WIXLIB

ProxySG on AWS MarketplaceBYOLDeployment GuideVersion 6.7.xGuide Revision: 10/7/2019SGOS for AWS MarketplaceDeployment Guide

Symantec SGOS on AWS Deployment Guide 6.7.xLegal NoticeCopyright 2019 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, andthe Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries.Other names may be trademarks of their respective owners. This document is provided for informational purposes only and isnot intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimedto the maximum extent allowed by law. The information in this document is subject to change without notice.THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONSAND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCHDISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FORINCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, ORUSE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TOCHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS, TECHNICAL SERVICES, AND ANY OTHERTECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL ANDSANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORTREGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONSAND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES,PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER INCOUNTRY OR IMPORT AFTER DELIVERY TO YOU.Symantec Corporation350 Ellis StreetMountain View, CA 94043www.symantec.com10/7/20192 of 27

TOCTable of ContentsAbout the ProxySG on AWS4Important Details about the ProxySG on AWS4Step 1: Complete Prerequisite Tasks5Step 2: Deploy the Instance6Step 3: Verify the Instance9Step 4: Install the License11Step 5: (Optional) Configure Elastic Load Balancing12Configure a Listener12Configure Health Checks13Back Up and Restore an Instance of the ProxySG14Create a Snapshot to Back Up Your ProxySG Instance14Restore an Instance of the ProxySG from a Snapshot15Create an AMI from a Snapshot of a ProxySG InstanceDeploy the Newly Registered AMI1516Troubleshoot the ProxySG on AWS17General Troubleshooting Steps17Troubleshoot Licensing Errors19Appendix A: Supported Configurations21Supported Instance Types21Storage and Network Settings22Appendix B: Metadata Reference23AWS Metadata23Appendix C: Additional Steps for Generating User Data25Generate User Data Files for Automatic Deployment of Instances25Supply User Data File While Deploying the Instance26About AWS User Data26AWS User Data Security273 of 27

Symantec SGOS on AWS Deployment Guide 6.7.xAbout the ProxySG on AWSThis guide provides instructions for deploying a ProxySG virtual appliance (Secure Web Gateway edition, SGOS version 6.7.x)running in Amazon Web Services (AWS) Marketplace. A ProxySG on AWS permits the same features and functionality as theSecure Web Gateway Virtual Appliance (SWG VA).This document guides you through the process of setting up a ProxySG on AWS. Deployment consists of the following steps:Deployment StepDocument ReferenceMake sure you have the required resources andfiles to deploy a ProxySG on AWS."Step 1: Complete Prerequisite Tasks" on page 5Launch the Amazon Machine Image (AMI) from theMarketplace, and configure it."Step 2: Deploy the Instance " on page 6Verify that you can access the instance throughSSH and the ProxySG Management Console."Step 3: Verify the Instance " on page 9Install the ProxySG license through the ProxySGManagement Console."Step 4: Install the License" on page 11Configure an AWS Elastic Load Balancer (ELB) formultiple ProxySG instances. This is an optionalstep."Step 5: (Optional) Configure Elastic Load Balancing" on page 12Create snapshots in AWS to capture the contents of "Back Up and Restore an Instance of the ProxySG" on page 14an Elastic Block Store (EBS) volume at specificpoints in time. This is a recommended step.Review the known issues in this release.SGOS Release Notes at MySymantecIf you encounter any issues while the ProxySG on AWS instance is running, refer to "Troubleshoot the ProxySG on AWS" onpage 17 in this guide for assistance.Note: For details beyond the scope of ProxySG documentation, refer to AWS /Important Details about the ProxySG on AWSFor the ProxySG on AWS, you can manage ProxySG instances through:nSSH to the CLInManagement ConsoleYou cannot access or manage a serial or VGA console to a virtual machine.4 of 27

Step 1: Complete Prerequisite TasksStep 1: Complete Prerequisite TasksBefore deploying the ProxySG on AWS, complete the following tasks:1. Prepare and verify your environment, including firewall configuration, Amazon Virtual Private Cloud (VPC)configuration, and security groups for the VPC. Refer to the Amazon documentation for . Allow the ProxySG instances access to the following Symantec vices.bluecoat.comYou need to allow these servers through any firewalls and security controls, such as Security Groups and NetworkAccess Control Lists (NACLs).You require access to these servers in order to retrieve and install the ProxySG license.3. Verify system requirements for the virtual appliance. See "Appendix A: Supported Configurations" on page 21.4. (Optional) Confirm that you are able to access the SSH private key (PEM file) that matches the public key you wantAWS to register with the EC2 instance.5. (If you intend to use load balancing) Understand how ELBs are deployed in AWS. Refer to AWS documentation cing.html5 of 27

Step 2: Deploy the InstanceStep 2: Deploy the InstanceDeploy the instance through the AWS Management Console.1. Log in to the AWS Management Console:a. Open a web browser window/tab.b. Go to the following URL: https://console.aws.amazon.com.The browser displays the AWS Management Console.2. In the AWS Management Console, select Services EC2.The browser displays the EC2 Dashboard.3. In the Create Instance section, click Launch Instance.The browser opens a wizard to guide you through the launch process.4. On the left menu on the EC2 dashboard, select AWS Marketplace.a. Step 1: Search for the AMI you want to launch and click Select.b. Step 2: Choose a supported instance type based on the license type you plan to deploy. Refer to "Appendix A:Supported Configurations" on page 21. The following are supported instance .10xlargeClick Next: Configure Instance Details.c. Step 3: Select the appropriate VPC and subnet, and (if required by your license) specify CPU options.nThe default number of CPUs for the instance type might be greater than the number of CPUs yourProxySG license allows, which can cause your license to be suspended when launching your ProxySGon AWS.To avoid your license being suspended, specify the number of CPUs your license requires. To specify thenumber of CPUs, select Specify CPU options. In Core count, enter the number of cores your license6 of 27

Symantec SGOS on AWS Deployment Guide 6.7.xallows (the number of cores you license allows is the number that follows the "C" in your license type,such as SG-VA-C1S has one core or SG-VA-C16L has 16 cores). In Threads per core, enter 1.Click Next: Add Storage.d. Step 4: Verify the storage settings are correct for your instance. For all supported instance types, the followingstorage settings are correct:nFor the Root volume, 8 GB of General Purpose SSDnFor each Data disk EBS volume, 100 GB of General Purpose SSD with 300 IOPS configuredFor the Data disk EBS volumes, ensure the correct number of virtual disks exist for your instance type.For more information, see "Appendix A: Supported Configurations" on page 21.Click Next: Add Tags.e. Step 5: (Optional) Create one or more tags for your instance by defining key-value pairs. Symantec recommendsat least assigning your instance a name (Key type is Name) so that you can easily identify it in the console.Click Next: Configure Security Group.f. Step 6: Create a new security group or select an existing one. Security groups allow you to control the inboundconnections to and outbound connections from your EC2 instance.Click Review and Launch.g. Step 7: Review the instance settings. Make corrections as needed.5. Launch the instance:a. In the AWS Management Console, click Launch.b. Either choose an existing keypair, create a new keypair,or proceed without a keypair.c. Accept the acknowledgment, and click Launch Instances.The browser displays the Launch Status page.6. In the "Your instances are now launching" message box, click the link to the instance.The browser displays the Instances page.7. Under Instance State, look for a status icon and an indication of the number of checks passed. If the instance launched7 of 27

Step 2: Deploy the Instancesuccessfully, you should see a green icon and "2/2 checks passed".If fewer than two checks passed (as follows), refer to the tabs at the bottom of the page.Click Status Checks to determine which check(s) failed and troubleshoot the problem(s). In the following example, theInstance Status Checks report a failure and provide a link for troubleshooting.8. Connect to your instance and complete the initial connection wizard:a. Open your preferred SSH client and connect to your instance with either the private or public IP addressassociated with the instance.b. Log in with the username config and one of the following:nThe private SSH key file that you associated with the instance during the launch processnThe initial password which is the instance ID (under the Description tab, you can copy and paste theInstance ID)c. Enter the serial number of the appliance.d. Enter the console username.e. Enter the console password and enter it again to verify it.f. Enter the enable password and enter it again to verify it.The appliance restarts to apply the new settings. The next time you access either the serial console orManagement Console, use the console username and password you entered to log in.9. Repeat the previous steps as needed to set up additional instances.Note: For multiple instances, you might want to set up a load balancer. If you do set up aload balancer, do so after you have verified the connectivity and license validity for allinstances. For ELB setup instructions, see "Step 5: (Optional) Configure Elastic LoadBalancing" on page 12.8 of 27

Step 3: Verify the InstanceStep 3: Verify the InstanceAfter you create the instance, verify that you can access it through SSH and the ProxySG Management Console.Note: To complete this step, you need the private key (PEM file) and/or the login credentialsthat you used to generate the user data file.1. Under Instances, select Instances. Locate the instance.2. Make sure that the Instance State says "running" and that Status Checks says "2/2 checks passed".If fewer than two checks passed, refer to the Status Checks tab to determine which checks failed, and troubleshootthe problems as suggested.3. Select the instance, right-click, and click Connect.Connect to the instance using a standalone SSH client, such as PuTTY. Follow the instructions on the dialog:Note: When connecting to your instance, use the console username you created and notthe ec2-user username.9 of 27