Step 1

Refer to Cisco Crosswork Data Gateway 6.0.1 Release Notes for Cloud Applications and download the installer bundle (.tar.gz file) and the OVA file from cisco.com to a directory.

Step 2

Connect to vCenter and log in with your credentials.

Step 3

Select the datacenter where you want to deploy the Crosswork Data Gateway VM.

Step 4

Connect to vCenter vSphere Client and select Actions > Deploy OVF Template.

Step 5

The VMware Deploy OVF Template wizard appears and highlights the first step, 1 Select template.

1. Click Browse to navigate to the location where you downloaded the OVA image file and select it.

   Once selected, the file name is displayed in the window.

Step 6

Click Next to go to 2 Select name and folder, as shown in the following figure.

1. Enter a unique name for the VM that you are creating.

   For larger systems it is likely that you have more than one Cisco Crosswork Data Gateway VM. The Cisco Crosswork Data Gateway name should, therefore, be unique and created in a way that makes identifying a specific VM easy.

2. In the Select a location for the virtual machine list, choose the datacenter on which you want to deploy Crosswork Data Gateway.

   

Step 7

Click Next to go to 3 Select a compute resource. Choose the VM’s host.

Step 8

Click Next. The VMware vCenter Server validates the OVA. The network speed determines how long the validation takes. When the validation is complete, the wizard moves to 4 Review details. Review the OVA’s information and then click Next.

Step 9

Click Next to go to 5 License agreements. Review the End User License Agreement and click Accept.

Step 10

Click Next to go to 6 Configuration, as shown in the following figure. Select Crosswork Cloud.

Step 11

Click Next to go to 7 Select storage, as shown in the following figure.

1. In the Select virtual disk format field,

   • For production environment, choose Thick Provision Lazy Zeroed.

   • For development environment, choose Thin Provision.

2. From the Datastores table, choose the datastore you want to use.

Step 12

Click Next to go to 8 Select networks, as shown in the following figure. From the drop-down, at the top of the page, choose the appropriate vNIC role for each interface.

Crosswork Cloud does not support vNIC3. Cisco advises against modifying the default network settings.

Step 13

Click Next to go to 9 Customize template, with the Host Information Settings already expanded. Enter the information for the parameters as described in Cisco Crosswork Data Gateway Deployment Parameters and Scenarios.

Step 14

Click Next to go to 10 Ready to complete. Review your settings and then click Finish.

Step 15

Wait for the deployment to finish before continuing. To check the deployment status:

1. Open the vCenter vSphere client.

2. In the Recent Tasks tab for the host VM, view the status for the Deploy OVF template and Import OVF package jobs.

Step 16

After the deployment status becomes 100%, power on the VM to complete the deployment process. Expand the host’s entry so you can click the VM and then right-click and choose Actions > Power > Power On, as shown in the following figure:

Wait for at least five minutes for the VM to come up and then log in through vCenter or SSH.

Warning

Changing the VM's network settings in vCenter may have significant unintended consequences, including but not limited to the loss of static routes and connectivity. Make any changes to these settings at your own risk. If you wish to change the IP address, destroy the current VM, create a new VM, and re enroll the new one on the Crosswork Cloud.

Step 1

On the machine where you have the OVFtool installed, use the following command to confirm that you have OVFtool version 4.4:

ovftTool --version

Step 2

Download the OVA and the sample script files from cisco.com. For the purpose of these instructions, we will use the file names as signed-cw-na-dg-6.0.1-119-release-20231220.uefi.ova and cw-na-dg-6.0.1-sample-install-scripts.tar.gz. The cw-na-dg-6.0.1-sample-install-scripts.tar.gz contains the sample scripts for single, two, and three vNIC deployments, which you may optimize to meet your needs.

Step 3

Use the following command to extract the files from the tar bundle:

tar -xvzf cw-na-dg-6.0.1-sample-install-scripts.tar.gz

Step 4

Use the following command to extract the install scripts from the tar bundle:

tar -xvzf DG-sample-install-scripts.tar.gz

Step 5

Review the contents of the README file to understand the components that are in the package and how they are validated.

Step 6

Choose the sample script that corresponds to the deployment you plan to use. Cisco provides sample scripts for 1, 2, and 3 vNIC deployments, which you may optimize to meet your needs. See Sample Script for Crosswork Data Gateway IPv4 Deployment.

Step 7

Use the following command to make the script executable:

chmod +x {filename}

Step 8

Use the following command to execute the script from the directory where the OVA and script files are stored:

./{script name} {path and ova file name}

./three-nic /home/admin/CDG_Install/signed-cw-na-dg-6.0.1-119-release-20231220.uefi.ova

Step 9

If the values provided in the script are valid, provide the vCenter user’s password when you are prompted.

admin@nso-576-tsdn-410-aio:~/CDG_Install$ ./three-nic /home/admin/CDG_Install/signed-cw-na-dg-6.0.1-119-release-20231220.uefi.ova
Opening OVA source: /home/admin/CDG_Install/signed-cw-na-dg-6.0.1-119-release-20231220.uefi.ova
The manifest does not validate
Warning:
- Line -1: Unsupported value 'firmware' for attribute 'key' on element 'ExtraConfig'.
- Line -1: Unsupported value 'uefi.secureBoot.enabled' for attribute 'key' on element 'ExtraConfig'.
Enter login information for target vi://rcdn5-spm-vc-01.cisco.com/
Username: johndoe
Password: ******

Opening VI target: vi://johndoe@rcdn5-spm-vc-01.cisco.com:443/Cisco-sample-sample/host/10.10.100.10
Warning:
- Line 146: Unable to parse 'enableMPTSupport' for attribute 'key' on element 'Config'.
- Line 229: Unable to parse 'vmxnet3.noOprom' for attribute 'key' on element 'Config'.
Deploying to VI: vi://johndoe@rcdn5-spm-vc-01.cisco.com:443/Cisco-sample-sample/host/10.10.100.10
Disk progress: 65% 

Step 1

Log in to Crosswork Data Gateway VM through vCenter.

Step 2

Locate the VM in vCenter and then right-click and select Open Console.

Step 3

Enter username (dg-admin or dg-oper as per the role assigned to you) and the corresponding password (the one that you created during installation process) and press Enter.

Step 1

Download and validate the Cisco Crosswork Data Gateway qcow2 package:

1. Download the latest available Cisco Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com to your local machine or a location on your local network that is accessible to your OpenStack. For the purpose of these instructions, we use the package name signed-cw-na-dg-6.0.1-119-release-20231220-qcow2.uefi.tar.gz and cw-na-dg-6.0.1-sample-install-scripts.tar.gz.

2. Use the following command to unzip the installer bundle:

   tar -xvzf signed-cw-na-dg-6.0.1-119-release-20231220-qcow2.uefi.tar.gz

   This command verifies the authenticity of the product. The directory contains the following files as shown here:

   README
   signed-cw-na-dg-6.0.1-119-release-20231220.uefi.tar.gz.signature
   signed-cw-na-dg-6.0.1-119-release-20231220.uefi.tar.gz
   cisco_x509_verify_release.py3
   cisco_x509_verify_release
   CDG-CCO_RELEASE

3. Use the following command to verify the signature of the build:

   Note	The machine where the script is being run needs HTTP access to cisco.com. Contact Cisco Customer Experience team if access to cisco.com is not possible due to security restrictions, or if you did not get a successful verification message after running the script.

   If you are using Python 2.x, use the following command to validate the file:

   python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

   If you are using Python 3.x, use the following command to validate the file:

   python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

Step 2

Complete the steps in Step 3 OR Step 4 based on the type of addressing you plan to use for the Crosswork Data Gateway VM.

Step 3

Update config.txt for a Crosswork Data Gateway VM with Static addressing.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the hostname as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ## Amazon Web Services IAM Role Name
   # Please enter the AWS IAM role name to use for sending VIP updates. This is required when deploying on AWS EC2.
   AwsIamRole=
   
   ## High Availability Network Mode
   # Please enter the mode for the HA Network. This will determine whether all interfaces require an address.
   HANetworkMode=L2
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Multiserver Mode
   # Send syslog to all servers (simultaneous) or one at a time (failover)
   SyslogMultiserverMode=Simultaneous
   
   ## Syslog Server Addresses
   # Please enter a space delimited list of hostnames, IPv4 addresses, or IPv6 addresses of the Syslog servers accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Token for Crosswork Cloud
   # Please enter the optional enrollment token to auto enroll with Crosswork Cloud
   CloudEnrollmentToken=TOKEN
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. (Important) Make a note of the IP address that you enter here for the vNIC IP addresses in the config.text. You will need to specifiy the same IP addresses when creating the ports for the VM in Step 9.

5. Repeat Step 3 (b) and Step 3 (d) to update and save a unique config.txt file for each VM using static addressing.

6. Proceed to Step 5.

Step 4

Update the config.txt for Crosswork Data Gateway VMs using DHCP.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the hostname as cdg1-nodhcp when using DHCP. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Token for Crosswork Cloud
   # Please enter the optional enrollment token to auto enroll with Crosswork Cloud
   CloudEnrollmentToken=TOKEN
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. Repeat Step 4 (b) and Step 4 (c) to update and save a unique config.txt file for each VM using DHCP addressing.

5. Proceed to Step 5.

Step 5

Log in to the OpenStack VM from CLI.

Step 6

Create the resource profile or flavor for the VMs.

Step 7

Create image for OpenStack install.

openstack image create --public --disk-format qcow2 --container-format bare --file <bios_release_image_file> <image_name>

openstack image create --public --disk-format qcow2 --container-format bare --file signed-cw-na-dg-6.0.1-119-release-20231220.bios.qcow2 cdg-cloud-bios

Step 8

Create the VM-specific parameters for each Crosswork Data Gateway VM.

1. (Optional) Create a 24 GB second data disk.

   openstack volume create --size 
   

   Sample commands:

   openstack volume create --size 24 cdg-vol1

2. Create a security policy to allow incoming TCP/UDP/ICMP connections.

   OpenStack does not allow incoming TCP/UDP/ICMP connections by default. Create a security policy to allow incoming connections from TCP/UDP/ICMP protocols.

   openstack security group create open
   openstack security group rule create open --protocol tcp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create open --protocol udp --dst-port <port_number> --remote-ip <IP_address>
   openstack security group rule create --protocol icmp open

3. Create ports with specified IP address ONLY for Crosswork Data VMs using Static addressing.

   Important

   This step is required only if you are using Static addressing. If you are using DHCP addressing, the IP addresses for the ports are automatically assigned from the IP addresses allocation pool for the subnet.

   openstack port create --network network_name --fixed-ip subnet=subnet_name,ip-address=port_ip_address port_name

   Sample commands to create ports for CDG VMs with 1 NICs using static addressing:

   
   openstack port create --network network1 --fixed-ip subnet=subnet1,ip-address=10.10.11.101 mgmt-port1
   

   In the previous command, network1 is the management network in your environment, subnet1 is the subnet on the management network, mgmt-port1 is the port that we are creating with the IP address as 10.10.11.101 for vNIC0 as specified in the config.txt file for the VM.

4. Apply the security policy to the ports.

   openstack port set <port_name> --security-group open

   For example,

   openstack port set mgmt-port1 --security-group open

5. Repeat Step 9 for all the VMs you will be installing.

Step 9

Install one or more Crosswork Data Gateway VMs.

openstack server create --flavor <flavor_name> --image <image_name> --port <mgmt-port> 
--config-drive True --user-data <config.txt> --block-device-mapping
vdb=<volume_name>:::true <CDG_hostname>

openstack server create --flavor cdg-cloud --image cdg-cloud-bios --port mgmt-port1 
--config-drive True --user-data config-nodhcp-cdg1.txt --block-device-mapping
vdb=cdg1:::true cdg1-nodhcp

openstack server create --config-drive true --flavor cdg --image <image_name> --key-name default
--nic net-id=<network id>,v4-fixed-ip=<CDG static IP> --security-group <security group name> --user-data
<config.txt> <CDG_hostname>

openstack server create --flavor <flavor_name> --image <image_name> --network <network1> --network <network2> --network <network3> --config-drive True --user-data <config.txt> --host <boot_drive> --block-device-mapping vdb=<volume_name>:::true <CDG_hostname>

openstack server create --flavor <flavor_name> --image <image_name> --network <network1> 
--config-drive True --user-data <config.txt> --host <boot_drive>
--block-device-mapping vdb=<volume_name>:::true <CDG_hostname>

openstack server create --config-drive true --flavor cdg --image --key-name default --network --security-group --user-data

Step 1

Download and validate the Cisco Crosswork Data Gateway qcow2 package:

1. Download the latest available Cisco Crosswork Data Gateway image (*.bios.signed.bin) from cisco.com to your local machine or a location on your local network that is accessible to your OpenStack. For the purpose of these instructions, we use the package name signed-cw-na-dg-6.0.1-119-release-20231220.uefi.qcow2.uefi.tar.gz and cw-na-dg-6.0.1-sample-install-scripts.tar.gz.

2. Use the following command to unzip the installer bundle:

   tar -xvzf signed-cw-na-dg-6.0.1-119-release-20231220.uefi.qcow2.uefi.tar.gz

   This command verifies the authenticity of the product. The directory contains the following files as shown here:

   README
   signed-cw-na-dg-6.0.1-119-release-20231220.uefi.tar.gz.signature
   signed-cw-na-dg-6.0.1-119-release-20231220-release.uefi.tar.gz
   cisco_x509_verify_release.py3
   cisco_x509_verify_release
   CDG-CCO_RELEASE

   If you encounter any network connectivity issues, skip this verification and perform a manual verification as explained in the next step.

   sh signed-cw-na-dg-6.0.1-119-release-20231220.bios.signed.bin --skip-verification

3. Use the following command to verify the signature of the build:

   Note	The machine where the script is being run needs HTTP access to cisco.com. Please contact Cisco Customer Experience team if access to cisco.com is not possible due to security restrictions, or if you did not get a successful verification message after running the script.

   If you are using python 2.x, use the following command to validate the file:

   python cisco_x509_verify_release.py -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

   If you are using python 3.x, use the following command to validate the file:

   python cisco_x509_verify_release.py3 -e <.cer file> -i <.tar.gz file> -s <.tar.gz.signature file> -v dgst -sha512

Step 2

Complete the steps in Step 3 OR Step 4 based on the type of addressing you plan on using for the Crosswork Data Gateway VM.

Step 3

Update the config.txt for a Crosswork Data Gateway VM with Static addressing.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   Important

   Make a note of the IP address that you are using to create the ports for the VM. You will need to specify the same IP addresses that you enter here for the vNIC IP addresses in the config.text file for each of the VMs.

   This is a sample config.txt file for a 1 NIC deployment with the hostname as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Token for Crosswork Cloud
   # Please enter the optional enrollment token to auto enroll with Crosswork Cloud
   CloudEnrollmentToken=TOKEN
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. (Important) Make a note of the IP address that you enter here for the vNIC IP addresses in the config.txt. You will need to specify the same IP addresses when creating the ports for the VM in Step 9.

5. Repeat Step 3 (b) and Step 3 (d) to update and save a unique config.txt file for each VM using static addressing.

6. Proceed to Step 5.

Step 4

Update the config.txt for a Crosswork Data Gateway VM with DHCP.

1. Navigate to the directory where you have downloaded the Crosswork Data Gateway release image.

2. Open the config.txt file and modify the parameters as per your installation requirements. Refer to the section Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information.

   This is a sample config.txt file for a 1 NIC deployment with the hostname as cdg1-nodhcp when using static addressing. Mandatory parameters in this list have been highlighted.

   #### Required Parameters
   
   ### Deployment Settings
   
   ## Resource Profile
   # How much memory and disk should be allocated?
   # Default value: Crosswork-Cloud
   Profile=Crosswork-Cloud
   
   ### Host Information
   
   ## Hostname
   # Please enter the server's hostname (dg.localdomain)
   Hostname=changeme
   
   ## Description
   # Please enter a short, user friendly description for display in the Crosswork Controller
   Description=changeme
   
   ### Passphrases
   
   ## dg-admin Passphrase
   # Please enter a passphrase for the dg-admin user. It must be at least 8 characters.
   dg-adminPassword=changeme
   
   ## dg-oper Passphrase
   # Please enter a passphrase for the dg-oper user. It must be at least 8 characters.
   dg-operPassword=changeme
   
   ### vNIC0 IPv4 Address
   
   ## vNIC0 IPv4 Method
   # Skip or statically assign the vNIC0 IPv4 address
   # Default value: DHCP
   Vnic0IPv4Method=None
   
   ## vNIC0 IPv4 Address
   # Please enter the server's IPv4 vNIC0 address if statically assigned
   Vnic0IPv4Address=0.0.0.0
   
   ## vNIC0 IPv4 Netmask
   # Please enter the server's IPv4 vNIC0 netmask if statically assigned
   Vnic0IPv4Netmask=0.0.0.0
   
   ## vNIC0 IPv4 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv4SkipGateway=False
   
   ## vNIC0 IPv4 Gateway
   # Please enter the server's IPv4 vNIC0 gateway if statically assigned
   Vnic0IPv4Gateway=0.0.0.1
   
   ### vNIC0 IPv6 Address
   
   ## vNIC0 IPv6 Method
   # Skip or statically assign the vNIC0 IPv6 address
   # Default value: None
   Vnic0IPv6Method=None
   
   ## vNIC0 IPv6 Address
   # Please enter the server's IPv6 vNIC0 address if statically assigned
   Vnic0IPv6Address=::0
   
   ## vNIC0 IPv6 Netmask
   # Please enter the server's IPv6 vNIC0 netmask if statically assigned
   Vnic0IPv6Netmask=64
   
   ## vNIC0 IPv6 Skip Gateway
   # Skip statically assigning a gateway address to communicate with other devices, VMs, or services
   # Default value: False
   Vnic0IPv6SkipGateway=False
   
   ## vNIC0 IPv6 Gateway
   # Please enter the server's IPv6 vNIC0 gateway if statically assigned
   Vnic0IPv6Gateway=::1
   
   ### DNS Servers
   
   ## DNS Address
   # Please enter a space delimited list of DNS server addresses accessible from the Default Gateway role
   DNS=changeme
   
   ## DNS Search Domain
   # Please enter the DNS search domain
   Domain=changeme
   
   ### NTPv4 Servers
   
   ## NTPv4 Servers
   # Please enter a space delimited list of NTPv4 server hostnames or addresses accessible from the Default Gateway role
   NTP=changeme
   
   #### Optional Parameters
   
   ### Host Information
   
   ## Label
   # An optional freeform label used by the Crosswork Controller to categorize and group multiple DG instances
   Label=
   
   ## Allow Usable RFC 8190 Addresses
   # If an address for vNIC0, vNIC1, vNIC2, or vNIC3 falls into a usable range identified by RFC 8190 or its predecessors, reject, accept, or request confirmation during initial configuration
   # Default value: Yes
   AllowRFC8190=Yes
   
   ## Crosswork Data Gateway Private Key URI
   # Please enter the optional Crosswork Data Gateway private key URI retrieved using SCP (user@host:/path/to/file)
   DGCertKey=
   
   ## Crosswork Data Gateway Certificate File URI
   # Please enter the optional Crosswork Data Gateway PEM formatted certificate file URI retrieved using SCP (user@host:/path/to/file)
   DGCertChain=
   
   ## Crosswork Data Gateway Certificate File and Key Passphrase
   # Please enter the SCP user passphrase to retrieve the Crosswork Data Gateway PEM formatted certificate file and private key
   DGCertChainPwd=
   
   ### DNS Servers
   
   ## DNS Security Extensions
   # Use DNS security extensions
   # Default value: False
   DNSSEC=False
   
   ## DNS over TLS
   # Use DNS over TLS
   # Default value: False
   DNSTLS=False
   
   ## Multicast DNS
   # Use multicast DNS
   # Default value: False
   mDNS=False
   
   ## Link-Local Multicast Name Resolution
   # Use link-local multicast name resolution
   # Default value: False
   LLMNR=False
   
   ### NTPv4 Servers
   
   ## NTPv4 Authentication
   # Use authentication for all NTPv4 servers
   # Default value: False
   NTPAuth=False
   
   ## NTPv4 Keys
   # Please enter a space delimited list of IDs present in the key file. The number of IDs in the list must match the number of servers, even if some or all are the same ID.
   NTPKey=
   
   ## NTPv4 Key File URI
   # Please enter the optional Chrony key file retrieved using SCP (user@host:/path/to/file)
   NTPKeyFile=
   
   ## NTPv4 Key File Passphrase
   # Please enter the SCP user passphrase to retrieve the Chrony key file
   NTPKeyFilePwd=
   
   ### Remote Syslog Servers
   
   ## Remote Syslog Server
   # Send Syslog messages to a remote host
   # Default value: False
   UseRemoteSyslog=False
   
   ## Syslog Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the Syslog server accessible from the Default Gateway role
   SyslogAddress=
   
   ## Syslog Server Port
   # Please enter a Syslog port
   # Default value: 514
   SyslogPort=514
   
   ## Syslog Server Protocol
   # Please enter the Syslog protocol
   # Default value: UDP
   SyslogProtocol=UDP
   
   ## Syslog over TLS
   # Use Syslog over TLS (must use TCP or RELP as the protocol)
   # Default value: False
   SyslogTLS=False
   
   ## Syslog TLS Peer Name
   # Please enter the Syslog server's hostname exactly as entered in the server certificate subjectAltName or subject common name
   SyslogPeerName=
   
   ## Syslog Root Certificate File URI
   # Please enter the optional Syslog root PEM formatted certificate file retrieved using SCP (user@host:/path/to/file)
   SyslogCertChain=
   
   ## Syslog Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the Syslog PEM formatted cetificate file
   SyslogCertChainPwd=
   
   ### Remote Auditd Servers
   
   ## Remote auditd Server
   # Send auditd messages to a remote host
   # Default value: False
   UseRemoteAuditd=False
   
   ## Auditd Server Address
   # Please enter a hostname, IPv4 address, or IPv6 address of the auditd server accessible from the Default Gateway role
   AuditdAddress=
   
   ## Auditd Server Port
   # Please enter na auditd port
   # Default value: 60
   AuditdPort=60
   
   ### Controller Settings
   
   ## Proxy Server URL
   # Please enter the optional HTTP/HTTPS proxy URL
   ProxyURL=
   
   ## Proxy Server Bypass List
   # Please enter an optional space delimited list of subnets and domains that will not be sent to the proxy server
   ProxyBypass=
   
   ## Authenticated Proxy Username
   # Please enter an optional username for an authenticated proxy servers
   ProxyUsername=
   
   ## Authenticated Proxy Passphrase
   # Please enter an optional passphrase for an authenticated proxy server
   ProxyPassphrase=
   
   ## HTTPS Proxy SSL/TLS Certificate File URI
   # Please enter the optional HTTPS Proxy PEM formatted SSL/TLS certificate file URI retrieved using SCP (user@host:/path/to/file). This will override the Controller SSL/TLS Certificate File URI.
   ProxyCertChain=
   
   ## HTTPS Proxy SSL/TLS Certificate File Passphrase
   # Please enter the SCP user passphrase to retrieve the HTTPS Proxy PEM formatted SSL/TLS certificate file
   ProxyCertChainPwd=
   
   #### Static Parameters  - Do not change this section
   
   ### Deployment Settings
   
   ## Deployment Type
   # What type of deployment is this?
   # Default value: Crosswork Cloud
   Deployment=Crosswork Cloud
   
   ### Host Information
   
   ## Data Disk Size
   # Data disk size in GB mounted as /opt/dg/appdata
   DGAppdataDisk=24
   
   ### vNIC Role Assignment
   
   ## Default Gateway
   # The interface used as the Default Gateway and for DNS and NTP traffic
   # Default value: eth0
   NicDefaultGateway=eth0
   
   ## Administration
   # The interface used for SSH access to the VM
   # Default value: eth0
   NicAdministration=eth0
   
   ## External Logging
   # The interface used to send logs to an external logging server
   # Default value: eth0
   NicExternalLogging=eth0
   
   ## Management
   # The interface used for enrollment and other management traffic
   # Default value: eth0
   NicManagement=eth0
   
   ## Control
   # The interface used for destination, device, and collection configuration
   # Default value: eth0
   NicControl=eth0
   
   ## Northbound System Data
   # The interface used to send collection data to the system destination
   # Default value: eth0
   NicNBSystemData=eth0
   
   ## Northbound External Data
   # The interface used to send collection data to external destinations
   # Default value: eth0
   NicNBExternalData=eth0
   
   ## Southbound Data
   # The interface used collect data from all devices
   # Default value: eth0
   NicSBData=eth0
   
   ### Auto Enrollment Package Transfer
   
   ## Enrollment Token for Crosswork Cloud
   # Please enter the optional enrollment token to auto enroll with Crosswork Cloud
   CloudEnrollmentToken=TOKEN
   
   ## Enrollment Destination Host and Path
   # Please enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)EnrollmentURI=
   
   ## Enrollment Passphrase
   # Please enter the optional SCP user passphrase to transfer the enrollment package
   EnrollmentPassphrase=
   

3. Save the config.txt file with the hostname of the VM or a name that makes it easy for you to identify the VM for which you have updated it.

4. Repeat Step 4 (b) and Step 4 (c) to update and save a unique config.txt file for each VM using static addressing.

5. Proceed to Step 5.

Step 5

Log in to the OpenStack VM from the OpenStack UI.

Step 6

Navigate to Compute > Flavors to create the resource profile or flavor.

Step 7

Create an image for OpenStack install.

1. Enter details in the following fields:

   1. Image Name - Specify a name for the image you are creating.

   2. File - Navigate to the directory where you have downloaded the Crosswork Data Gateway release image and select the image.

   3. Format - Select QCOW2 - QEMU Emulator from the drop-down list.

   4. Leave the other settings to the values as shown in the image.

2. Click Create Image.

Step 8

Create a security group policy to allow incoming TCP/UDP/ICMP connections.

1. In the OpenStack UI, navigate to Networks > Security Groups.

2. Click + Create Security Group.

   

3. Specify the Name and Description of the security group. Click Create Security Group.

4. In the new window that appears to create security rules, click Add Rule to create a security policy for each protocol by specifying the direction, port range and the IP addresses range.

   The security group contains two rules by default. Use the Delete Rule option to delete these rules.

   

Step 9

Create ports with specified IP address ONLY if you are using Static addressing.

1. In the OpenStack UI, navigate to Network > Networks.

2. Depending on the number of NICs in your deployment, (starting with the management network), select a network and click + Create Ports.

3. Enter details in the Name and Fixed IP Address fields. Select the Enable Admin State and Port Security check box.

   

Step 10

Navigate to Compute > Instances. Click Launch Instance in this page.

Step 11

In the Details tab, specify the VM name in the Instance Name field and the Count as 1. Click Next.

Step 12

In the Source tab:

Step 13

In the Flavor tab, in the Available pane, for the flavor you want to select for the VM, click to move it from the Available pane to the Allocated pane. Click Next.

Step 14

Assign networks to the VM. Depending on the number of vNICs in your deployment, select up to 3 networks for the VM by clicking for each network from the list of networks in the Available pane. Doing this moves the selected networks to the Allocated pane. Click Next.

Step 15

Assign ports to the VM.

Step 16

Assign Security Groups to the VM by moving the security groups you wish to apply to the VM from the Available pane to the Allocated pane.

Step 17

In the Key Pair tab, click Next.

Step 18

In the Configuration tab:

Step 19

Click Launch Instance.

Step 20

Repeat Step 9 to Step 20 of the procedure to install all Crosswork Data Gateway VMs.

Step 1

Prepare the user data for the Crosswork Data Gateway VMs.

1. Prepare the user data for Crosswork Data Gateway VMs. See Cisco Crosswork Data Gateway Deployment Parameters and Scenarios for more information about the parameters. Sample user data for a VM is attached here for your reference. Important parameters have been highlighted.

   AwsIamRole=changeme
   ActiveVnics=3
   AllowRFC8190=Yes
   AuditdAddress=
   AuditdPort=60
   ControllerCertChainPwd=changeme
   ControllerIP=
   ControllerPort=30607
   ControllerSignCertChain=cw-admin@<controller-IP>:/home/cw-admin/controller.pem
   ControllerTlsCertChain=
   Deployment=Crosswork On-Premise
   Description=changeme
   DGAppdataDisk=5
   DGCertChain=
   DGCertChainPwd=
   DGCertKey=
   DNS=changeme
   DNSSEC=False
   DNSTLS=False
   Domain=changeme
   EnrollmentPassphrase=
   EnrollmentURI=
   Hostname=changeme
   Label=
   LLMNR=False
   mDNS-False
   NTP=changeme
   NTPAuth=False
   NTPKey=
   NTPKeyFile=
   NTPKeyFilePwd=
   Profile=Extended
   ProxyBypass=
   ProxyCertChain=
   ProxyCertChainPwd=
   ProxyPassphrase=
   ProxyURL=
   ProxyUsername=
   SyslogAddress=
   SyslogCertChain=
   SyslogCertChainPwd=
   SyslogPeerName=
   SyslogPort=514
   SyslogProtocol=UDP
   SyslogTLS=False
   UseRemoteAuditd=False
   UseRemoteSyslog=False
   Vnic0IPv4Address=0.0.0.0  //IP address of management interface
   Vnic0IPv4Gateway=0.0.0.1
   Vnic0IPv4Method=None
   Vnic0IPv4Netmask=0.0.0.0
   Vnic0IPv4SkipGateway=False
   Vnic0IPv6Address=::0
   Vnic0IPv6Gateway=::1
   Vnic0IPv6Method=None
   Vnic0IPv6Netmask=64
   Vnic0IPv6SkipGateway=False
   Vnic1IPv4Address=0.0.0.0  //IP address of data interface
   Vnic1IPv4Gateway=0.0.0.1
   Vnic1IPv4Method=None
   Vnic1IPv4Netmask=0.0.0.0
   Vnic1IPv4SkipGateway=False
   Vnic1IPv6Address=::0
   Vnic1IPv6Gateway=::1
   Vnic1IPv6Method=None
   Vnic1IPv6Netmask=64
   Vnic1IPv6SkipGateway=False
   Vnic2IPv4Address=0.0.0.0  //leave unchanged to default value.
   Vnic2IPv4Gateway=0.0.0.1
   Vnic2IPv4Method=None
   Vnic2IPv4Netmask=0.0.0.0
   Vnic2IPv4SkipGateway=False
   Vnic2IPv6Address=::0
   Vnic2IPv6Gateway=::1
   Vnic2IPv6Method=None
   Vnic2IPv6Netmask=64
   Vnic2IPv6SkipGateway=False
   dg-adminPassword=changeme
   dg-operPassword=changeme
   
   CloudEnrollmentToken=cloudenrollmenttoken  //enter the optional enrollment token to auto enroll with Crosswork Cloud
   EnrollmentURI=enrollmenturi  //enter the optional SCP destination host and path to transfer the enrollment package using SCP (user@host:/path/to/file)
   EnrollmentPassphrase=enrollmentpassphrase  //enter the optional SCP user passphrase to transfer the enrollment package

2. Repeat the previous step to create the user data for each Crosswork Data VM that you plan to install.

Step 2

Install the Crosswork Data Gateway VM.

1. Log in to AWS and search for the EC2 service. The EC2 dashboard opens.

2. Navigate to Launch Instance pane on the dashboard and click Launch Instance > Launch Instance.

   A Launch an Instance window appears.

3. In the Name and tags section, enter the name of the Crosswork Data Gateway VM.

4. In the Application and OS Images (Amazon Machine Image) section, click My AMIs > Owned by me and select the Crosswork Data Gateway AMI image in the Amazon Machine Image (AMI) field.

5. In the Instance type section, select the following instance types (both production and lab environment) based on the profile of the Crosswork Data VM you are deploying.

   • m5.4xlarge - for a Standard VM.

   • m5.8xlarge - for an Extended VM.

6. In the Key pair (login) section, select a Key pair name from the drop-down list.

   Note	Cisco Crosswork does not support key-based authentication. This is an AWS requirement and will not be used by Cisco Crosswork.

7. In the Network Settings section, click Edit.

   1. Enter values in the following fields:

      • VPC - Select the appropriate VPC for your environment.

      • Subnet - Select the subnet that you wish to assign to the management interface.

      • Auto-assign public IP - Select Disabled.

      • Firewall (security groups) - Specify a security group for the VM. You can create a security group or use an existing security group that you have already created.

        After you have entered the details above, under Advanced network configuration, a Network Interface1 is automatically created.

   2. Update the Description, Primary IP (vNIC0 IP address from the user data), Subnet, Security groups.

   3. Click Add network interface and add details for a second interface (corresponds to vNIC1) and a third interface (vNIC2) of the VM.

      Important

      Please note that the user data for the VM does not have an IP address for vNIC2 as this is assigned during pool creation. It is an AWS requirement to assign an IP address each time a network interface is created. You can either enter an IP address in the Primary IP field (static IP) of the third interface or leave it blank (AWS assigns an IP automatically).

8. In the Configure Storage section, click Advanced and click Add new volume to add an additional partition for your VM. Update the following fields for the newly created volume.

   • Device name - /device/sdb

   • Size (GIB) - 20 GB (Standard CDG) or 520 GB (Extended CDG)

   • Volume type - We recommend using gp2 or gp3.

9. In the Advanced Settings section, update the following fields.

   • IAM instance profile - Select the AWS IAM role that you had specified in the user data or create a new role.

   • Metadata accessible - Enabled.

   • Metadata version - V1 and V2 (token optional)

   • Metadata response hop limit - 2

   • User data - Copy the user data that you had prepared in Step 1 and paste it within the window here. If you are providing the parameters in a base64 encoded format, select the check box.

     Note	Ensure that there are no leading white spaces when you paste the user data otherwise the deployment will fail.

Step 3

Click Launch Instance. Amazon EC2 initiates the installation of the VM.

Step 4

Repeat steps 2 to 4 to install the remaining VMs.