Bootstrap Configuration Example for VM-Series

Using bootstrap option significantly simplifies VM-Series initial configuration setup.

In this document, we provide a bootstrap example to set up an “Allow All” and Egress NAT policy for the VM-Series to validate that traffic is indeed sent to the VM-Series for VPC to VPC traffic inspection. This example does not use Panorama.

For a manual setup, follow manual setup example.

1. Create IAM Role and Policy

Login to AWS console, create an IAM role with the name, for example, “bootstrap-VM-S3-role”. Attach an IAM policy with the name, for example, “bootstrap-VM-S3-policy”. The policy has the following statements.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

2. Create bootstrap bucket structure

In AWS S3, at the top level create a bucket for bootstrap with a unique name, for example “bootstrap_bucket”, with the following structure:

bootstrap-bucket/
  config/
    init-cfg.txt
    bootstrap.xml
  content/
  license/
  software/

bootstrap_bucket

3. Upload config files

3.1 The example bootstrap.xml file contains the “Allow All”, Egress and API admin setup. To downloady the file, click bootstrap.xml.

3.2 For the example init-cfg.txt file, click init-cfg.txt.

Note

In the example bootstrap.xml, the API admin user name is avxadmin. You can customize it.

3.3 upload these two files to your config folder in the bootstrap-bucket.

4. Launch the VM-Series instance

Follow the Aviatrix Firewall Network (FireNet) workflow to Step 7a..

Fill in the required fields. Click Advanced. Fill in the following parameters.

Advanced Field Example Value
IAM Role bootstrap-VM-s3-role
Bootstrap Bucket Name bootstrap-bucket (must be a unique name in S3)

Launch the VM-Series instance. Wait for 15 minutes for it to boot up and initialize.

Login to the HTTPS interface of VM-Series management public IP with username “admin”, password “Aviatrix123#”

5. Configure API Vendor Integration

In order for the Aviatrix Controller to automatically update firewall instance route tables, monitor the firewall instance health and manage instance failover, you need to setup API access permissions.

Go to Controller -> Firewall Network -> Vendor Integration -> Firewall. Note the following fields.

  • Firewall Login User Name field, use “avxadmin” without the double quotes.
  • Firewall Login Password field, use “Aviatrix123#” without the double quotes.

Follow the instructions here to enable API access.

6. Ready to go!

Now your firewall instance is ready to receive packets!

The next step is to specify which Security Domain needs packet inspection by defining a connection policy that connects to the firewall domain. This is done by Step 8 in the Firewall Network workflow.

For example, deploy Spoke-1 VPC in Security_Domain_1 and Spoke-2 VPC in Security_Domain_2. Build a connection policy between the two domains. Build a connection between Security_Domain_2 to Firewall Domain.

Launch one instance in Spoke-1 VPC and Spoke-2 VPC. From one instance, ping the other instance. The ping should go through.

7. View Traffic Log

You can view if traffic is forwarded to the firewall instance by logging in to the VM-Series console. Click Monitor. Start ping packets from one Spoke VPC to another Spoke VPC where one or both of Security Domains are connected to Firewall Network Security Domain