Step 1

Go to the Cisco Software Download site and download these files:

Step 2

Verify that the TAR file is genuine and from Cisco Systems, Inc.

Step 3

Load the Docker images from the downloaded files:

Step 4

Use the docker images command to display a list of the Docker images in the repository. Verify that you have the latest copies of the server and client applications.

Step 5

Run the server application:

$ docker run -d -p 9090:8080 -e DEBUG=true --name server f4f625f2411b

Step 6

Run the client application:

$ docker run -d -p 90:80 -e CHOKIDAR_USEPOLLING=true 
-e REACT_APP_API_URL=http://localhost:9090 --name client b7e2a0b1d3db

Step 7

Use the docker ps -a command to verify that the server and client applications are running.

Step 8

Verify that the server application is accessible by entering the URL in this format:

http://192.0.2.2:9090/api/valaunchpad/aws/v1/api-docs/

Step 9

Verify that the client application is accessible by entering the URL in this format:

http://192.0.2.1:90/valaunchpad

Step 1

Log in to Cisco Global Launchpad using one of these methods:

Step 2

If you are an admin user logging in for the first time, enter your email address in the Email ID field and click Submit.

Step 3

Click + Add a VA pod.

Step 4

Configure the AWS infrastructure (including the region, VPC, private subnet, routing table, security group, virtual gateway, and CGW) by completing these steps:

1. Configure these VA pod environment details fields:

   • Region name: From this drop-down list, choose a region.

   • VA pod name: Assign a name to the new VA pod.

     Note	The VA pod name must meet these requirements: The name must be unique within the region. (This means that you can use the same name across multiple regions.) The name must be between four to 12 characters. The name can include letters (A through Z), numbers (0 to 9), and dashes (-).

   • Availability zone: From this drop-down list, choose an availability zone.

     An availability zone is an isolated location within your selected region.

   • AWS VPC CIDR: Enter a unique VPC subnet to use to launch the AWS resources.

     Note	Keep these guidelines in mind: The recommended CIDR range is /25. In IPv4 CIDR notation, the last octet (the fourth octet) of the IP address can be either 0 or 128. This subnet should not overlap with your corporate subnet.

2. Under Transit gateway (TGW), choose a gateway option.

   If you have...	And you want to...	Then choose...
   a single VA pod,	use a VPN gateway,	VPN GW. A VPN GW is the VPN endpoint on the Amazon side of your Site-to-Site VPN connection. It can be attached to only one VPC.
   multiple VA pods or VPCs,	use the TGW as a transit hub to interconnect multiple VPCs and on-premises networks,	New VPN GW + New TGW. Note   It can also be used as a VPN endpoint for the Amazon side of the Site-to-Site VPN connection. You can create only one TGW for each region.
   an existing TGW,	use the existing TGW,	Existing TGW.

   If you chose Existing TGW, under VPN/Direct Connect Attachment, choose a gateway option.

   If you want to...	Then choose...
   create a new VPN gateway for your existing TGW,	New VPN GW.
   use an existing VPN or direct-connect attachment,	Existing attachment. From the Select attachment ID drop-down list, choose an attachment ID. Note   To view the direct connect gateway name in the drop-down list, you must log in to Cisco Global Launchpad with an administrator account to grant the required permissions. If you choose this option, you must also configure routing on your existing gateway or direct connect attachment. For instructions, see Manually configure routing on your existing gateway or direct-connect attachment.

3. Complete this step depending on your gateway selection.

   If you chose...	Then...
   Existing TGW and Existing attachments as your preferred connectivity options,	continue to Step 4.d.
   VPN GW, New VPN GW + New TGW, or Existing TGW + New VPN GW,	provide these VPN details: Customer gateway (Enterprise firewall/router): Enter the IP address of your enterprise firewall or router to form an IPsec tunnel with the AWS VPN gateway. VPN vendor: From this drop-down list, choose a VPN vendor. Barracuda, Sophos, Vyatta, and Zyxel are not supported VPN vendors. For more information, see VA pod configuration errors and possible solutions. Platform: From this drop-down list, choose a platform. Software: From this drop-down list, choose a software.

4. For the Customer profile size, leave the default Medium setting.

   The customer profile size applies to both the Catalyst Center VA instance and the backup instance. For information about the Catalyst Center instance size and Catalyst Center backup instance size, see Prerequisites for automated deployment.

5. For the Backup target (NFS), choose a destination for your backups.

   If you want...	Then choose...
   the backup to be stored in the on-premises servers,	Enterprise backup. For information about the backup storage requirements, see “Backup storage requirements” in the Cisco Catalyst Center Administrator Guide.
   the backup to be stored in AWS,	Cloud backup.

   If you chose Cloud backup, record this information because you will use it later to log in to the cloud backup server:

   • SSH IP address: <BACKUP VM IP>

   • SSH port: 22

   • Server path: /var/catalyst-backup/

   • Username: maglev

   • Password: <xxxx##########>

     Your backup server password is dynamically created. The password is composed of the first four characters of the VA pod name and the backup server IP address without the periods.

     For example, if the VA pod name is DNAC-SJC and the backup server IP address is 10.0.0.1, the backup server password is DNAC10001.

     Note	You can find the VA pod name on the Dashboard pane after you choose the region that it's deployed in. You can find the backup server IP address on the View Catalyst Center pane. For more information, see "View Catalyst Center VA Details" in the Cisco Global Launchpad Administrator Guide.

   • Passphrase: <Passphrase>

     Your passphrase is used to encrypt the security-sensitive components of the backup. These security-sensitive components include certificates and credentials.

     This passphrase is required. When you restore the backup files, you are prompted to enter this passphrase. You cannot restore backup files without this passphrase.

   • Open ports: 22, 2049, 873, and 111

6. Click Next.

7. On the Summary pane, review the environment and VPN details that you entered. When you're satisfied, click Start configuring AWS infrastructure.

   Important

   This setup takes about 20 minutes to complete. You can navigate from this screen to another page in Cisco Global Launchpad, and the process continues in the background. If you close the tab or window, or refresh the page, any active background process pauses.

   After the AWS infrastructure is successfully configured, the AWS Infrastructure Configured pane is displayed.

   

   If the AWS infrastructure configuration fails, exit Cisco Global Launchpad and see VA pod configuration errors and possible solutions.

   

Step 5

Download the on-premises configuration file by completing these steps:

1. After the AWS infrastructure is successfully configured, click Proceed to on-premises configuration.

2. In the Configure the On-Premises Tunnel Endpoint pane, click Download configuration file. Forward this file to your network administrator to configure the on-premises-side IPsec tunnel.

   This file is generated based on the on-premises vendor, platform, and version that were selected during the AWS infrastructure configuration. The file contains the unique VPN connection IDs that were created for the VPC. Only a few things need to be modified according to the on-premises firewall or router. For example, if you have an ASA firewall or router, you need to modify the static route configuration to the selected VPC subnet.

   route Tunnel-int-vpn-0bbef6e1331a37048-0 10.0.0.0 255.255.0.0 169.254.184.85 100

   Make sure your network administrator configures only one IPsec tunnel.

   Note

   The network administrator can make the necessary changes to this configuration file and apply it to your enterprise firewall or router to bring up the IPsec tunnels. The provided configuration file enables you to bring up two tunnels between AWS and the enterprise router or firewall. Most virtual private gateway solutions have one tunnel up and the other down. You can have both tunnels up and use the Equal Cost Multiple Path (ECMP) networking feature. ECMP processing enables the firewall or router to use equal-cost routes to transmit traffic to the same destination. To do this, your router or firewall must support ECMP. Without ECMP, we recommend that you either keep one tunnel down and manually failover or use a solution, such as an IP SLA, to automatically bring up the tunnel in a failover scenario.

3. Click Proceed to network connectivity check.

Step 6

Check the status of your network configuration based on the on-premises connectivity preferences that you selected during the AWS infrastructure configuration.

Step 7

Click Go to dashboard to return to the Dashboard pane, where you can create more VA pods and manage your existing ones.

Step 1

From the AWS console, go to VPC service.

Step 2

In the left navigation pane, under Transit Gateways, choose Transit gateway route tables and select the existing TGW route table.

Step 3

In the Transit gateway route tables page, complete these steps:

1. Click Associations.

2. From the drop-down list, choose the attachment to associate.

3. Click Create association.

Step 4

In the Transit gateway route tables page, click the Propagations tab and then click Create propagation.

Step 5

In the Transit gateway route tables page, ensure that the static route between the respective VPC and VPN is active by completing these steps:

1. Click Routes.

2. Click Create static route.

Step 6

Ensure that your on-premises router configuration is updated to route the network traffic destined for the CIDR ranges that are allocated to your CGW or direct-connect attachment in your AWS environment.

Step 1

In the Dashboard pane, locate the VA pod where you want to create your Catalyst Center VA.

Step 2

In the VA pod card, click Create/Manage Catalyst Center(s).

Step 3

In the VA Pod Dashboard pane, click + Create a new Catalyst Center.

Step 4

Enter these details:

Step 5

Click Validate to validate the Enterprise DNS server and FQDN configured on the DNS server.

Step 6

In the Summary page, review the configuration details.

Step 7

Click Generate PEM key file.

Step 8

In the Download PEM key file dialog box, click Download PEM key file.

Step 9

Click Start Catalyst Center configuration.

Step 10

Click Back to VA Pod dashboard to return to the VA Pod Dashboard pane.