Docs 550 azure hub and spoke deployment guide

docs/_deploy_azure_conductor_to_authority.md

@@ -6,13 +6,11 @@ Take this opportunity to log into the Conductor GUI to complete the following op
 
 1. Select the **Conductor** from the Authority menu on the left side of the GUI. 
 
- ![Configuration menu](/img/config_menu_gui.png)
-
-2. Select the **Configure** icon.
+2. In the **Node** panel, select the **Configure** icon.
 
  ![Conductor Configuration Icon](/img/conductor_config_icon.png)
 
-3. In the Node panel, under **Associated Asset ID**, select the hostname for the conductor.
+3. In the Node Basic Information panel, under **Associated Asset ID**, enter the hostname for the conductor.
 
  ![Asset ID](/img/dep-conductor_asset-id.png)
 

docs/_set_authority_name.md

@@ -6,7 +6,7 @@ The authority represents the complete set of all SSRs managed under a single org
 
 	![Up arrow](/img/deploy-up-arrow.png)
 
-2. Select the Authority Settings.
+2. Select the Authority tile.
 
  ![Authority Settings](/img/conductor_authority_name.png)
 

docs/_set_conductor_ip.md

@@ -1,10 +1,10 @@
 <!----Set the Conductor IP Address---->
 
-1. Under Conductor Addresses, select ADD.
+1. Under Authority Settings, scroll down to **Conductor Addresses** and select **ADD**.
 2. In the **New Conductor Address** window, enter the conductor public IP address, `192.168.100.10`.
 
 ![Conductor Address](/img/conductor_address.png)
 
-3. Click Validate and Commit. Warnings will appear, advising you of the change.  
+3. Select **VALIDATE** then **COMMIT**. Warnings will appear, advising you of the change.  
 
 The steps during initialization setup the management IP. The conductor IP address is the public IP address to which the managed routers connect. It is not necessary to manually associate this IP address with a network interface; the interactions between the SSR software and Linux will identify and assign the IP address to the network interface. 

docs/deploy_appendix_azure_hub_spoke.mdx

@@ -0,0 +1,288 @@
+---
+title: "Appendix: Azure Hub and Spoke Configuration"
+sidebar_label: "Appendix: Hub and Spoke Config"
+---
+import NetworkDesign from './_deploy_azure_hub_spoke_network_design.md';
+
+This appendix contains the complete SSR PCLI configuration for the `azure-hub-router` and `azure-spoke-router` deployments described in this guide. This configuration reflects the final state after completing all steps through [Step 4 — Configure Hub and Spoke Routers](deploy_azure_hub_spoke_config.mdx).
+
+:::important
+Replace all placeholder values (shown in angle brackets) with values from your environment before applying:
+
+- `<conductor-public-ip>` — public IP of the conductor VM.
+- `<conductor-vmbus-uuid>` — VMBus UUID of the conductor management interface (found in `devicemap.json` on the conductor VM).
+- `<hub-wan-vmbus-uuid>` — VMBus UUID of the hub router WAN NIC (`ge-0-0`).
+- `<hub-lan-vmbus-uuid>` — VMBus UUID of the hub router LAN NIC (`ge-0-1`).
+- `<spoke-wan-vmbus-uuid>` — VMBus UUID of the spoke router WAN NIC (`ge-0-0`).
+- `<spoke-lan-vmbus-uuid>` — VMBus UUID of the spoke router LAN NIC (`ge-0-1`).
+:::
+
+## Network Design Reference
+
+<NetworkDesign/>
+
+## Applying This Configuration
+
+This configuration can be applied to the conductor using the PCLI import function.
+
+1. Save the configuration below to a file — for example, `azure-hub-spoke.cfg`.
+
+2. Copy the file to the conductor:
+
+   ```
+   scp -i azure-hub-spoke.cfg t128@:/tmp/
+   ```
+
+3. Log in to the conductor PCLI:
+
+   ```
+   ssh -i t128@<conductor-public-ip>
+   su admin
+   ```
+
+4. Enter configuration mode and import:
+
+   ```
+   [email protected]# import config /tmp/azure-hub-spoke.cfg
+   ```
+
+5. Review any validation warnings, then commit:
+
+   ```
+   [email protected] (config)# commit
+   Are you sure you want to commit the candidate config? [y/N]: y
+   ```
+
+Alternatively, you may copy and paste each block into the PCLI while in `configure` → `edit` mode.
+
+:::note
+The authority-level objects the routers depend on (`hub-corp` tenant, `spoke-corp` tenant, `Internet-Traffic` service, authority name, and conductor address) are included in the configuration block below. If your conductor already has an `Internet-Traffic` service or other conflicting objects, reconcile those before importing.
+:::
+
+## Complete Configuration
+
+```
+config
+    authority
+        conductor-address  <conductor-public-ip>
+
+        router             conductor-1
+            name  conductor-1
+
+            node  node0
+                name           node0
+                asset-id       conductor-1
+                platform-type  "Virtual Machine"
+            exit
+        exit
+
+        router             ssr-router-2
+            name                 ssr-router-2
+            inter-node-security  internal
+
+            dns-config           static
+                mode     static
+                address  1.1.1.1
+                address  8.8.8.8
+            exit
+
+            node                 node0
+                name              node0
+                asset-id          ssr-router-2
+                role              combo
+                platform-type     "Virtual Machine"
+
+                device-interface  wan-dev
+                    name               wan-dev
+                    vmbus-uuid         00224879-yourvmbusuuidhere
+
+                    network-interface  wan1
+                        name                   wan1
+                        global-id              1
+                        conductor              true
+                        default-route          true
+
+                        neighborhood           internet
+                            name  internet
+                        exit
+                        inter-router-security  internal
+                        source-nat             true
+
+                        host-service           ssh
+                            service-type   ssh
+
+                            access-policy  0.0.0.0/0
+                                source  0.0.0.0/0
+                            exit
+                        exit
+                        management             true
+
+                        management-vector
+                            name      mgmt-vec-wan
+                            priority  100
+                        exit
+                        dhcp                   v4
+                    exit
+                exit
+
+                device-interface  lan-dev
+                    name               lan-dev
+                    vmbus-uuid         00224879-yourvmbusuuidhere
+
+                    network-interface  lan1
+                        name        lan1
+                        global-id   2
+                        tenant      spoke-corp
+                        source-nat  true
+
+                        address     10.8.2.5
+                            ip-address     10.8.2.5
+                            prefix-length  24
+                        exit
+                    exit
+                exit
+            exit
+
+            service-route        internet-via-hub
+                name          internet-via-hub
+                service-name  Internet-Traffic
+                peer          ssr-hub-router-1
+            exit
+        exit
+
+        router             ssr-hub-router-1
+            name                 ssr-hub-router-1
+            inter-node-security  internal
+
+            dns-config           static
+                mode     static
+                address  1.1.1.1
+                address  8.8.8.8
+            exit
+
+            node                 node0
+                name              node0
+                asset-id          ssr-hub-router-1
+                role              combo
+                platform-type     "Virtual Machine"
+
+                device-interface  wan-dev
+                    name               wan-dev
+                    vmbus-uuid         002248be-yourvmbusuuidhere
+
+                    network-interface  wan1
+                        name                   wan1
+                        global-id              3
+                        conductor              true
+                        default-route          true
+
+                        neighborhood           internet
+                            name      internet
+                            topology  hub
+                        exit
+                        inter-router-security  internal
+                        source-nat             true
+
+                        host-service           ssh
+                            service-type   ssh
+
+                            access-policy  0.0.0.0/0
+                                source  0.0.0.0/0
+                            exit
+                        exit
+                        management             true
+
+                        management-vector
+                            name      mgmt-vec-wan
+                            priority  100
+                        exit
+                        dhcp                   v4
+                    exit
+                exit
+
+                device-interface  lan-dev
+                    name               lan-dev
+                    vmbus-uuid         002248be-yourvmbusuuidhere
+
+                    network-interface  lan1
+                        name        lan1
+                        global-id   4
+                        tenant      hub-corp
+                        source-nat  true
+
+                        address     10.8.6.4
+                            ip-address     10.8.6.4
+                            prefix-length  24
+                        exit
+                    exit
+                exit
+            exit
+
+            service-route        internet-breakout
+                name          internet-breakout
+                service-name  Internet-Traffic
+
+                next-hop      node0 wan1
+                    node-name  node0
+                    interface  wan1
+                exit
+            exit
+        exit
+
+        tenant             hub-corp
+            name  hub-corp
+        exit
+
+        tenant             spoke-corp
+            name  spoke-corp
+        exit
+
+        service            Internet-Traffic
+            name           Internet-Traffic
+            security       internal
+            address        0.0.0.0/0
+
+            access-policy  hub-corp
+                source  hub-corp
+            exit
+
+            access-policy  spoke-corp
+                source  spoke-corp
+            exit
+        exit
+    exit
+exit
+```
+
+## Interface Summary
+
+### Hub Router (`azure-hub-router`)
+
+| Interface | Device Interface | VMBus UUID | Type | Configuration |
+|-----------|-----------------|-----------|------|---------------|
+| `wan1` | `wan-dev` | `<hub-wan-vmbus-uuid>` | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood `internet` topology `hub` |
+| `lan1` | `lan-dev` | `<hub-lan-vmbus-uuid>` | External | Tenant `hub-corp`, static `10.0.2.1/24`, source-nat |
+
+### Spoke Router (`azure-spoke-router`)
+
+| Interface | Device Interface | VMBus UUID | Type | Configuration |
+|-----------|-----------------|-----------|------|---------------|
+| `wan1` | `wan-dev` | `<spoke-wan-vmbus-uuid>` | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood `internet` topology `spoke` |
+| `lan1` | `lan-dev` | `<spoke-lan-vmbus-uuid>` | External | Tenant `spoke-corp`, static `10.0.4.1/24`, source-nat |
+
+## Service Route Summary
+
+| Router | Service Route | Service | Type | Next Hop | Effect |
+|--------|--------------|---------|------|---------|--------|
+| `azure-hub-router` | `internet-breakout` | `Internet-Traffic` | `service-agent` | `node0/wan1` | Hub LAN and spoke SVR traffic breaks out directly to the internet. |
+| `azure-spoke-router` | `internet-via-hub` | `Internet-Traffic` | `peer` | `azure-hub-router` | Spoke internet traffic is forwarded over the SVR peer path to the hub for breakout. |
+
+## Traffic Flow Reference
+
+The following table describes how internet traffic flows in the completed hub-and-spoke network.
+
+| Source | Destination | Path |
+| --- | --- | --- |
+| Hub LAN device (10.0.2.x) | Internet | Hub LAN → `hub-corp` tenant → `Internet-Traffic` service → `internet-breakout` route → hub `wan1` → internet |
+| Spoke LAN device (10.0.4.x) | Internet | Spoke LAN → `spoke-corp` tenant → `Internet-Traffic` service → `internet-via-hub` peer route → SVR path → hub `wan1` → internet |
+| Hub or spoke router | Conductor | Management over forwarding on `wan1` using port 930/4505/4506; management-vector priority 100 on each router's WAN interface |

docs/deploy_azure_conductor_config.mdx

@@ -37,11 +37,19 @@ If all managed routers reside in the same Azure VNet and communicate over privat
 
 Tenants logically partition the network. The `corp` tenant represents corporate LAN users and is referenced by the LAN interface configuration on each managed router.
 
-1. In the Conductor GUI, select **Configuration**.
-2. Select **Authority**.
-3. Scroll to **Tenants** and select **ADD**.
-4. Enter the name `corp` and select **SAVE**.
-5. Select **VALIDATE** then **COMMIT**.
+1. Under **Configuration** in the left panel, select **Authority**.
+
+![Select Authority](/img/deploy-azure-select-authority.png)
+
+2. Scroll to **Tenants** and select **ADD**.
+
+![Add Tenant](/img/deploy-azure-select-tenant-add.png)
+
+3. Enter the name `corp` and select **SAVE**.
+
+![Name Tenant](/img/deploy-azure-newtenant.png)
+
+4. Select **VALIDATE** then **COMMIT**.
 
 :::info
 Tenants are authority-wide. A single `corp` tenant definition applies to all routers that assign it to a LAN interface.
@@ -51,16 +59,40 @@ Tenants are authority-wide. A single `corp` tenant definition applies to all rou
 
 The *service* configuration element defines the IP destinations that the SSR routes. This step creates a single service representing all internet-bound traffic from corporate LAN users.
 
-1. In the Conductor GUI, select **Configuration**.
-2. Select **Authority** from the left panel.
-3. Scroll down to **Services** and select **ADD**.
+1. Under **Configuration** in the left panel, select **Authority**.
+
+![Select Authority](/img/deploy-azure-select-authority.png)
+
+3. Scroll to **Services** and select **ADD**.
+
+![Add Service](/img/deploy-azure-hs-services.png)
+
 4. Enter the name `Internet-Traffic` and select **SAVE**.
-5. On the Service screen, verify **Enabled** is set to `true`.
-6. Scroll down to **Service Addresses** and select **ADD**.
+
+![Add Internet Traffic Service](/img/deploy-azure-service-int-traf.png)
+
+5. Verify **Enabled** is set to `true`.
+
+![Internet Traffic Service True](/img/deploy-azure-service-int-traf2.png)
+
+6. Scroll to **Service Addresses** and select **ADD**. 
+
+![Select Service Addresses](/img/deploy-azure-service-int-traf3.png)
+
 7. Enter `0.0.0.0/0` and select **SAVE**.
-8. Scroll down to **Access Policies** and select **ADD**.
+
+![Address IP](/img/deploy-azure-service-address.png)
+
+8. Scroll to **Access Policies** and select **ADD**.
+
+![Add Access policy](/img/deploy-azure-hs-access-policies-select.png)
+
    - Set **Source** to `corp`.
+
+![Corp Access Policy](/img/deploy-azure-access-policy-corp.png)
+
    - Select **SAVE**.
+
 9. Select **VALIDATE** then **COMMIT**.
 
 ## What Was Configured