Deploy Crosswork Data Gateway

Determine if you want to configure autoenroll or obtain the enrollment token. See Autoenroll Crosswork Data Gateway with Crosswork Cloud.

Deploy Crosswork Data Gateway on the preferred virtualization platform:

Register Crosswork Data Gateway with Crosswork Cloud applications

Verify the Crosswork Data Gateway deployment

Decide when to generate or use the enrollment token.

Based on your security preference, acquire the enrollment token via Base64 encoding scheme or export it using SCP.

Log in to Crosswork Cloud.

From the main window, click Configure > Data Gateways. The Data Gateways page opens.

Click Add Crosswork Data Gateway

On the Add Crosswork Data Gateway page, select the row for the token you intend to use.

Check the expiration date of the selected token. If you plan to install and register the Crosswork Data Gateway after the token expires, choose a different token. You can review the Valid Until column on the Add Crosswork Data Gateway page to determine the expiration information.

Note

Clicking on the Next button will take you to the next stage in the enrollment workflow. For example, upon choosing a row to use a pre-existing token and selecting Next, Crosswork displays the list of tokens for which the enrollment is pending.

Click View Enrollment Token.

The View Enrollment Token window displays the token in a secure JSON format.

Click Copy to copy the token. Paste the copied token into a local file.

Log in to Crosswork Cloud.

Choose Configure > Data Gateways.

Click Add Crosswork Data Gateway.

In the Crosswork Data Gateway page, click Manage Tokens.

Click Create Enrollment Token.

Enter the token information.

Click Create.

The enrollment token is created and displayed in the View Enrollment Token window. The token's content is displayed in a secure JSON format.

Click Copy to copy the token. Paste the copied enrollment token into the configuration file for installing Crosswork Data Gateway.

During Crosswork Data Gateway deployment, paste the enrollment token in the applicable platform configuration file:

Authorize Crosswork Data Gateway to access Crosswork Cloud.

Log in to Crosswork Cloud.

Choose Configure > Data Gateways.

Click Add Crosswork Data Gateway.

On the Crosswork Data Gateway page, click Manage Tokens.

The available enrollment tokens are listed.

Select the token that you want to delete and click Revoke Token.

Review the information in the confirmation window and click Yes to proceed.

Deploy Crosswork Data Gateway and generate an enrollment token from the Crosswork Data Gateway Interactive Console.

Enter the Crosswork Data Gateway details in Crosswork Cloud to register the gateway.

Log in to Crosswork Data Gateway.

Choose Get Enrollment Package > Display base64 Encoded Enrollment Package.

Copy the package contents, paste them into a .json file, and save this file.

Log in to Crosswork Data Gateway.

Select Get Enrollment Package .

Choose Export Enrollment Package.

Click OK .

Enter the SCP URI for exporting the enrollment package, then click OK.

Enter the SCP passphrase or the SCP user password and click OK.

Choose the OpenStack method to deploy Crosswork Data Gateway.

Depending on the deployment method, choose the method to verify the Crosswork Data Gateway installation.

Download the Crosswork Data Gateway (qcow2) package.

1. Download the Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com. For the deployment of the current version, use the package name signed-cdg-deployment-7.2.0-32.bios.qcow2.tar.gz and cdg-7.2.0-sample-install-scripts.tar.gz.

2. Place the downloaded files in a directory that OpenStack can access.

Validate the downloaded qcow2 package:

1. Unzip the installer bundle using this command:

   tar -xvzf signed-cdg-deployment-7.2.0-32.bios.qcow2.tar.gz
   

   This command extracts the contents of the downloaded package.

2. After extraction, the directory should contain these files:

   README
   signed-cdg-deployment-7.2.0-32.bios.qcow2.tar.gz
   cisco_x509_verify_release.py3
   cisco_x509_verify_release
   CDG-CCO_RELEASE

3. Verify the signature of the build. To verify the integrity and authenticity of the package, run the signature verification script. Ensure the machine where the script is executed has HTTP access to cisco.com. If access is restricted or you do not receive a successful verification message after running the script, consult the Cisco Customer Experience team for assistance.

4. Execute the appropriate command for your Python version:

   Table 1. Supported Python version

   If the Python version is...	Use the command...
   Python 2.x	python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512
   Python 3.x	python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

Choose one of these options based on the addressing method you plan to use for the Crosswork Data Gateway VM:

Confirm that the deployment is successful. See Verify installation of Crosswork Data Gateway VMs with OpenStack CLI.

Modify the config.txt file.

Log in to the OpenStack VM from the CLI.

Create the resource profile or flavor for the VMs.

Create an image for the OpenStack install.

openstack image create --public --disk-format qcow2 --container-format bare --file <bios_release_image_file> <image_name>

openstack image create --public --disk-format qcow2 --container-format bare --file cdg-cloud-deployment-8.0.0-32.bios.qcow2 cdg-cloud-bios

Create the VM-specific parameters for each Crosswork Data Gateway VM.

1. (Optional) Create a 24-GB second data disk.

   openstack volume create --size 
   

   Example:

   openstack volume create --size 24 cdg-vol1

2. Create a security policy to allow incoming TCP, UDP, or ICMP connections in OpenStack, as it does not allow them by default.

   openstack security group create open
   openstack security group rule create open --protocol tcp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create open --protocol udp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create --protocol icmp open

3. Create ports with a specified IP address exclusively for Crosswork Data Gateway VMs using the static addressing.

   This step is optional unless you are using static addressing, in which case it is required.

   openstack port create --network network_name --fixed-ip subnet=subnet_name,ip-address=port_ip_address port_name

   Example:

   To create ports for Crosswork Data Gateway VMs with 1 NICs using static addressing.

   
   openstack port create --network network1 --fixed-ip subnet=subnet1,ip-address=10.10.11.101 mgmt-port1
   

   Note

   • network1 is the management network in your environment.

   • subnet1 is the subnet on the management network.

   • mgmt-port1 is the port that we are creating with the IP address as 10.10.11.101 for vNIC0 as specified in the config.txt file for the VM.

4. Apply the security policy to the ports.

   openstack port set <port_name> --security-group open

   Example:

   openstack port set mgmt-port1 --security-group open

Install one or more Crosswork Data Gateway VMs.

1. To install a Crosswork Data Gateway VM with one NIC that uses the static addressing:

   openstack server create --flavor <flavor_name> --image <image_name> --port <mgmt-port> 
   --config-drive True --user-data <config.txt> --block-device-mapping
   vdb=<volume_name>:::true <CDG_hostname>
   

   Example:

   openstack server create --flavor cdg-cloud --image cdg-cloud-bios --port mgmt-port1 
   --config-drive True --user-data config-nodhcp-cdg1.txt --block-device-mapping
   vdb=cdg1:::true cdg1-nodhcp
   

   OR

   openstack server create --config-drive true --flavor cdg --image <image_name> --key-name default
   --nic net-id=<network id>,v4-fixed-ip=<CDG static IP> --security-group <security group name> --user-data
   <config.txt> <CDG_hostname>
   

   Note

   The number of networks specified in the installation command depends on how many NICs are present in the deployment.

   For example, the command to install a VM with 2 NICs is: openstack server create --flavor cdg-cloud --image cdg-cloud-bios --port mgmt-port2 --port south-port2 --config-drive True --user-data config-nodhcp_2nic.txt --block-device-mapping vdb=cdg-vol:::true cdg-bios-nodhcp_2NIC

Update the config.txt configuration file with VM-specific parameters.

Log in to the target OpenStack environment via CLI.

Create a resource profile or flavor for the VM:

Create an image for OpenStack install.

openstack image create --public --disk-format qcow2 --container-format bare --file <bios_release_image_file> <image_name>

openstack image create --public --disk-format qcow2 --container-format bare --file cdg-cloud-deployment-8.0.0-32.bios.qcow2 cdg-cloud-bios

Enter the VM-specific parameters for each Crosswork Data Gateway VM.

1. (Optional) Create a 24 GB second data disk.

   openstack volume create --size 24 cdg-vol1

   Example:

   openstack volume create --size 24 cdg-vol1

2. Create a security policy to allow the incoming TCP, UDP, or ICMP connections.

   openstack security group create open
   openstack security group rule create open --protocol tcp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create open --protocol udp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create --protocol icmp open

   Note

   OpenStack does not allow incoming TCP, UDP, or ICMP connections by default. Create a security policy to allow incoming connections from the TCP, UDP, or ICMP protocols.

3. Create ports with a specified IP address ONLY for Crosswork Data Gateway VMs using the static addressing.

   openstack port create --network network_name --fixed-ip subnet=subnet_name,ip-address=port_ip_address port_name

   Example:

   To create ports for CDG VMs with 1 NICs using static addressing:

   Example:

   
   openstack port create --network network1 --fixed-ip subnet=subnet1,ip-address=10.10.11.101 mgmt-port1
   

   In the previous command, network1 is the management network in your environment, subnet1 is the subnet on the management network, mgmt-port1 is the port that we are creating with the IP address as 10.10.11.101 for vNIC0 as specified in the config.txt file for the VM.

4. Apply the security policy to the ports.

   openstack port set <port_name> --security-group open

   Example:

   openstack port set mgmt-port1 --security-group open

Install one or more Crosswork Data Gateway VMs:

1. To install a VM with one NIC and DHCP:

   openstack server create --flavor <flavor_name> --image <image_name> --network <network1> --network <network2> --network <network3> --config-drive True --user-data <config.txt> --host <boot_drive> --block-device-mapping vdb=<volume_name>:::true <CDG_hostname>

   Example:

   Example:

   openstack server create --flavor <flavor_name> --image <image_name> --network <network1> 
   --config-drive True --user-data <config.txt> --host <boot_drive>
   --block-device-mapping vdb=<volume_name>:::true <CDG_hostname>
   

   Alternatively:

   openstack server create --config-drive true --flavor cdg --image --key-name default --network --security-group --user-data

Run this command to list the status of all VMs:

openstack server list

Confirm the VM status:

1. After executing the command, ensure that the status of the VMs shows as Active .

2. Once the status is confirmed, wait for about 10 minutes for the VM to fully initialize.

3. After waiting, verify that the VM is running correctly and as expected.

Download the Crosswork Data Gateway (qcow2) package:

1. Download the latest available Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com to your local machine or a network location accessible to your OpenStack instance. For the deployment of the current version, we use the package name signed-cdg-deployment-7.2.0-32.uefi.qcow2.tar.gz and cdg-7.2.0-sample-install-scripts.tar.gz.

Validate the downloaded qcow2 package:

1. Unzip the installer bundle using this command:

   tar -xvzf signed-cdg-deployment-7.2.0-32.uefi.qcow2.tar.gz

   This command extracts the contents of the downloaded package.

2. After extraction, the directory should contain these files:

   README
   signed-cdg-deployment-7.2.0-32.uefi.qcow2.tar.gz
   cisco_x509_verify_release.py3
   cisco_x509_verify_release
   CDG-CCO_RELEASE

3. Run the signature verification script to confirm the integrity and authenticity of the package. Make sure the machine executing the script has HTTP access to cisco.com. If you do not have access or do not receive a successful verification message, contact the Cisco Customer Experience team for support.

4. Execute the appropriate command for your Python version:

   Table 2. Supported Python versions

   If the Python version is...	Use the command...
   Python 2.x	python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512
   Python 3.x	python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

Choose one of the following options based on the addressing method you plan to use for the Crosswork Data Gateway VM:

For instructions on configuring the Data Gateway through the OpenStack UI, see Configure Crosswork Data Gateway in the OpenStack UI.

Log in to the OpenStack VM from the OpenStack UI and create the resource profile or flavor.

1. Navigate to Compute > Flavors.

2. Enter the required details. For the other optional fields, review the Flavor Information Window.

   • Name: Enter a unique resource name.

   • VCPUs: Enter the number of vCPUs.

   • RAM: Enter the RAM size.

   • Root Disk: Enter the root disk size.

   • Ephemeral Disk: Enter the ephemeral disk size.

3. Click Create Flavor.

   

Create the Crosswork Data Gateway image.

1. Enter the details:

   1. Image Name: Specify a name for the image you are creating.

   2. File: Browse to the directory where you have downloaded the Crosswork Data Gateway release image and select the image.

   3. Format: Select QCOW2 - QEMU Emulator from the drop-down list.

   4. Leave the other settings to the values as shown in the image.

2. Click Create Image.

Create a security group policy to allow incoming TCP, UDP, or ICMP connections.

1. On the OpenStack UI, go to Networks > Security Groups.

2. Click + Create Security Group.

   

3. Specify the Name and Description of the security group. Click Create Security Group.

4. In the new window that appears to create security rules, click Add Rule to create a security policy for each protocol by specifying the direction, port range and the IP addresses range.

   The security group contains two rules by default. Use the Delete Rule option to delete these rules.

   

Create ports when using the static addressing.

1. In the OpenStack UI, navigate to Network > Networks.

2. Depending on the number of NICs in your deployment, (starting with the management network), select a network and click + Create Ports.

3. Enter details in the Name and Fixed IP Address fields. Select the Enable Admin State and Port Security check box.

   

Start the VM launch workflow.

1. Navigate to Compute > Instances and click Launch Instance on this page.

   A Launch Instance window appears to start the VM installation.

2. In the Details tab, specify the VM name in the Instance Name field and Count as 1. Then, click Next.

   Note

   For larger systems it is likely that you will have more than one Crosswork Data Gateway VMs. The Crosswork Data Gateway name should, therefore, be unique and created in a way that makes identifying a specific VM easy. We recommend that you enter the same name you had specified in the Hostname parameter in the config.txt file for the VM.

   

Select image, flavor, and networks.

1. In the Source tab:

   1. Select Boot Source: Select Image from the drop-down list.

   2. Create New Volume: Select No.

   3. All images available in the OpenStack environment are listed under the Available pane. Click to select the image. Doing this will now move the image to the Allocated pane indicating that you have selected the image.

   4. Click Next.

   

2. On the Flavor > Available pane, for the flavor you want to select for the VM, click to move it from the Available pane to the Allocated pane. Click Next.

   

3. Assign networks to the VM. Depending on the number of vNICs in your deployment, select up to 3 networks for the VM by clicking for each network from the list of networks in the Available pane. Doing this moves the selected networks to the Allocated pane. Click Next.

   The order in which you select the networks is important. In a 3-NIC deployment, the first network you select will be assigned to the vNIC0 interface, the second to the vNIC1 interface and the third to the vNIC2 interface.

   

Assign ports and security groups.

1. From the list of ports that are displayed in the Available pane, click to move the port to the Allocated pane.

   

2. Click Next.

Upload configuration and launch the instance.

1. Assign Security Groups to the VM by moving the security groups you wish to apply to the VM from the Available pane to the Allocated pane.

   In this image, 2 security groups - default and cdg, are applied to the VM.

   

2. Click Next.

3. In the Key Pair tab, click Next.

4. In the Configuration tab:

   1. Click Choose File to select and upload the config.txt file you had modified and saved for the VM.

   2. Select the Configuration Drive check box.

      

Upload configuration and launch the instance.

1. In the Configuration tab, select the Configuration Drive check box.

2. Click Launch Instance.

In the OpenStack UI, navigate to Compute > Instances.

A list of installed and pending Crosswork Data Gateway VMs will be displayed here.

Note

The installation status of each VM is shown in the Status , Task , and Power State columns.

Monitor VMs during installation:

1. If a Crosswork Data Gateway VM is still being installed:

   • Status: Build

   • Task: Spawning

   • Power State: No State

2. Once the VM is successfully installed, the indicators change to:

   • Status: Active

   • Task: None

   • Power State: Running

   

3. After the Status changes to Active , wait for approximately 10 minutes to ensure proper initialization.

Click the name of the Crosswork Data Gateway VM to open the VM's console.

Log in to the console using the dg-admin or dg-oper user account as appropriate.

1. Enter the password configured in the config.txt file during VM setup.

2. After successful login, the Interactive Console for Crosswork Data Gateway is displayed.

Choose the VMware method to deploy Crosswork Data Gateway.

Verify the Crosswork Data Gateway installation. See Verify the Crosswork Data Gateway deployment.

Log in to the vSphere Client and start deployment.

1. Right-click the data center (host) and choose Actions > Deploy OVF Template to open the Deploy OVF Template wizard.

Select the OVA file.

1. On the Select an OVF template page, browse to and select the downloaded OVA file, then click Next.

   

   Note

   The file name shown in the image is for reference only and may vary depending on the release you are deploying.

Name the VM and choose its location.

1. Enter a unique name for the VM, select the data center where you want to deploy Crosswork Data Gateway, and click Next.

   

Choose a compute resource.

1. Select the host for the VM deployment and click Next.

Review OVA details and accept the EULA.

1. Confirm the OVA information (you cannot modify it).

2. Review the OVA information. This information cannot be modified. You can ignore the disk requirements for an on-premises deployment at this stage; you will configure the disk settings later in the process.

3. Review the End User License Agreement. Click Accept, then click Next.

Select the configuration and storage.

1. On the Configuration page, select Crosswork Cloud, and then click Next.

   

2. On the Select storage page, choose the virtual disk format.

   • Thick Provision Lazy Zeroed for production environments, or

   • Thin Provision for development environments

   

3. Select a datastore and click Next.

Map networks.

1. On the Select networks page, choose the appropriate vNIC role for each interface from the drop-down list. Click Next.

Customize deployment parameters and add the enrollment token.

1. Enter all required Crosswork Data Gateway parameters.

2. On the Auto Enrollment Package Transfer page, paste the enrollment token into the Auto Enrollment Token field.

Complete deployment and power on the VM.

1. On the Ready to complete page, review your settings and click Finish.

2. After the deployment is completed, check the Recent Tasks tab on the VM host for the Deploy OVF Template job status. Confirm the deployment reaches 100%.

3. Right-click the VM and choose Actions > Power > Power On.

4. Wait at least five minutes for initialization. Then, log in through vCenter or SSH.

Verify that OVF Tool version 4.4 or later is installed on your machine by running the command:

ovftTool --version

Download the Crosswork Data Gateway UEFI OVA (for cloud only) installation package from the Cisco Software Download site. If the file has .dms extension, rename it to .ova. This conversion is necessary to comply with vCenter's requirements for properly importing and deploying virtual appliances.

Extract the installation scripts and validation files with the command:

tar -xvzf cdg-8.0.0-sample-install-scripts.tar.gz

Extract the install scripts with the command:

tar -xvzf cdg-8.0.0-sample-install-scripts.tar.gz

Make the script executable with the command:

chmod +x {filename}

Execute the script from the directory where the OVA and script files are stored with the command:

./{script name} {path and ova file name}

./three-nic /home/admin/CDG_Install/signed-cdg-deployment-8.0.0-32.uefi.qcow2.tar.gz

Enter the vCenter username and password when prompted.

admin@nso-576-tsdn-410-aio:~/CDG_Install$ ./three-nic /home/admin/CDG_Install/signed-cdg-deployment-8.0.0-32.uefi.qcow2.tar.gz
Opening OVA source: /home/admin/CDG_Install/signed-cdg-deployment-8.0.0-32.uefi.qcow2.tar.gz
The manifest does not validate
Warning:
- Line -1: Unsupported value 'firmware' for attribute 'key' on element 'ExtraConfig'.
- Line -1: Unsupported value 'uefi.secureBoot.enabled' for attribute 'key' on element 'ExtraConfig'.
Enter login information for target vi://rcdn5-spm-vc-01.cisco.com/
Username: johndoe
Password: ******

Enter the password and monitor the deployment process on the vCenter console. Observe any warnings or errors that are related to configuration parameters.

Opening VI target: vi://johndoe@rcdn5-spm-vc-01.cisco.com:443/Cisco-sample-sample/host/10.10.100.10
Warning:
- Line 146: Unable to parse 'enableMPTSupport' for attribute 'key' on element 'Config'.
- Line 229: Unable to parse 'vmxnet3.noOprom' for attribute 'key' on element 'Config'.
Deploying to VI: vi://johndoe@rcdn5-spm-vc-01.cisco.com:443/Cisco-sample-sample/host/10.10.100.10
Disk progress: 65% 

After deployment is complete, ensure the Crosswork Data Gateway is powered on and check its status in the vCenter interface.

Log in to vCenter and navigate to Crosswork Data Gateway.

In vCenter, locate Crosswork Data Gateway. Right-click on it and select Open Console .

Enter your dg-admin or dg-oper credentials, along with the password you created during the deployment process.