Black Ridge BR-2120 Manual de usuario

BlackRidge BR-2120

Gateway for AWS

Setup Guide

BlackRidge Technology Inc.

10615 Professional Circle Suite 201

Reno, NV 89521

U.S.A

Part No. 2120-0030-01

Revision 1.0, September 2016

Preface.................................................................................................................................. 7

About This Guide......................................................................................................................... 7

Related Material ................................................................................................................... 8

Who Should Use This Guide ........................................................................................................ 9

How This Guide is Organized .................................................................................................... 10

Typographical Conventions....................................................................................................... 11

SECTION I ............................................................................................................................ 12

Task Map for the BlackRidge BR-2120 TAC Gateway for AWS............................................... 13

SECTION II ........................................................................................................................... 14

Identify Security Use Case & BlackRidge Solution Requirements ........................................... 15

Security Problem....................................................................................................................... 15

Setup Requirements ................................................................................................................. 15

VPC Requirements for the BR-2120 Gateway for AMS ......................................................... 16

Select Resources to Trust and to Protect .............................................................................. 17

Criteria to Determine Role(s) ............................................................................................... 18

Trusted Hosts: ................................................................................................................... 18

Protected Resources:......................................................................................................... 18

Design the Network Topology.............................................................................................. 19

Port Assignments for the BR-2120 Gateway for AWS............................................................ 20

SECTION III .......................................................................................................................... 21

Create and Configure Virtual Private Cloud .......................................................................... 22

Task: Create VPC ....................................................................................................................... 23

Task: Configure Internet Gateway ............................................................................................ 24

Task: Create Subnets................................................................................................................. 25

Task: Create Route Tables......................................................................................................... 27

Task: Create Route Under the MGMT Route Table................................................................... 30

Task: Create Security Groups .................................................................................................... 31

SECTION IV .......................................................................................................................... 35

Launch and Configure a Gateway AMI Instance ................................................................... 36

Task: Configure and Launch an AMI Instance........................................................................... 36

Task: Stop the AMI Instance ..................................................................................................... 42

Task: Review Settings of the eth0/Management Interface for the AMI Instance .................... 42

Task: Create Additional Interfaces for the AMI Instance.......................................................... 43

Task: Attach Additional Interfaces to the AMI Instance ........................................................... 45

Task: Allocate a New Elastic IP Address for the MGMT Interface ............................................ 46

Task: Associate Elastic IP with MGMT Interface....................................................................... 47

Task: Modify Route Table for (Trusted + Protected) Side of BRT GW....................................... 49

Task: Disable Source/Destination Check for Untrusted and Trusted Interfaces....................... 51

Task: Disable Source/Destination Check for Untrusted and Trusted Interfaces....................... 53

Task: Associate Elastic IP with the Public/Untrusted Interface ................................................ 54

SECTION V ........................................................................................................................... 55

Deploy a Jump Host into the MGMT Subnet in VPC .............................................................. 56

Task: Create the Jump Host Instance........................................................................................ 57

Task: Assign an Elastic IP to the Jump Host .............................................................................. 64

SECTION VI .......................................................................................................................... 68

Deploy a (Trusted + Protected) Host into Trusted Subnet in VPC ........................................... 69

Task: Provision an Instance of the Amazon Linux AMI ............................................................. 70

Task: Check Boot Status through AWS CLI................................................................................ 76

Task: SSH into Trusted + Protected Instance............................................................................. 77

Task: Configure Static Networking and Routes on the Trusted + Protected Instance .............. 78

SECTION VII ......................................................................................................................... 80

Configure Layer 3 NAT –External-to-VPC (Unidirectional) .................................................... 81

Task: Inserter –Generate and Export SKEY................................................................................... 86

Task: Resolver –Import SKEY........................................................................................................ 86

Task: Inserter –Add NAT and Routes............................................................................................ 86

Task: Inserter –Add NAT and Routes............................................................................................ 87

Task: Inserter –Add and Enable Identity ...................................................................................... 88

Task: Inserter –Create Trusted Host and Associate Identity ........................................................ 88

Task: Resolver –Add and Enable Identity Using SKEY .................................................................. 89

Task: Resolver –Add Protected Resource ..................................................................................... 89

Task: Resolver –Add Rule and Link Identity.................................................................................. 90

Task: Inserter –Enable Enforce Mode .......................................................................................... 90

Task: Resolver –Enable Enforce Mode ......................................................................................... 90

SECTION VIII ........................................................................................................................ 91

Configure Layer 3 NAT –VPC-to-VPC (Bidirectional) ............................................................. 92

Task: Inserter + Resolver –Add NAT and Routes .......................................................................... 94

Task: Inserter + Resolver –Configure Trusted Host and Protected Resource............................... 95

Task: Inserter –Generate and Export SKEY................................................................................... 95

Task: Resolver –Import SKEY........................................................................................................ 96

Task: Inserter –Add and Enable Identity ...................................................................................... 96

Task: Inserter –Associate Identity with Trusted Host................................................................... 97

Task: Resolver –Add and Enable Identity Using SKEY .................................................................. 97

Task: Resolver –Add Rule for and Link Identity to Protected Resource ....................................... 97

Task: Inserter –Enable Enforce Mode .......................................................................................... 98

Task: Resolver –Enable Enforce Mode ......................................................................................... 98

SECTION IX .......................................................................................................................... 99

Add Certificates to BlackRidge TAC Gateway...................................................................... 100

Initiate a BlackRidge Certificate Signing Request (CSR)....................................................... 101

Task: Generate BlackRidge TAC Gateway Keys ...................................................................... 102

Task: Generate a Certificate Signing Request (CSR) ............................................................... 102

Loading the BlackRidge Technology-Signed Certificates ........................................................ 103

Task: Extract the Encrypted Certificate File ............................................................................ 103

Importing Certificates into TAC Gateway ............................................................................... 107

Task: Import the Root and Intermediate Certificates ............................................................. 107

Task: Import the BlackRidge TAC Gateway Certificates ......................................................... 108

Task: Validate the BlackRidge TAC Gateway Certificates....................................................... 108

SECTION X ......................................................................................................................... 109

Testing the Configuration .................................................................................................. 110

Task: Test the Gateways’ Ability to Route Locally in Layer 3 Mode ........................................... 110

Task: Test the Trusted + Protected Connection Using SSH ......................................................... 110

SECTION XI ........................................................................................................................ 111

Set Transport Access Control (TAC) Mode of Operation ...................................................... 112

Task: Display TAC Mode.......................................................................................................... 113

Task: Set TAC Mode as “Bridge” ............................................................................................. 113

Task: Set the TAC Mode as “Monitor” .................................................................................... 114

Task: Set the TAC Mode as “Enforce” ..................................................................................... 114

Congratulations................................................................................................................. 115

Appendix A: Accessing the BlackRidge Gateway (SSH)........................................................ 116

Using PuTTY and SSH to Access the Gateways ....................................................................... 116

Appendix B: CLI Commands for Configuring the IP Network Attributes of the BlackRidge TAC

Gateway ........................................................................................................................... 119

Configure DHCP Network Settings for the Management Port ............................................... 119

cfg (static IP) - Configure IPv4 Network Settings for the Management Port ......................... 120

/etc/mgt/ipv6/ –Configure an IPv6 Address on the admin Port ......................................... 121

add –Associate IPv6 Addresses with the Management Port................................................. 121

del –Remove IPv6 Addresses from the Management Port ................................................... 121

disable –Disable IPv6 on the Admin Port............................................................................... 122

enable –Enable IPv6 on the Admin Port ................................................................................ 122

mod –Modify IPv6 Address on the Admin Port ..................................................................... 123

Appendix C: CLI Commands for Configuring the DNS Network Attributes of the BlackRidge TAC

Gateway ........................................................................................................................... 124

/etc/dns/ - DNS Configuration ........................................................................................... 124

cfg - Configure DNS ................................................................................................................. 124

show - Show DNS Settings ...................................................................................................... 125

Appendix D: CLI Commands for Configuring the Host Name Attributes of the BlackRidge TAC

Gateway ........................................................................................................................... 126

/etc/hostname/ - Host Name and Domain Name Configuration......................................... 126

cfg - Configure Hostname ....................................................................................................... 126

show - Show the Hostname and Domain Name..................................................................... 127

This document is protected by copyright and distributed under licenses restricting its use,

copying, distribution and decompilation. No part of this document may be reproduced in any

form by any means without prior written authorization of BlackRidge Technology Inc.

Documentation is provided as is without warranty of any kind, either expressed or implied,

including any kind of implied or expressed warranty of non-infringement or the implied

warranties of merchantability or fitness for a particular purpose.

BlackRidge Technology Inc. reserves the right to change any products described herein at any

time and without notice. BlackRidge Technology Inc. assumes no responsibility or liability

arising from the use of products described herein, except as expressly agreed to in writing by

BlackRidge Technology Inc. The use and purchase of this product does not convey a license

under any patent rights, trademark rights or any other intellectual property rights of BlackRidge

Technology Inc.

Document Part Number: 2120-0030-01

Preface

About This Guide

The BlackRidge BR-2120 is a TAC Gateway for Amazon™ Web Services (AWS). There are a

number of initial tasks that must be completed to set up the TAC Gateway(s) for network access

and operation. This document contains the instructions for deploying a single BlackRidge TAC

Gateway into the AWS Elastic Compute Cloud (EC2) cloud server.

The setup instructions are divided into a number of categories, each of which contains one or

more basic tasks to complete. These tasks are designed to simplify the overall process of setting

up your gateway(s) to be operational and connected to the network.

This Setup Guide provides guidance in the following procedures:

Identifying resource requirements

Selecting resources to trust and protect

Designing a network topology

Creation of a Virtual Private Cloud (VPC)

Deployment of a Gateway from AMI

Deployment of a Management Instance in AWS

Deployment of trusted hosts/protected resources in AWS

Configuration of Layer 3 mode for the Gateway in AWS

Connecting an Insertion Gateway in an external network to a Resolving Gateway in AWS

(Unidirectional)

Connecting an Insertion Gateway to a Resolving Gateway in AWS between VPCs

(Bidirectional)

Testing the configuration

Use this Setup Guide as the prerequisite to the BlackRidge TAC Gateway - Quick Start Guide.

Related Material

The BlackRidge documentation set consists of:

BlackRidge TAC Gateway - Getting Started Guide provides a high-level roadmap for

leveraging the documentation set to successfully install and configure each model of the

BlackRidge family of gateway products.

BlackRidge BR-3110 1G Branch TAC Gateway - Setup Guide outlines the steps required

to set up the gateway for network access and operation.

BlackRidge BR-2110 1G Virtual TAC Gateway - Setup Guide outlines the steps required to

set up the gateway for network access and operation.

BlackRidge BR-2210 10G Virtual TAC Gateway - Setup Guide outlines the steps required

to set up the gateway for network access and operation.

BlackRidge BR-3100 1G Enterprise TAC Gateway - Setup Guide outlines the steps

required to set up the gateway for network access and operation.

BlackRidge BR-3120/BR-3121 1G Enterprise TAC Gateway - Setup Guide outlines the

steps required to set up the gateway for network access and operation.

BlackRidge BR-3220-T/BR-3221-T 10G Enterprise TAC Gateway - Setup Guide outlines

the steps required to set up the gateway for network access and operation.

BlackRidge BR-3220-F 10G Enterprise TAC Gateway - Setup Guide outlines the steps

required to set up the gateway for network access and operation.

BlackRidge BR-3221-SR/BR-3221-LR 10G Enterprise TAC Gateway - Setup Guide outlines

the steps required to set up the gateway for network access and operation.

BlackRidge BR-2051 Gateway for IBM z Systems - Setup Guide outlines the steps

required to set up the gateway for network access and operation on the IBM z Systems

platform.

BlackRidge BR-2061 Gateway for z/VM Systems - Setup Guide outlines the steps

required to set up the gateway for network access and operation on the IBM z/VM®

platform.

BlackRidge BR-2120 Gateway for AWS - Setup Guide outlines the steps required to set

up the gateway for network access and operation on the Amazon Web Services™ (AWS)

platform.

BlackRidge TAC Gateway - Quick Start Guide describes the concepts and procedures to

configure cloaking and Static Identities for unidirectional authentication of IPv4 network

endpoints.

BlackRidge TAC Gateway - Configuration Guide describes the advanced concepts and

procedures to configure cloaking, Static and Dynamic AD Identities for bidirectional

authentication for multiple IPv4 and IPv6 network endpoints.

BlackRidge TAC Gateway –Command Reference Guide contains the descriptions of the

commands, arguments and options that are used by the administrator to set up,

configure, and maintain the BlackRidge TAC Gateways.

Who Should Use This Guide

This guide is intended for experienced systems and networking IT professionals who are

responsible for the initial setup of the BlackRidge BR-2120 TAC Gateway for AWS.

Tabla de contenidos

Manuales populares de Puerta de otras marcas

LST

LST M500RFE-AS Manual de usuario

Kinnex

Kinnex Media Gateway Manual de usuario

2N Telekomunikace

2N Telekomunikace 2N StarGate Manual de usuario

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZYWALL2 ET 2WE Manual de usuario

Telsey

Telsey CPVA 500 - SIP Manual de usuario

RTA

RTA 460A-NNA4 Hoja de especificaciones

Shaw

Shaw Gateway HDPVR Manual de usuario

ABB

ABB VSN900 Guía de inicio rápido

Commander

Commander Pulse Manual de usuario

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Manual de usuario

NETGEAR

NETGEAR C6300BD Manual de usuario

Amit

Amit CDW531AM Manual de usuario

HMS

HMS Netbiter EasyConnect EC150 Manual de usuario

Huawei

Huawei EchoLife HG620 Manual de usuario

AT&T

AT&T U-verse 3801 Manual de uso y cuidado

Logic IO

Logic IO RTCU MX2 turbo Manual de usuario

Suttle

Suttle MediaMAX MXM-521 Manual de usuario