Download the latest available Cisco Crosswork Change Automation and Health Insights image file (*.ova) to your system.

With VMware ESXi running, log in to the VMware vSphere Web Client.

On the left navigation pane, choose the ESXi host on which you want to deploy the VM.

Choose Actions > Deploy OVF Template. The VMware Deploy OVF Template window appears, with the first step, 1 - Select template, highlighted.

Click Browse to navigate to the location where you downloaded the OVA image file and select it. Once selected, the file name is displayed in the window.

Click Next. The Deploy OVF Template window is refreshed, with 2 - Select name and location now highlighted.

Enter a name for the Cisco Crosswork Change Automation and Health Insights VM you are creating.

Click Next. The Deploy OVF Template window is refreshed, with 3 - Select a resource highlighted.

Select the Cisco Crosswork Change Automation and Health Insights VM’s host.

Click Next.

Review the OVF template that you are deploying. Note that this information is gathered from the OVF, and cannot be modified.

Click Next. The Deploy OVF Template window is refreshed, with 5 - Accept license agreements highlighted.

Review the End User License Agreement and click Accept.

Click Next The Deploy OVF Template window is refreshed, with 6 - Select configuration highlighted.

Select the desired deployment configuration (IPv4, IPv6, IPv4 Network on a Single Interface, or IPv6 Network on a Single Interface).

Note	In order for Cisco Crosswork Data Gateway to be deployed using a single interface, Cisco Crosswork Change Automation and Health Insights must be deployed using a single interface only.

Click Next. The Deploy OVF Template window is refreshed, with 7 - Select Storage highlighted.

Choose the relevant option from the Select virtual disk format drop-down list. From the table, choose the datastore you want to use, and review its properties to ensure there is enough available storage.

Click Next. The Deploy OVF Template window is refreshed, with 8 - Select networks highlighted.

From the Data Network and Management Network drop-down lists, choose an appropriate destination network.

Click Next The Deploy OVF Template window is refreshed, with 9 - Customize template highlighted. The Crosswork Configuration settings are expanded. Make an entry in the Disclaimer field.

Expand the Management Network settings.

Provide information for the IPv4 deployment (Management IPv4 Address, Management IPv4 Gateway, and Management IPv4 Netmask fields) or for the IPv6 deployment (Management IPv6 Address, Management IPv6 Gateway, and Management IPv6 Prefix fields) respectively.

Expand the Data Network settings.

Provide information for the IPv4 deployment (Data IPv4 Address, Data IPv4 Gateway, and Data IPv4 Netmask fields) or the IPv6 deployment (Data IPv6 Address, Data IPv6 Gateway, and Data IPv6 Prefix fields) .

Expand the Deployment Type settings, as shown in the following figure.

In the Deployment Type drop-down list, select New. You can leave the remaining fields blank or with the default values.

Expand the DNS and NTP Servers settings.

According to your deployment configuration (IPv4 or IPv6), the fields that are displayed are different. Provide information in the following three fields:

Disk Configuration settings allow you to adjust the amount of storage space available to Cisco Crosswork Change Automation and Health Insights. The default settings should work for most environments. For assistance in adding additional storage, contact the Cisco Customer Experience team.

Expand Crosswork Configuration and enter your legal disclaimer text (users will see this text if they log into the CLI).

Click Next. The Deploy OVF Template window is refreshed, with 10 - Ready to Complete highlighted, as shown in the following figure (template name will depend on the version you are installing).

Review your settings and then click Finish if you are ready to begin deployment. Wait for the deployment to finish before continuing. To check the deployment status:

1. Open a VMware vCenter client.

2. In the Recent Tasks tab of the host VM, view the status of the Deploy OVF template and Import OVF package jobs.

After the deployment tasks are complete, check the host's VM settings to permit boot from the Extensive Firmware Interface (EFI):

1. Under the host VM's Summary tab, below the VM Hardware table, click Edit Settings, as shown in the following figure.

   

2. On the Edit Settings window, click the VM Options tab.

3. Expand the Boot Options drop-down list and change the Firmware setting to EFI, if it is not set by default, and click OK. We recommend that you take a snapshot of the VM at this point.

   

You can now power on the Cisco Crosswork Change Automation and Health Insights VM to complete the deployment process. Expand the host’s entry, click the Cisco Crosswork Change Automation and Health Insights VM, and then choose Actions > Power > Power On.

After the Cisco Crosswork Change Automation and Health Insights VM is powered on, wait for 20 minutes, and then launch the console.

At the login prompt, enter the default administrator username, cw-admin, and the corresponding default password, cw-admin. When prompted to change the password, enter the default password again for verification, and then enter and confirm the new password as prompted. Follow the instructions on the screen to create a strong password.

If you see instructions to check firstBoot.log, use the command sudo cat /var/log/firstBoot.log to view the log file. If you find any discrepancy and want to investigate further, see Troubleshoot the Installation. After you have identified the error, perform the following:

1. Power off the Cisco Crosswork Change Automation and Health Insights VM.

2. Delete the Cisco Crosswork Change Automation and Health Insights VM from the disk.

3. Repeat the installation procedure, while rectifying the error that prevented the installation from completing.

4. Relaunch the console.

Launch one of the supported browsers (see Supported Web Browsers).

In the browser's address bar, enter:

https://<Crosswork_VM_management_IPv4_adddress>:30603/

https://[<Crosswork_VM_management_IPv6_adddress>]:30603/

Log in to Cisco Crosswork Change Automation and Health Insights as follows:

1. Enter the Cisco Crosswork Change Automation and Health Insights administrator username admin and the default password admin.

2. Click Log In.

3. When prompted to change the Cisco Crosswork Change Automation and Health Insights administrator's default password, enter the new password in the fields provided and then click OK.

To exit the GUI, close the browser window or click at the top-right corner of the home page and choose Log out.

Download the latest available Cisco Crosswork Data Gateway image file from CCO (*.ova).

Connect to vCenter vSphere Client. Then select Actions > Deploy OVF Template, as shown in the following figure:

The VMware Deploy OVF Template wizard appears and highlights the first step, 1 Select template.

1. Click Browse to navigate to the location where you downloaded the OVA image file and select it.

   Once selected, the filename is displayed in the window.

Click Next to go to 2 Select name and location, as shown in the following figure.

1. Enter a name for the Cisco Crosswork Data Gateway VM you are creating.

2. In the Select a location for the virtual machine list, choose the datacenter under which the Cisco Crosswork Data Gateway VM will reside.

   
   

   

   
   

Click Next to go to 3 Select a resource. Choose the VM’s host.

Click Next. The VMware vCenter Server validates the OVA. Network speed will determine how long validation takes. When the validation is complete, the wizard moves to 4 Review details. Review the OVA’s information and then click Next.

Click Next to go to 5 accept license agreements. Review the End User License Agreement and click Accept.

Click Next to go to 6 Select configuration, as shown in the following figure. To install Cisco Crosswork Data Gateway for Cisco Crosswork Change Automation and Health Insights, you must select Crosswork On Premise from the Configuration dropdown.

Click Next to go to 7 Select storage, as shown in the following figure.

1. Cisco recommends that you select Thick provision lazy zeroed from the Select virtual disk format drop-down list.

2. From the Datastores table, choose the datastore you want to use and review its properties to ensure there is enough available storage.

Click Next to go to 8 Select networks, as shown in the following figure. In the dropdown table at the top of the page, choose the appropriate destination network for each source network, vNIC2, vNIC1, and vNIC0 respectively.

Click Next to go to 9 Customize template, with the Host Information Settings already expanded. As per the deployment scenario chosen by you in Section: Cisco Crosswork Data Gateway OVF Parameters and Deployment Scenarios, enter the information for the parameters:

1. Host Information

   • Hostname: Hostname of the server specified as a fully qualified domain name (FQDN).

     Note	For larger systems it is likely that you will have more than one Cisco Crosswork Data Gateway instance. The Cisco Crosswork Data Gateway hostname should, therefore, be unique and created in a way that makes identifying a specific instance easy.

   • Description:A detailed description of the Cisco Crosswork Data Gateway instance.

   • Label: Label used by Crosswork to categorize and group multiple Cisco Crosswork Data Gateway instances.

   • Active vNICs: Number of vNICs to use for sending traffic. You can choose to use either 1, 2, or 3 vNICs as per the following combinations:

     • 1 - sends all traffic through vNIC0.

     • 2 - sends management traffic through vNIC0 and all data traffic through vNIC1.

     • 3 - sends management traffic through vNIC0, Southbound data through vNIC1, and Northbound data on vNIC2.

   • Private Key URI: SCP URI to private key file for session key signing. You can retrieve this using SCP (user@host:path/to/file).

   • Certificate File URI: SCP URI to PEM formatted signing certificate chain for this VM. You can retrieve this using SCP (user@host:path/to/file).

   • Certificate File and Key Passphrase: SCP user passphrase to retrieve the Cisco Crosswork Data Gateway PEM formatted certificate file and private key.

2. Passphrases

   • dg-admin Password: The password you have chosen for the dg-admin user.

   • dg-oper Password: The password you have chosen for the dg-oper user.

   Note

   Cisco Crosswork Data Gateway supports either IPv4 or IPv6 for vNIC0, vNIC1, and vNIC2 interfaces. For the interface(s) and protocol you choose to use, select Method as Static and enter information in Address, Netmask, and Gateway fields. The default value is None. Crosswork does not support dual stack configurations. Therefore, ALL addresses for the environment must be either IPv4 or IPv6.

3. vNIC0 IPv4 Address

   • vNIC0 IPv4 Method: How the vNIC0 interface gets its IPv4 address.

   • vNIC0 IPv4 Address: IPv4 address of the vNIC0 interface.

   • vNIC0 IPv4 Netmask: IPv4 netmask of the vNIC0 interface in dotted quad format.

   • vNIC0 IPv4 Gateway: IPv4 address of the vNIC0 gateway.

   An example is shown below:

   
   

   

   
   

4. vNIC0 IPv6 Address

   • vNIC0 IPv6 Method: How the vNIC0 interface gets its IPv6 address.

   • vNIC0 IPv6 Address: IPv6 address of the vNIC0 interface.

   • vNIC0 IPv6 Netmask: IPv6 netmask of the vNIC0 interface in dotted quad format.

   • vNIC0 IPv6 Gateway: IPv6 address of the vNIC0 gateway.

5. vNIC1 IPv4 Address

   • vNIC1 IPv4 Method: How the vNIC1 interface gets its IPv4 address.

   • vNIC1 IPv4 Address: IPv4 address of the vNIC1 interface.

   • vNIC1 IPv4 Netmask: IPv4 netmask of the vNIC1 interface in dotted quad format.

   • vNIC1 IPv4 Gateway: IPv4 address of the vNIC1 gateway.

6. vNIC1 IPv6 Address

   • vNIC1 IPv6 Method: How the vNIC1 interface gets its IPv6 address.

   • vNIC1 IPv6 Address: IPv6 address of the vNIC1 interface.

   • vNIC1 IPv6 Netmask: IPv6 netmask of the vNIC1 interface in dotted quad format.

   • vNIC1 IPv6 Gateway: IPv6 address of the vNIC1 gateway.

7. vNIC2 IPv4 Address

   • vNIC2 IPv4 Method: How the vNIC2 interface gets its IPv4 address.

   • vNIC2 IPv4 Address: IPv4 address of the vNIC2 interface.

   • vNIC2 IPv4 Netmask: IPv4 netmask of the vNIC2 interface in dotted quad format.

   • vNIC2 IPv4 Gateway: IPv4 address of the vNIC2 gateway.

8. vNIC2 IPv6 Address

   • vNIC2 IPv6 Method: How the vNIC2 interface gets its IPv6 address.

   • vNIC2 IPv6 Address: IPv6 address of the vNIC2 interface.

   • vNIC2 IPv6 Netmask: IPv6 netmask of the vNIC2 interface in dotted quad format.

   • vNIC2 IPv6 Gateway: IPv6 address of the vNIC2 gateway.

9. DNS and NTP

   • DNS Address: Space-delimited list of IPv4/IPv6 addresses of the DNS server accesible from the management interface.

   • DNS Search Domain: DNS search domain

   • NTP Servers: Space-delimited list of IPv4/IPv6 addresses or hostnames of the NTP servers accessible from the management interface.

     Note

     You must enter a value here, such as pool.ntp.org. NTP server is critical for time synchronization between Cisco Crosswork Data Gateway VM, Cisco Crosswork Change Automation and Health Insights, and devices. Using a non-functional or dummy address may cause issues when Crosswork and Cisco Crosswork Data Gateway try to communicate with each other. If you are not using an NTP server, ensure that time gap between Cisco Crosswork Data Gateway and Cisco Crosswork Change Automation and Health Insights is not more than 10 minutes. Else, Cisco Crosswork Data Gateway will fail to pull images.

10. Syslog Servers

    • Server Address: IPv4 or IPv6 address of a syslog server accessible from the management interface.

      Note	If you are using an IPv6 address, it must be surrounded by square brackets ([1::1]).

    • Syslog Port: Port number of the syslog server.

    • Syslog Protocol: Use UDP, TCP, or RELP when sending syslog.

    • Use Syslog over TLS?: Use TLS to encrypt syslog traffic.

    • TLS Peer Name: Syslog server's hostname exactly as entered in the server certificate SubjectAltName or subject common name.

    • Syslog Root Certificate File URI: PEM formatted root cert of syslog server retrieved using SCP.

    • Syslog Certificate File Passphrase: Password of SCP user to retrieve Syslog certificate chain.

11. Controller Settings

    • Controller IP: IP address of the Crosswork controller i.e., Cisco Crosswork Change Automation and Health Insights.

      Note	If you are using an IPv6 address, it must be surrounded by square brackets ([1::1]).

    • Controller Port: Port of the Crosswork controller i.e., Cisco Crosswork Change Automation and Health Insights.

    • Controller Signing Certificate File URI: PEM formatted root cert of Cisco Crosswork Change Automation and Health Insights to validate signing certs retrived using SCP. PEM file is generated by Crosswork and is available at the following location:

      cw-admin@<Crosswork_VM_ Management_IP_Address>:/home/cw-admin/controller.pem

      Note

      The Controller Signing Certificate File is required for the Cisco Crosswork Data Gateway to become functional. The certificate file is automatically imported once Cisco Crosswork Data Gateway boots up for the first time if you specify these parameters during the installation. If you do not specify these parameters during installation, then you must import the certificate file manually by following the procedure Import Controller Signing Certificate File.

    • SSL/TLS Certificate File URI: Crosswork controller PEM formatted SSL/TLS certificate file retrieved using SCP.

    • Controller Certificate File Passphrase: Password of SCP user (cw-admin) to retrieve Cisco Crosswork Change Automation and Health Insights certificate chain.

    • Proxy Server URL: URL of management network proxy server.

    • Proxy Server Bypass List: Space-delimited list of subnets and domains that will not be sent to the proxy server.

    • Authenticated Proxy Username: Username for authenticated proxy servers.

    • Authenticated Proxy Passphrase: Passphrase for authenticated proxy servers.

    • HTTPS Proxy SSL/TLS Certificate File URI: HTTPS proxy PEM formatted SSL/TLS certificate file retrieved using SCP.

    • HTTPS Proxy SSL/TLS Certificate File passphrase: Password of SCP user to retrieve proxy certificate chain.

12. Auto Enrollment Package

    Note

    Enrollment package is required for enrolling Cisco Crosswork Data Gateway with Crosswork. The enrollment package is automatically transferred once Cisco Crosswork Data Gateway boots up for the first time if you specify these parameters during the installation. If you do not specify these parameters during installation, then you must export enrollment package manually by following the procedure Export Enrollment Package.

    • Enrollment Passphrase: SCP user passphrase to transfer enrollment package.

    • Enrollment Destination Host and Path: SCP host and path to transfer the enrollment package using SCP (user@host:/path/to/file ).

Click Next to go to 10 Ready to complete, as shown in the following figure. Review your settings and then click Finish if you are ready to begin deployment.

Wait for the deployment to finish before continuing. To check the deployment status:

1. Open the vCenter vSphere client.

2. In the Recent Tasks tab for the host VM, view the status for the Deploy OVF template and Import OVF package jobs.

Once the deployment status is 100%, power on the VM to complete the deployment process. Expand the host’s entry so you can click the VM and then choose Actions > Power > Power On, as shown in the following figure:

Wait for at least 5 minutes for the Cisco Crosswork Data Gateway VM to come up and then login via vCenter or SSH as explained in the Section Log In and Log Out.

Open a command prompt.

Navigate to the location where you installed the OVF Tool.

Run the OVF Tool using the following command:

ovftool --noSSLVerify --overwrite --powerOffTarget --powerOn --acceptAllEulas --skipManifestCheck --X:injectOvfEnv --allowExtraConfig \
--extraConfig:firmware=efi --extraConfig:uefi.secureBoot.enabled=true \
--net:"vNIC0=VM Network" -ds="datastore-<data_store>-ssd" --diskMode="thin" \
--deploymentOption="onpremise" --prop:"Description=CDG VM Single Interface" \
--name="cdg1.cisco.local" --prop:"Hostname=cdg1.cisco.local" --prop:"ActiveVnics=1" \
--prop:"ControllerIP=<controller_ipv4_address>" --prop:"ControllerSignCertChain=cw-admin@<management_ip_address>:/home/cw-admin/controller.pem" \
--prop:"ControllerPort=<controller_port>" --prop:'ControllerCertChainPwd=<Password>' \
--prop:"Vnic0IPv4Method=Static" \
--prop:"Vnic0IPv4Address=<Vnic0_ipv4_address>" --prop:"Vnic0IPv4Netmask=<Vnic0_ipv4_netmask>" --prop:"Vnic0IPv4Gateway=<Vnic0_ipv4_gateway>" \
--prop:'dg-adminPassword=<dg-admin_password>' --prop:'dg-operPassword=<dg-oper_password>' \
--prop:"DNS=<DNS_ip_address>" --prop:"NTP=<NTP Server>" --prop:"Domain=cisco.com" \
<image download URL> vi:<username>:<password>'@<IP address>/DC/host/<IP address>

root@cxcloudctrl:/opt# ./cdgovfdeployVM197

Log into Cisco Crosswork Change Automation and Health Insights as described in Section Log In to the GUI From a Browser.

From the Main Menu, select Admin > Data Gateway Management.

The Data Gateway Management page opens.

Click the Add button.

The Enroll New Data Gateway dialog opens.

Click Browse and navigate to the folder to which you copied the enrollment package and select it.

Select the Data gateway admin state in which you want to bring up the Cisco Crosswork Data Gateway:

• Up (recommended): Select this state if you want to bring up the Cisco Crosswork Data Gateway in active mode. Up state moves the operational state of the Cisco Crosswork Data Gateway to Up with no intermediate step.

• Maintenance: Select this state if you want to bring up the Cisco Crosswork Data Gateway in maintenance state. Maintenance state moves the operational state of the Cisco Crosswork Data Gateway to Up but it is flagged as being in Maintenance mode while you perform any additional testing and setup.

The Enroll New Data Gateway dialog displays a summary of the selected enrollment package:

• Name of the Cisco Crosswork Data Gateway instance

• Description of the Cisco Crosswork Data Gateway instance

• Labels associated with the Cisco Crosswork Data Gateway instance

It also displays additional details:

• Number of CPUs

• Memory

  Note

  The value shown for memory represents the usable amount for user processes, not the total VM amount. The Cisco Crosswork Data Gateway operating system reserves about 700MB from the total VM memory for itself, which is excluded from memory reporting tools. It is expected for the memory value reported here to be 1GB less than the full amount allocated to the VM due to operating system reservation and rounding.

• Number of NICs

• Interface name

• Interface MAC address

• Interface IPv4/IPv6 Address

• certChain

• Version

• DUUID

Click Enroll.Cisco Crosswork Data Gateway displays the following message upon successful enrollment:

Once you click Enroll, a dialog pops up asking if you want to attach devices now or later. It is recommended to choose Later as devices must only be attached once the operational state of the Cisco Crosswork Data Gateway instance is Up.

Note	Steps to attach devices to a Cisco Crosswork Data Gateway instance are available in the Cisco Crosswork Change Automation and Health Insights 3.2.2 User Guide.