Deploy ASMS on the cloud

This topic describes how you can deploy ASMS on Amazon AWS or Microsoft Azure to manage your devices from the cloud.

Note: Each installation package includes software for the full AlgoSec Security Management Suite. Functionality for each ASMS product is enabled via license, and not by installation.

Deploy ASMS on AWS

Deploy ASMS on an AWS instance using an ASMS AMI available from the AlgoSec Portal.

Refer to Hardware minimum requirements.

For AWS deployments, we also recommend:

  • Using machines from the Amazon EC2 General Purpose M5 family, compatible with CentOS 7.

  • Ensuring that your AWS instance includes high-performance storage. Use Amazon gp3 volumes (SSD-based).

  • When deploying your first AWS AMI, you must accept the CentOS 7 image (CentOS 7 (x86_64) with updates HVM by CentOS org) in your AWS console. You only need to do this once and not for every VM.

For more details, see the AWS Documentation.

Do the following:

  1. Deploy your AWS AMI.

    1. On the Download AlgoSec Security Management Suite > AMI page, select an AWS Region and enter your AWS Account ID. The AlgoSec AMI is shared with your account. For details, see Download ASMS software packages.

    2. During the Add Storage phase of the setup process, increase disk space on your AWS instance. See Increase disk space of a new AWS instance.
    3. When the setup process is complete, you are notified and provided with the details required to access your new instance with ASMS.

  2. After launching your instance from AMI, run the following command in order to get better disk performance:

    sudo dd if=/dev/nvme0n1 of=/dev/null bs=1M

    Note: this step may take several minutes up to several hours, depending on your EC2 instance bandwidth, the IOPS provisioned for the volume and the size of the volume.

  3. If you are deploying clusters or distributed architectures, continue with Deploy clusters and distributed architectures.

    Otherwise, continue with deploying ASMS products, including populating your environment with devices and users. For details, see ASMS deployment checklist.

Deploy ASMS on Microsoft Azure

The following instructions explain how to deploy ASMS over an Azure VM.

Note: Currently, the following Microsoft Azure regions are supported:

  • North Europe

  • West Europe

  • East US

  • South Central US

  • Central US

  • Australia East

  • UAE North

If your region is not currently supported, contact your AlgoSec Account Manager.

Important: When deploying a complex Azure-based environment including LDUs and RAs, the Azure hostname length must not exceed 7-characters.

Refer to Hardware minimum requirements.

For Azure deployments:

  • Ensure that your machine is compatible with CentOS 7. We recommend machines from D-series.

  • Ensure that your Azure instance includes high performance storage, specifically Premium SSD P-20 and above.

  • It is highly advised that you disable hyperthreading on Azure VMs running ASMS prior to deploying the machine. AlgoSec has observed improved performance under heavy workloads. See Disable Hyper-threading on Azure Instance.

Note: ASMS supports deployment of the AlgoSec VHD into Azure on any General Purpose VM-Type. Many customers choose the VM-Type to deploy based on the resource requirements set forth for ideal performance & scalability in their specific AlgoSec Architecture Recommendation, received from AlgoSec. Since ASMS does not make use of Hyperthreading at this time, ensure that the VM-Type selected for an Azure based deployment provides sufficient logical CPU cores, as outlined in your AlgoSec Architecture Recommendation.

For more details, see the Azure Documentation.

Do the following:

Before you start: The parameter values in the following steps, <image_path>, <subscription_id>, <Application Name>, <applicationId>, <sourceTenantId> and <secret> can be obtained from this AlgoPedia article (requires credentials).

  1. Access https://portal.azure.com/#home using Azure Admin username and password. Microsoft Azure opens.

  2. Click Resource Groups. The Resource Groups page opens.

    Note: if you do not have available resource groups, create one using:

  3. Get your tenant ID:

    1. Click the Cloud Shell icon. The Azure Cloud Shell Console opens.

    1. In the Azure Cloud Shell console, run the command: 

      az account show

    1. The tenant ID (tenantId) is returned.

      Important: There may be several tenantId's in the results. The relevant one is under "state": "Enabled":

    2. Save the Tenant ID to use in the next step.

  4. In another browser window, navigate to the following url:

    https://login.microsoftonline.com/<tenantId>/oauth2/authorize?client_id=<Application_ID>&response_type=code&redirect_uri=https%3A%2F%2Fwww.microsoft.com%2F

    • Replace tenantId with your saved value.

    • Replace <Application_ID> with value obtained from HERE (requires credentials).

    A verification message appears. Click Accept. The app registration object is created on your tenant.

    You are redirected to microsoft.com (you can close the tab at this point).

    To verify that the app registration object is created on your tenant:

    1. Go to https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade.

    2. Search for AlgoSec Registry. AlgoSec Registry should be found.

  5. In the Azure Cloud Shell console, login to the Azure Gallery Application by running the following commands: 
    az login --service-principal -u '< Application_ID >' -p '<secret>' --tenant '<source_tenant_id>'
az login --service-principal -u '< Application_ID>' -p '<secret>' --tenant ' tenantId '
  6. Add permissions to your resource group. To grant user access to a resource group:

    1. Go to the Resource Groups page.

    2. Click your Resource Group. The Resource Group Overview opens.

    3. Select Access control (IAM).

    4. Select + Add > Add role assignment.

    5. Click Privileged Administrator Roles

    6. Select Contributor role and click Next. The Add Role Assignment page opens.

    7. Select Assign access to a user, group, or service principal.

    8. Click +Select members. The list of members appears to the right side of the screen.

    9. Select your Application Name, obtained from HERE (requires credentials). Click Select.

  7. To create a VM from the latest ASMS version, run the following command: 
    az vm create --resource-group <Resource Group Name> --name <vmName> --image "<image_path>" --admin-username azureuser --generate-ssh-keys
    • Replace <Resource Group Name> with the name of your resource group.
    • Replace <vmName> with any name you choose to call your new VM.
    • Replace <image_path> with the value obtained from HERE (requires credentials).

  1. When the Azure VM is available, if the root user is locked, unlock it as follows:

    1. Log in to the virtual machine via CLI using the Azure VM user credentials.

    2. Run the command: 

      echo "<Azure VM user password>" | sudo -S echo;echo "<new root password>" | sudo passwd --stdin root

      The root user is now unlocked and you can log into it using the password you gave in the command.

  2. Disable hyperthreading (best practice). See Disable Hyper-threading on Azure Instance.

If you require additional storage beyond the default, to increase disk space on your Azure instance. See Increase disk space of an Azure instance.

If you are deploying clusters or distributed architectures, continue with Deploy clusters and distributed architectures.

Otherwise, continue with deploying ASMS products, including populating your environment with devices and users. For details, see ASMS deployment checklist.