¶ Deploy Cyber Gateway on a Virtual Machine
The CGW requires a single virtual machine (VM) to deploy on an Hyper-V host. For High-Availability (HA) deployment, you will need two VMs on two separate Hyper-V hosts.
- For Zero-Trust Secure Private Access (SPA) only deployment use case, you will create a VM with a single network interface. If you have a VM with more than one network interface, only a single interface will be used by the cyber gateway.
¶ Pre-requisites
- Hyper-V with version 10.0.x or above
- Valid Administrator credentials to deploy or manage VMs/Networks
- Ubuntu ISO - download it from here
- Resume downloading of image if it stops. Sometimes it happens because of the size of the image
- Download and store ISO in on local hard drive
- Existing network configuration which provides Internet access as well as connectivity to private resources
Hyper-V network subnet must be from same subnet which users will access remotely. Same subnet must provide Internet connectivity to CGW VM.
¶ How to Create a VM for the Cyber Gateway?
¶ Login to VMWare ESXi host
- Open Hyper-V Manager UI and click on New
- Click on Virtual Machine…
- Specify VM Name and click on Next
- Select Generation 1 and click on Next
- Specify Memory [minimum 2GB] and click on Next
- Configure Networking, by selecting Connection.
Selected network must provide access to Internet as well as connectivity to private resources which users want to access remotely.
- Specify Hard Disk Size [minimum 30GB] and click on Next
- Select Installation Media. Click on Browse and navigate to path where the ISP is downloaded
- Select the ISO which was downloaded previously in first step. Click on Next
- Verify VM summary and click on Finish
- From Hyper-V UI, select the CGW VM, right click and select Settings…
- Select Processor and specify no. of CPU or processors [minimum 2]
- Click on Apply and OK
- On Hyper-V UI, select CGW VM, right client and click on Start to power on
- Connect to CGW VM
- On Hyper-V UI, select VM, right click and select Connect option
- Follow typical Ubuntu installation steps as UI displays. For reference, all the installation steps can be checked below:
- Select interface Name
- Press space button to expand
- Select Edit IPv4 and press space button to expand
- If ESXi network provides DHCP IP then select Automatic (DHCP)
- If ESXi network does not provide DHCP IP, then select Manual and configure IP address
- Save configuration and continue
- Provide inputs, and specify username with password
- Select Install Open SSH Server and press Done
- Press enter on Reboot now, after installation/updates
- Once VM boots, press Enter, when VM console displays Remove installation medium and press enter
- Login to VM using username and password which was created during installation
- After login check VM has an IP address with DHCP or manual configuration [Use ip addr command to check configuration]
- Check WAN connectivity [Use ping 8.8.8.8 and ping google.com]
- In case DNS resolution fails, add nameservers 8.8.8.8 entry in /etc/resolv.conf and try ping google.com again
- Check internal/private application servers on the LAN are accessible from the VM.
- Ping internal/private application server IP to verify connectivity
Internet / WAN connectivity is required to install CGW software and connect it to Cyber Mesh
- SSH to CGW VM IP, which will be required to copy command on VM terminal
¶ Create a Cyber Gateway
To create a Single-Interface Cyber Gateway (CGW-SIF), follow the steps below.
- Navigate to the MSP admin console -> Client Workspace
- Click on Sites in the left menu bar → Add Gateway
- Make sure Single-Interface is selected
- Enter a Name for the cyber gateway, admin email to receive notifications or alerts
- Select User Groups if already created or skip if no there is no additional requirement, admin can add/delete user group association later also.
- Select HA yes, in case high availability is required
- Click Save
¶ Deploy the Cyber Gateway
- Copy the install command for the cyber gateway you just created as shown in the screenshot below
- Paste the install command in the machine's SSH console/terminal
- Press Enter
In case, you are unable to login to machine using SSH to copy and run CGW install command, then we recommend you to run pre-install script mentioned below. You have to type it on console, because copy paste won't work on some direct machine consoles.
bash <(curl -s https://s3-api.speerity.net/cgw/scripts/cgwctl.sh)Please share Workspace and CGW names with us on support@exium.net. We will push installation remotely.
The CyberGateway deployment will start. At this time, you can leave the deployment running unattended. You will receive an email on the admin email that you specified earlier when the deployment is complete. You can also check the status of the cyber gateway in the Exium admin console. When cyber gateway is deployed successfully and connected, you will see a Green Connected Status as in the screenshot below.
Post successful deployment, subnet of the CyberGateway machine's interface will be added as a Trustpath automatically. It will be associated to “workspace” group category, i.e. all the users in workspace will be able to access the resources on that private subnet. You can edit group association any time as per requirement. You may create new user groups and associate them with the trust path.
Once the CyberGateway is deployed successfully and connected, you can start testing the Zero Trust Secure Private Access policies.
Additional trust paths can be added manually. In case additional trust paths have different next hops, then those can also be configured from admin console. In case additional trust path subnets are already accessible via Cybergateway's default gateway then next hop configuration is not required.
You can follow below steps to add additional trust path subnets with or without their next hop.
- Click on Zero-Trust Paths
- Select CyberGateway from drop down list
- Click on Add Trust Path
- Provide Network Destination or private subnet to allow access for remote users
- Provide Next HOP Gateway IP, if it is different from default gateway of CyberGateway machine
Make sure next hop gateway IP is accessible from CyberGateway machine, else route configuration will fail
- Select Allowed User Groups or leave workspace group associated in case whole organization is allowed to access that subnet
- Save the configuration [CGW will pull configuration, and routes will be added after few mins.]
- Additional trust path configuration can be modified later as per requirement or when the next hop changes
Do not add next hop configuration in the default trust path which is created automatically by CyberGateway post deployment.
¶ Uninstall CyberGateway
Uninstall can be done from admin console or using CGW CLI commands
¶ From Admin console
- Navigate to the MSP admin console -> Client Workspace
- Click on Sites → Cyber Gateways in the left menu bar
- Select the CyberGateway you want to uninstall and click on the icon show in screenshot
- It will take around 5 ~10 mins complete uninstallation
¶ On CyberGateway terminal using command line
To uninstall CyberGateway from CyberGateway system directly
- SSH to CyberGateway
- type “sudo -s” to switch to root
- Run following command on terminal to uninstall
cgw uninstall