Step 1

Refer to Cisco Crosswork Data Gateway 4.5 Release Notes for Cloud Application and download the Crosswork Data Gateway image (*.ova) file.

Step 2

Connect to vCenter and login with your credentials.

Step 3

Select the data center where you want to deploy the Crosswork Data Gateway VM.

Step 4

Connect to vCenter vSphere Client. Then select Actions > Deploy OVF Template.

Step 5

The VMware Deploy OVF Template wizard appears and highlights the first step, 1 Select template.

1. Select Local File and then click Browse to navigate to the location where you downloaded the OVA image file and select it.

   The filename is displayed in the window.

Step 6

Click Next to go to 2 Select name and folder, as shown in the following figure.

1. Enter a name for the Cisco Crosswork Data Gateway VM you are creating.

   For larger systems it is likely that you will have more than one Cisco Crosswork Data Gateway VM. The Cisco Crosswork Data Gateway name should, therefore, be unique and created in a way that makes identifying a specific VM easy.

2. In the Select a location for the virtual machine list, choose the datacenter under which the Cisco Crosswork Data Gateway VM resides.

   

Step 7

Click Next to go to 3 Select a compute resource. Choose the VM’s host.

Step 8

Click Next. The VMware vCenter Server validates the OVA. The network speed determines how long the validation takes. When the validation is complete, the wizard moves to 4 Review details. Review the OVA’s information and then click Next.

Step 9

Click Next to go to 5 License agreements. Review the End User License Agreement and click Accept.

Step 10

Click Next to go to 6 Configuration, as shown in the following figure. Select Crosswork Cloud.

Step 11

Click Next to go to 7 Select storage, as shown in the following figure.

1. In the Select virtual disk format field,

   • For production environment, choose Thick Provision Lazy Zeroed.

   • For development environment, choose Thin Provision.

2. From the Datastores table, choose the datastore you want to use.

Step 12

Click Next to go to 8 Select networks, as shown in the following figure. In the drop-down table at the top of the page, choose the appropriate destination network for each source network based on the number of vNICs you plan to use.

Step 13

Click Next to go to 9 Customize template, with the Host Information Settings already expanded.

Step 14

Click Next to go to 10 Ready to complete. Review your settings and then click Finish if you are ready to begin deployment.

Step 15

Check deployment status.

1. Open the vCenter vSphere client.

2. In the Recent Tasks tab for the host VM, view the status for the Deploy OVF template and Import OVF package jobs.

Step 16

After the deployment status becomes 100%, power on the VM to complete the deployment process. Expand the host’s entry so you can click the VM and then choose Actions > Power > Power On, as shown in the following figure:

Wait for at least five minutes for the VM to come up and then log in through vCenter or SSH.

Warning

Changing the VM's network settings in vCenter may have significant unintended consequences, including but not limited to the loss of static routes and connectivity. Make any changes to these settings at your own risk. If you wish to change the IP address, destroy the current VM, create a new VM, and reenroll the new one on the Crosswork Cloud.

Step 1

Open a command prompt on the machine where you want to install Crosswork Data Gateway.

Step 2

Open the template file and edit it to match the settings you chose for Crosswork Data Gateway.

Step 3

Navigate to the location where you installed the OVF Tool.

Step 4

Run the OVF Tool using the script.

root@cxcloudctrl:/opt# ./<script_file>

root@cxcloudctrl:/opt# ./cdgovfdeployVM197

Step 1

Download and validate the Cisco Crosswork Data Gateway qcow2 package:

1. Download the latest available Cisco Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com to your local machine or a location on your local network that is accessible to your OpenStack. For the purpose of these instructions, we use the package name "cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin".

2. Extract the content of the bin file to the current directory by running the following command.

   sh cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin

   This command verifies the authenticity of the product. The directory contains the following files as shown here:

   CDG-CCO_RELEASE.cer
   cisco_x509_verify_release.py3
   cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz 
   README
   cisco_x509_verify_release.py 
   cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin 
   cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz.signature

3. Use the following command to verify the signature of the build:

   Note	The machine where the script is being run needs HTTP access to cisco.com. Please contact Cisco Customer Experience team if access to cisco.com is not possible due to security restrictions, or if you did not get a successful verification message after running the script.

   If you are using python 2.x, use the following command to validate the file:

   python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

   If you are using python 3.x, use the following command to validate the file:

   python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

4. Unzip the QCOW2 file (cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz) with the following command:

   tar -xvf cw-na-dg-4.0.1-65-release-20221130.uefi.tar.gz

   This creates a new directory that contains the config.txt file.

Step 2

Complete the steps in Step 3 OR Step 4 based on the type of addressing you will be using for the Crosswork Data Gateway VM.

Step 3

Update the config.txt for a Crosswork Data Gateway VM with Static addressing.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the host name as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. (Important) Make a note of the IP address that you enter here for the vNIC IP addresses in the config.text. You will need to specifiy the same IP addresses when creating the ports for the VM in Step 9.

5. Repeat Step 3 (b) and Step 3 (d) to update and save a unique config.txt file for each VM using static addressing.

6. Proceed to Step 5.

Step 4

Update the config.txt for Crosswork Data Gateway VMs using DHCP.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the host name as cdg1-nodhcp when using DHCP. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. Repeat Step 4 (b) and Step 4 (c) to update and save a unique config.txt file for each VM using DHCP addressing.

5. Proceed to Step 5.

Step 5

Log in to the OpenStack VM from CLI.

Step 6

Create the resource profile or flavor for the VMs.

Step 7

Create image for OpenStack install.

openstack image create --public --disk-format qcow2 --container-format bare --file <bios_release_image_file> <image_name>

openstack image create --public --disk-format qcow2 --container-format bare --file cw-na-dg-4.0.1-65-release-20221130.bios.qcow2 cdg-cloud-bios

Step 8

Create the VM-specific parameters for each Crosswork Data Gateway VM.

1. (Optional) Create a 24 GB second data disk.

   openstack volume create --size 
   

   Sample commands:

   openstack volume create --size 24 cdg-vol1

2. Create a security policy to allow incoming TCP/UDP/ICMP connections.

   OpenStack does not allow incoming TCP/UDP/ICMP connections by default. Create a security policy to allow incoming connections from TCP/UDP/ICMP protocols.

   openstack security group create open
   openstack security group rule create open --protocol tcp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create open --protocol udp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create --protocol icmp open

3. Create ports with specified IP address ONLY for Crosswork Data VMs using Static addressing.

   Important

   This step is required only if you are using Static addressing. If you are using DHCP addressing, the IP addresses for the ports are automatically assigned from the IP addresses allocation pool for the subnet.

   openstack port create --network network_name --fixed-ip subnet=subnet_name,ip-address=port_ip_address port_name

   Sample commands to create ports for CDG VMs with 1 NICs using static addressing:

   
   openstack port create --network network1 --fixed-ip subnet=subnet1,ip-address=10.10.11.101 mgmt-port1
   

   In the previous command, network1 is the management network in your environment, subnet1 is the subnet on the management network, mgmt-port1 is the port that we are creating with the IP address as 10.10.11.101 for vNIC0 as specified in the config.txt file for the VM.

4. Apply the security policy to the ports.

   openstack port set <port_name> --security-group open

   For example,

   openstack port set mgmt-port1 --security-group open

5. Repeat Step 9 for all the VMs you will be installing.

Step 9

Install the Crosswork Data Gateway VM(s).

openstack server create --flavor <flavor_name> --image <image_name> --port <mgmt-port> 
--config-drive True --user-data <config.txt> --block-device-mapping
vdb=<volume_name>:::true <CDG_hostname>

openstack server create --flavor cdg-cloud --image cdg-cloud-bios --port mgmt-port1 
--config-drive True --user-data config-nodhcp-cdg1.txt --block-device-mapping
vdb=cdg1:::true cdg1-nodhcp

openstack server create --config-drive true --flavor cdg --image <image_name> --key-name default
--nic net-id=<network id>,v4-fixed-ip=<CDG static IP> --security-group <security group name> --user-data
<config.txt> <CDG_hostname>

openstack server create --flavor <flavor_name> --image <image_name> --network <network1> --network <network2> --network <network3> --config-drive True --user-data <config.txt> --host <boot_drive> --block-device-mapping vdb=<volume_name>:::true <CDG_hostname>

openstack server create --flavor <flavor_name> --image <image_name> --network <network1> 
--config-drive True --user-data <config.txt> --host <boot_drive>
--block-device-mapping vdb=<volume_name>:::true <CDG_hostname>

openstack server create --config-drive true --flavor cdg --image --key-name default --network --security-group --user-data

Step 1

Download and validate the Cisco Crosswork Data Gateway qcow2 package:

1. Download the latest available Cisco Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com to your local machine or a location on your local network that is accessible to your OpenStack. In these instructions, we use the package name "cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin".

2. Extract the content of the bin file to the current directory.

   sh cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin

   This command verifies the authenticity of the product. The directory contains the following files as shown here:

   CDG-CCO_RELEASE.cer
   cisco_x509_verify_release.py3
   cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz 
   README
   cisco_x509_verify_release.py 
   cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin 
   cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz.signature

   If you encounter any network connectivity issues, skip this verification and perform a manual verification as explained in the next step.

   sh cw-na-dg-4.0.1-65-release-20221130.bios.signed.bin --skip-verification

3. Use the following command to verify the signature of the build:

   Note	The machine where the script is being run needs HTTP access to cisco.com. Please contact Cisco Customer Experience team if access to cisco.com is not possible due to security restrictions, or if you did not get a successful verification message after running the script.

   If you are using python 2.x, use the following command to validate the file:

   python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

   If you are using python 3.x, use the following command to validate the file:

   python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

4. Unzip the QCOW2 file (cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz) with the following command:

   tar -xvf cw-na-dg-4.0.1-65-release-20221130.bios.tar.gz

   This creates a new directory that contains the config.txt file.

Step 2

Complete the steps in Step 3 OR Step 4 based on the type of addressing you will be using for the Crosswork Data Gateway VM.

Step 3

Update the config.txt for a Crosswork Data Gateway VM with Static addressing.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   Important

   Make a note of the IP address that you are using to create the ports for the VM. You will need to specify the same IP addresses that you enter here for the vNIC IP addresses in the config.text file for each of the VMs.

   This is a sample config.txt file for a 1 NIC deployment with the host name as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. (Important) Make a note of the IP address that you enter here for the vNIC IP addresses in the config.txt. You will need to specify the same IP addresses when creating the ports for the VM in Step 9.

5. Repeat Step 3 (b) and Step 3 (d) to update and save a unique config.txt file for each VM using static addressing.

6. Proceed to Step 5.

Step 4

Update the config.txt for a Crosswork Data Gateway VM with DHCP.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the host name as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. Repeat Step 4 (b) and Step 4 (c) to update and save a unique config.txt file for each VM using static addressing.

5. Proceed to Step 5.

Step 5

Log in to the OpenStack VM from the OpenStack UI.

Step 6

Navigate to Compute > Flavors to create the resource profile or flavor.

Step 7

Create an image for OpenStack install.

1. Enter details in the following fields:

   1. Image Name - Specify a name for the image you are creating.

   2. File - Navigate to the directory where you have downloaded the Crosswork Data Gateway release image and select the image.

   3. Format - Select QCOW2 - QEMU Emulator from the drop-down list.

   4. Leave the other settings to the values as shown in the image.

2. Click Create Image.

Step 8

Create a security group policy to allow incoming TCP/UDP/ICMP connections.

1. In the OpenStack UI, navigate to Networks > Security Groups..

2. Click + Create Security Group.

   

3. Specify the Name and Description of the security group. Click Create Security Group.

4. In the new window that appears to create security rules, click Add Rule to create a security policy for each protocol by specifying the direction, port range and the IP addresses range.

   The security group contains two rules by default. Use the Delete Rule option to delete these rules.

   

Step 9

Create ports with specified IP address ONLY if you are using Static addressing.

1. In the OpenStack UI, navigate to Network > Networks.

2. Depending on the number of NICs in your deployment, (starting with the management network), select a network and click + Create Ports.

3. Enter details in the Name and Fixed IP Address fields. Select the Enable Admin State and Port Security check box.

   

Step 10

Navigate to Compute > Instances. Click Launch Instance in this page.

Step 11

In the Details tab, specify the VM name in the Instance Name field and the Count as 1. Click Next.

Step 12

In the Source tab:

Step 13

In the Flavor tab, in the Available pane, for the flavor you want to select for the VM, click to move it from the Available pane to the Allocated pane. Click Next.

Step 14

Assign networks to the VM. Depending on the number of vNICs in your deployment, select up to 3 networks for the VM by clicking for each network from the list of networks in the Available pane. Doing this moves the selected networks to the Allocated pane. Click Next.

Step 15

Assign ports to the VM.

Step 16

Assign Security Groups to the VM by moving the security groups you wish to apply to the VM from the Available pane to the Allocated pane. .

Step 17

In the Key Pair tab, click Next.

Step 18

In the Configuration tab:

Step 19

Click Launch Instance.

Step 20

Repeat Step 9 to Step 20 of the procedure to install all Crosswork Data Gateway VMs.

Step 1

Log in to AWS and search for the CloudFormation service. The CloudFormation dashboard opens.

Step 2

Click Stacks from the side menu.

Step 3

In Step 1 - Specify template, select the following settings:

1. Under Prepare template, select Template is ready.

2. Under Template source, select Upload a template file.

3. Click Choose file, and select your CF template (.yaml file).

4. Click Next.

Step 4

In Step 2 - Specify stack details, enter relevant values for the stack name and each parameter field, and click Next.

Step 5

In Step 3 - Configure stack options, enter the relevant values for the settings based on your production preferences. Click Next to continue.

Step 6

In Step 4 - Review, review the settings you have configured.

Step 7

Select the acknowledgment checkbox, and click Create stack to start the VM installation.

Step 1

Prepare the user data for the Crosswork Data Gateway VMs.

1. Prepare the user data for Crosswork Data Gateway VMs. See Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information about the parameters. Sample user data for a VM is attached here for your reference. Important parameters have been highlighted.

   For Amazon EC2 deployment, this document assumes that a user of this procedure is familiar with AWS and the CloudFormation concepts, and as such, the CF template creation is out of the scope of this document. In the example, AwsIamRole is an optional parameter for the Amazon EC2 deployment.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   

2. Repeat the previous step to create the user data for each Crosswork Data VM that you plan to install.

Step 2

Install the Crosswork Data Gateway VM.

1. Log in to AWS and search for the EC2 service. The EC2 dashboard opens.

2. Navigate to Launch Instance pane on the dashboard and click Launch Instance > Launch Instance.

   A Launch an Instance window appears.

3. In the Name and tags section, enter the name of the Crosswork Data Gateway VM.

4. In the Application and OS Images (Amazon Machine Image) section, click My AMIs > Owned by me and select the Crosswork Data Gateway AMI image in the Amazon Machine Image (AMI) field.

5. In the Instance type section, select the t2.2xlarge instance type (both production and lab environment) for the Crosswork Data VM you are deploying.

6. In the Key pair (login) section, select a Key pair name from the drop-down list.

   Note	Cisco Crosswork does not support key-based authentication. This is an AWS requirement and will not be used by Cisco Crosswork.

7. In the Network Settings section, click Edit.

   1. Enter values in the following fields:

      • VPC: Select the appropriate VPC for your environment.

      • Subnet: Select the subnet that you wish to assign to the management interface.

      • Auto-assign public IP: Select Disabled.

      • Firewall (security groups): Specify a security group for the VM. You can create a security group or use an existing security group that you have already created.

        After you have entered the details above, under Advanced network configuration, a Network Interface1 is automatically created.

   2. Update the Description, Primary IP (vNIC0 IP address from the user data), Subnet, Security groups.

8. In the Configure Storage section, click Advanced and click Add new volume to add an additional partition for your VM. Update the following fields for the newly created volume.

   • Device name: /device/sdb

   • Size (GIB): 20 GB or 520 GB. If you do not specify a size, the default size of 50 GB is considered.

     When extra disk space is required for processing additional dossier collection, you can add node disk.

   • Volume type: We recommend using gp2 or gp3.

9. In the Advanced Settings section, update the following fields.

   • IAM instance profile: Select the AWS IAM role that you had specified in the user data or create a new role.

   • Metadata accessible: Enabled.

   • Metadata version: V1 and V2 (token optional)

   • Metadata response hop limit: 2

   • User data: Copy the user data that you had prepared in Step 1 and paste it within the window here. If you are providing the parameters in a base64 encoded format, select the check box.

     Note	Ensure that there are no leading white spaces when you paste the user data otherwise the deployment fails.

Step 3

Click Launch Instance. AWS EC2 initiates the installation of the VM.

Step 4

Repeat steps 2 to 4 to install the remaining VMs.