Guides
ProductDeveloperPartnerPersonal
Guides
ProductDeveloperPartnerPersonal

Deploy VAs in Alibaba Cloud

Alibaba Cloud is a public cloud environment.

👍

Two virtual appliances (VAs) are required for each Umbrella site. It is critical that these VAs are not cloned or copied in any way. Each VA must be set up and configured manually.

Table of Contents

Prerequisites

  • Full Admin user role. For more information, see Manage Accounts.
  • For information about the requirements for deploying Umbrella VAs, see Prerequisites.
  • An Alibaba account. You can create one at https://www.alibaba.com/.
  • A qemu-utils package installed, such as Homebrew, to run qemu-img and tar commands.
  • Only VAs running version 3.6.1 or above can be deployed in Alibaba.
  • An SSH client (for example, PuTTY on Windows or Terminal on Macintosh) to access the VA console.

(Optional) Configure Authentication for the Virtual Appliances

Procedure

  1. Download and Extract the Hyper-V Installer. This is a one time task.
  2. Alibaba Cloud Setup
  3. Create a Custom Image. Perform this task for each VA after performing the one-time task of preparing the VA images.
  4. Deploy the Umbrella VAs from the Imported Custom Image
  5. First-time Login to Umbrella VA
  6. Related Topics
    1. Dual-NIC Support on the VA
    2. IP Addressing
    3. Anycast Configuration Support
    4. DNS Performance on Alibaba ECS Instances
    5. Extensions on Alibaba ECS Instances

Download and Extract the Hyper-V Installer

Download the software package for the Umbrella Virtual Appliance.

When you download the software package for the VA and if you did not configure API key credentials for your AD Connectors and VAs, Umbrella displays a warning message. We recommend that you configure API keys for your AD Connectors and Umbrella VAs. For more information, see Configure Authentication for Virtual Appliances.

  1. Navigate to Deployments > Configuration > Sites and Active Directory and click Download.
1093
  1. Click Download for VA for Hyper-V.
574

Umbrella generates and downloads a tar file unique to your deployment. 
This tar file includes:  

  • a zip file containing the virtual hard disks that need to be deployed on Hyper-V  
  • a signature file  
  • a Cisco public certificate to validate the signature  
  • a readme file  
  1. Extract the contents of the tar file using the command tar –xvf <.
    To verify the integrity of the downloaded file, validate the signature by following the instructions provided in the readme file. When successful, there will be a message saying “Verified OK." 
  2. Extract the .zip file. You'll find two folders—Virtual Hard Disks and Virtual Machines—and a config file.
640

  1. In Windows Explorer, navigate to the \Virtual Hard Disks** subfolder within the extracted download folder created in Step 1**.

  2. Note the two VA files, dynamic and forwarder-va. Convert the forwarder-va.vhd file to .raw format:

    qemu-img convert -f vpc -O raw forwarder-va.vhd forwarder-va.raw

  3. Zip the forwarder-va.raw file.
    Note: Alibaba only allows for 5Gb uploads.

Alibaba Cloud Setup

This section describes the configuration requirements within Alibaba Cloud to support deploying the Umbrella VA instances to your virtual private cloud (VPC). For more details on setting up a VPC and other components, please refer to Alibaba's Cloud Documentation here.

Procedural Overview

  1. Create an Alibaba Virtual Private Cloud (VPC)
  2. Create a Bucket for the Umbrella VAs
  3. Configure a ZIP Package Decompression Rule
  4. Upload the Umbrella VHD Images to the OSS Bucket

Create an Alibaba Virtual Private Cloud (VPC)

A virtual private cloud (VPC) is required to deploy your Alibaba Cloud resources, such as Umbrella VAs.

  1. Log in to your Alibaba Cloud Account and log on to the VPC console.
  2. In the top navigation bar, select the region where you want to deploy the VPC.
    Note: The VPC and the cloud resources that you want to deploy in the VPC must belong to the same region.
  3. On the VPCs page, click Create VPC.
  4. On the Create VPC page, set the required parameters and click OK.

To find more information about this, please click here.

Create a Bucket for the Umbrella VAs

An Object Storage Service (OSS) bucket is needed. Alibaba OSS is a secure, cost-effective, and highly reliable cloud storage service that allows for the storage of large amounts of data.

  1. On the Alibaba Cloud Console home page, select Object Storage Service (OSS).
  2. In the left-side navigation pane, click Buckets. On the Buckets page, click Create Bucket.
  3. In the Create Bucket panel, enter the Bucket Name and Region .
    The bucket must be in the same region as the VPC in which the Umbrella VAs are to be deployed. Keep the default settings for other parameters or configure the parameters after the bucket is created.
  4. Click OK.
    After the bucket is created, the Created message is displayed.

Configure a ZIP Package Decompression Rule

Alibaba Cloud accepts uploads of objects up to 5 GB in size using the OSS console. Because the Umbrella Forwarder VA is larger than 5 GB, the forwarder-va.vhd file needs to be converted to .raw format and then compressed to a zip file, as described in Download and Extract the Hyper-V Installer.

  1. In the left navigation pane of the OSS console, click Buckets. On the Buckets page, find and click the desired bucket.
  2. In the left navigation tree, choose Data Processing > Decompress ZIP Package.
  3. Click Start Activation and follow the prompts.
  4. Once activation is complete, go to the bucket and click Decompress ZIP Package. In the Decompress ZIP Package panel, configure the following parameters:
    1. Service Authorization - Authorize Function Compute to read data from and write data to OSS and to execute functions. Click Authorize. Complete authorization on the page that appears.
    2. Authorize Trigger - Authorize OSS to access Function Compute. Click Authorize. Complete authorization on the page that appears. If OSS is authorized to access Function Compute, the Trigger Role parameter is displayed instead of the Authorize Trigger parameter.
    3. Destination Directory - To store the objects extracted from a ZIP package in a subdirectory that has the same name as the package in the destination directory, select Add the compressed object name to the destination directory.
  5. Click OK.

Now that the bucket is created, click Go to Bucket. Alternatively, click Buckets in the left-side navigation pane and click the name of the created bucket.

Upload the Umbrella VHD Images to the OSS Bucket

Upload the Umbrella VHD images that were downloaded in Download and Extract the Hyper-V Installer to your bucket.

  1. Select your bucket, choose Files > Upload, and click here to upload.

  2. Select the compressed forwarder-va zip file on your local drive. Wait for the automatic decompression to be triggered before continuing. The forwarder-va.raw file should be seen in the table on the Upload page if it is uploaded successfully.

  3. Select the dynamic.vhd on your local drive. Given the small size of this file, no conversion or compression is required.

  4. The file will be displayed in the table on the Upload page if it is uploaded successfully.

  5. Click View Details, the click Copy File URL. This URL is needed in later steps when creating a custom image.

Create a Custom Image

  1. Select the Alibaba Elastic Compute Service (ECS).
  2. Select Instances & Images > Images > Custom Images.
  1. Click the Import Image button.
  1. Paste the forwarder-va.raw URL in the Import Image window. See Upload the Umbrella VHD Images to the OSS Bucket for where to find the URL.
    Note: If the following error is seen, ECS does not have access to the OSS resources. Enable access by clicking the here hyperlink shown.
  1. If necessary, click the Confirm Authorization Policy button.
  1. Repeat the Import Image action and fill the necessary fields as below.
  1. Check the Configure Disk Attributes box and adjust the Disk SizeGiB setting.
    Note: Make sure that the forwarder-va.raw disk size is 6.5 GB.
  2. Repeat for the dynamic.vhd file.
    Note: Make sure that the dynamic.vhd disk size is 20 MB.
  1. If the image is successfully created, the following window is shown.
  1. Note that if the forwarder-va.vhd is uploaded instead of .raw image, or if the size is not supported, the following error is shown.

Deploy the Umbrella VAs from the Imported Custom Image

An Elastic Compute Service (ECS) image provides the information that is required to create an ECS instance. An image must be specified when creating an ECS instance. An image is a copy of data from one or more disks. An instance image can contain data from only the system disk or from both the system disk and data disks.

  1. Navigate to Elastic Compute Service > Instances. Click Create Instance.
  1. Complete the following Basic Configuration settings:
    1. Select the Region and zone. Select a region that is close to your geographical location to reduce latency. After an instance is created, the region and the zone of the instance cannot be changed.
    2. Select the Instance type. Different instance types have different CPU, RAM and throughput capacity.
      Note: It is recommended to have an instance type having a minimum capability of ecs.c6.xlarge for optimal DNS performance, with enhanced clock speed as the VA is a DNS proxy.
  1. Select the Custom image, Duration and click Next.
    Note: The System Disk size increase will not help scale the VA as dynamic disk size change is not supported. The VA only supports a 7 GB system and 1 GB data disk.
  1. Select the VPC and VSwitch as per the topology. In this example, default values are selected.
    The Virtual Appliance will have a private IP with which it will be registered with the dashboard. Specify the private IP so that it does not change on power cycle.
  1. If a Security Group has already been created, the same can be reused. This example proceeds with basic configuration and enable the ports later as per VA pre-requisites
  1. Alibaba cloud does not support password setting for users other than "root", so the vmadmin password cannot be set through the Cloud and it has to be Set Later through SSH or console access.
  1. Select the Resource Group in the next window. In this example, the Default Resource Group is used.
  2. Click Create Order and proceed.
  1. Once the subscription is created, the instance will show up on the ECS console.

What to do Next

  • Go to the newly created instance and edit Security Group rules; see the virtual appliances (VA) network requirements.
  • The vmadmin password can be reset by doing remote SSH via the public IP as port 3389 is allowed by default.
  • If the instance does not have a public IP, a Bastion host has to be created in the same region to access it via Private IP as per Alibaba documentation.
  • Please note that connecting to the VA via the Alibaba cloud workbench will fail due to the change password prompt, so the first time password reset has to happen via SSH.
  • Once the password is reset, the Alibaba workbench can be used to login to the console.
  • After the password is set, you can SSH to the VA via the ECS Workbench as well.

First-time Login to Umbrella VA

There are three ways to do the first-time login to the Umbrella VA:

  1. If the VA has a public IP associated, use the default vmadmin/Umbrella credentials and reset the password.
  2. If the VA is inside private network, create another OAM VM (not the Alibaba bastion) inside the same network and SSH through the private IP using the vmadmin/Umbrella credentials and reset the password.
  3. ECS instances can also be added to a Bastion host enterprise edition available on the Alibaba cloud; refer to the following guidelines. When doing so, please note that the password should be reset from the ECS instance UI also before trying to login through the Bastion. Please note that even though the instance password is reset through UI, it won't apply to the instance as we do not have a root account.

Related Topics

Dual-NIC Support on the VA

In the Alibaba Cloud elastic network interfaces (ENIs) are logical networking components that represent virtual NICs, providing network connectivity and IP addresses for Elastic Compute Service (ECS) instances deployed in virtual private clouds (VPCs).

The Umbrella virtual appliance (VA) supports a dual-NIC configuration. This dual-NIC configuration is intended to enable DMZ deployment of a VA for traffic segregation with one network interface being used for outbound communication and the other network interface used for internal communication.

There is no change to existing behavior if the VA is deployed with a single NIC. Configuring more than two NICs on the VA is not supported.

For more information about Umbrella Dual-NIC support and how to configure Alibaba ENIs, see the following:

Note: Do not connect more than one ENI the same VSwitch. Network issues will result.

IP Addressing

General Guidelines

The Umbrella VA supports both IPv4 and IPv6 addressing (dual stack). However there are some observations on the Alibaba cloud regarding IP addressing:

  • While the Alibaba ECS ENI supports multiple private IP address, please note that the Umbrella VA only supports a single IPv4 or Single IPv4 + IPv6 pair per ENI.
  • One private IPv4 and one private IPv6 address can be added to the Umbrella VA.
  • The Alibaba Cloud is not supporting public IPv6 address to ECS instances.
  • An IPv6 gateway can be set up at the VPC level and establish connectivity to Umbrella global IPv6 resolvers. However, it has been observed during testing that IPv6 packets are not getting a response even after setting up the gateway. This has been observed in the Germany Frankfurt Region.

Support for IPv6 Addressing

The following are observations regarding IPv6 addressing on the Alibaba Cloud:

  • The IPv6 address range should be enabled on the VSwitch.
  • By default, when creating an Elastic Compute Service (ECS) instance, an IPv4 address instead of an IPv6 address is assigned to the instance. To have the instance communicate over IPv6, configure an IPv6 address for the instance.
  • IPv6 addressing is not supported on every ECS instance types. It depends on system resources selected during deployment. Refer to ECS instance type family.
  • See Configure IPv6 addresses for information on how to configure an IPv6 address for the instance.

Anycast Configuration Support

The Umbrella VA enables the use of Anycast DNS addressing within an enterprise.

The VA currently supports enabling Anycast using the BGP protocol. This requires support for BGP on the VA’s neighboring router, or any router that is reachable from the VA within 255 hops. See the Configure Anycast topic for information about how to configure Anycast on the VA.

In addition, keep the following in mind when configuring Anycast on the Alibaba cloud:

  • Configure an additional route on the VSwitch for the Anycast IP address for packets with the destination IP as Anycast.
  • The Anycast IP/network can be routed only per single ECS or ENI per VSwitch, where the next hop is the VA instance on which Anycast is enabled and 10.0.0.5 is the Anycast IP.

Note: VAs participating in anycast DNS should belong to different VSwitches or different networks; the following image shows the route table of a VSwitch configured with an Anycast route.

DNS Performance on Alibaba ECS Instances

Different instance types have different CPU, RAM and throughput capacity. Latency and throughput testing was performed on the following instances using dnsperf. The results captured after running the test for 1 minute are collected in the following table.

From these statistics, it is recommended to have an instance type having a minimum capability of ecs.c6.xlarge for optimal DNS performance. Refer to the Alibaba Cloud Instance family documentation for information on instance configurations.

Instance TypeMaximum DNS
Throughput
ecs.mn4.small1300 qps
ecs.c5.large1800 qps
ecs.hfc5.large2000 qps
ecs.g6e.large2700 qps
ecs.c6.xlarge4600 qps
ecs.g6e.xlarge> 10000 qps

Extensions on Alibaba ECS Instances

Alibaba ECS instance supports installing agents/plugins for monitoring purpose, example CloudMonitor argusagent. It is not recommended to do so as it puts the VA under risk for root partition exhaustion. On a newly deployed VA instance, the memory usage is 66 % due to the aliyun default packages installation.

Deploy VAs in Nutanix < Deploy VAs in Alibaba > Configure Virtual Appliances

Updated 3 months ago