cddf3ee7c0 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf5.png differ diff --git a/static/img/deploy-azure-wan-dev-intf6.png b/static/img/deploy-azure-wan-dev-intf6.png new file mode 100644 index 0000000000..5dc71a432b Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf6.png differ diff --git a/static/img/deploy-azure-wan-dev-intf7.png b/static/img/deploy-azure-wan-dev-intf7.png new file mode 100644 index 0000000000..aa19ba9123 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf7.png differ diff --git a/static/img/deploy-azure-wan-dev-intf8.png b/static/img/deploy-azure-wan-dev-intf8.png new file mode 100644 index 0000000000..627f91d010 Binary files /dev/null and b/static/img/deploy-azure-wan-dev-intf8.png differ