pdf icon

download as PDF

pdf icon

PDFをダウンロード

This documentation covers how you can quickly get started using MSactivator™ by installing a Docker based mini lab and start testing the product.

Alternatively, if you want to test MSactivator™ without having to go though the installation process, you can register for a free access to our hosted trial setup

Video tutorial

This video details the steps for installing and activating the mini lab.

Prerequisites

The following prerequisites are required for a successful use of MSactivator™:

  1. A recent version of Git.

  2. A working docker and docker compose setup

Setup requirements

Internet Resources

Ensure you have access from HOST machine(s) to:

Install the MSactivator™ behind a proxy

Often the MSactivator™ has to be installed on a host that sits behind a proxy. This requires some specific configuration on the host, on docker and also on the MSactivator™ containers themselves:

Proxy setting on the host OS where the proxy needs to be specified and used. This is needed to download all the necessary docker packages as well as docker compose on the machine. Those settings are different depending on the OS that might be used.

Once installed, docker does not inherit the proxy settings from the host machine. Proxy settings need to be specified in dockers configuration file to download the necessary MSactivator™ images.

However, along with that, the "no proxy" option should be specified for the internal container to containers communication. Falling to do so will result in all the traffic routed the proxy.

The easiest way to do that is to edit the file docker-compose.yml and add the following to the services msa-dev, msa-api and msa-sms:

environment:
    http_proxy: "<PROXY URL>"
    https_proxy: "<PROXY URL>"
    no_proxy: "localhost,127.0.0.1,linux_me_2,linux_me,msa-cerebro,camunda,msa-alarm,db,msa-sms,msa-ai-ml,msa-ui,msa-dev,msa-bud,msa-kibana,msa-es,msa-front,msa-api"

If your proxy also rewrites the SSL certificates you will face errors such as fatal: unable to access 'https://github.com/openmsa/Workflows.git/': Peer’s Certificate issuer is not recognized. when installing the MSactivator™. To solve this you also need to add the following to the msa_dev and msa_api environment.

    GIT_SSL_NO_VERIFY: "true"

Hardware Resources

on a PC (for lab experimentation)

Minimum RAM memory to allocate to Docker:

  • On a 8GB RAM PC: allocate 4GB, 2 CPU, 50 GB of disk space.

  • On a 16GB RAM PC: you can allocate 6-8GB, 2+ CPU, 50 GB of disk space.

with less that 4GB of memory, the MSactivator™ may not function properly: some container such as the API container may not be able to start causing issues when connecting to the UI.
allocating more CPU might be tempting but before you do that you need to make sure that your system has enough memory. For instance, if you allocate 4 CPU to Docker, you need to allocate at least 8GB of memory.
if you are using Docker on MacOS, this guide will help you with this configuration.
if you are using Docker on Windows, this guide will help you with this configuration.

on a production environment

  • minimum 16GB, 4CPU, 200GB

Docker optional custom configuration

The custom configuration below may not be needed depending on your host computer and you intended use of the MSactivator™. If you are just running the product for evaluation purpose or training, don’t worry too much about these at first.

In a production environment, these custom configuration may be mandatory to allow your setup to support a higher workload.

Docker for Linux (or Linux VM)

execute as root

sysctl -w vm.max_map_count=262144
touch /etc/sysctl.d/50-msa.conf
echo 'vm.max_map_count = 262144' > /etc/sysctl.d/50-msa.conf
sysctl -p /etc/sysctl.d/50-msa.conf

Docker for Mac

From the command line, run:

screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty

Press enter and use`sysctl` to configure vm.max_map_count:

sysctl -w vm.max_map_count=262144

To exit the screen session, type Ctrl a d.

Docker for Windows

docker-machine create -d virtualbox  \
	--virtualbox-cpu-count=2 \
	--virtualbox-memory=8192 \
	--virtualbox-disk-size=50000 \
	default

In the docker VM, do as for Linux host above:

sudo sysctl -w vm.max_map_count=262144
sudo tee -a /etc/sysctl.conf <<< "vm.max_map_count=262144"

Mini lab creation

Step 1: creation

Create the mini lab: clone the quickstart git repository from Github, download and run the MSactivator™ from DockerHub.

  1. git clone https://github.com/ubiqube/quickstart.git

  2. cd quickstart

  3. ./scripts/install.sh (or ./scripts/install_win.sh for Windows users)

If you are already running the MSactivator™ and wish to upgrade it to a new version check the documentation below
The architecture of the mini lab is detailed in the architecture overview documentation in the admin guide.

Step 2: install the trial license

Contact your sales representative to request for a trial license

Open https://localhost/ and connect with username ncroot and password ubiqube.

Browse to "Settings" in the left menu and upload the free trial license you received.

use localhost if you are using your PC as the docker host, otherwise use the IP address assigned to the docker host.

Step 3: provision the mini lab with tenants, managed entities, etc.

The mini lab comes with 2 Linux container (linux_me / 172.20.0.101 and linux_me_2 / 172.20.0.102) for experimentation.

Credentials for the Linux machine are:

  • username: msa

  • password: ubiqube

In order to ease your discovery of MSactivator™, we are providing a script that will create the mini lab environment for you:

  • 1 tenant - BladeRunner

  • 1 subtenant - Tyrell Corporation

  • 2 managed entities to manage the Linux container - linux_me

  • some microservices and workflows to start configuring the managed entity - users, firewall, etc.

To create the mini lab environment, run the CLI command from where you have cloned the quickstart Github project:

docker compose exec msa-dev /usr/bin/create_mini_lab.sh

Step 4: change default password of super admin(ncroot)

Browse: https://localhost/ and connect with username ncroot and password ubiqube.

After Login, Go to Profile tab and Edit Profile. Update new password for ncroot and do Logout.

Step 5: start using the MSactivator™

Browse: https://localhost/ and connect with username ncroot and updated password in previous step.

Mini lab detailed description

Use case 1: firewall orchestration on Linux

This lab use case will show you in a simple way how you can use MSactivator™ to automate the configuration of iptables-based firewall policy on the Linux containers included in the mini lab.

The development of this use case is detailed in this guide: Firewall Policy Automation

You can use the guide to recreate the use case step by step or you may also directly run the use case with the workflow and microservices that are installed in the mini-lab.

For that, you’ll have to select the subtenant named "TYRELL CORPORATION," click on the link "Automation" on the left menu and select the tab "Workflows." The workflow to use is "Simple Firewall (Python)."

Mini lab additional info

Fresh install or upgrade ?

The quickstart repository is maintained on https://github.com/ubiqube/quickstart, the latest version is tagged as tags/MSA-2.8.13

If you are upgrading your MSactivator™, the best and easiest option is to remove your Quickstart git repository and use git clone to get the new version.

In case you have updated the MSactivator™ with docker compose up -d or docker compose pull, you might experience cache issues (for instance, your changes may not be reflected on the UI). To solve that, you can clean your browser cache, or use a browser private session.

Upgrade version N to N+1

Starting from it’s version 2.2.0, the quickstart project provides a script upgrade.sh for taking care of possible upgrade actions such as recreate some volumes, execute some database specific updates, update the libraries,…​

Let’s say that you are running the version MSA-2.8.10, to upgrade to the version MSA-2.8.13 you need to follow these steps:

  1. cd quickstart

  2. git checkout master

  3. git pull

  4. ./scripts/install.sh

when running the upgrade script, it will ask you if you want your local libraries to be updated with the latest version from the community. If you answer 'y', the update will be done automatically. You can also do the update later manually on the container msa_dev.
# ./scripts/install.sh --help
usage: install.sh [--mini-lab|-m] [--force|-f] [--cleanup|-c] [--remove-orphans|-ro]
this script installs and upgrades a {product_name}

-m: mini lab creation. Create a demo platform around a Linux ME
-f: force the upgrade without asking for user confirmation. Permit also to reapply the upgrade and to auto merge files from OpenMSA
-c: cleanup unused images after upgrade to save disk space. This option clean all unused images, not only MSA quickstart ones
-ro: remove containers for services not defined in the compose file. Use it if some containers use same network as MSA
-mano : apply mano containers

Note for Windows user

If your original version is 2.1, plz refer to upgrade script first provided with 2.2.0 GA. In any cases, perform those commands

  1. cd quickstart

  2. git checkout master

  3. git pull

  4. ./scripts/install_win.sh

NOTE : you may face an issue at the end of the script with a message "Wait Kibana to be ready". This is a known issue, the workaround is to execute docker compose up -d from another CLI.

Install a specific version

For each release of the MSactivator™, there is a tag that you can use if you need to install a specific version of the product.

To install a tagged version, you can checkout the tag and go to the install steps above.

For example, the CLI command below will checkout the quickstart for the release MSA-2.8.13.

The releases and tags are available here

install_libraries script

The script install_libraries.sh is installed in the container msa_dev.

This script is designed to populate the libraries for a fresh install or to update your libraries with the latest version from Github.

$ docker compose exec msa-dev /usr/bin/install_libraries.sh --help
usage: install_libraries.sh all|ms|wf|da|py|mano|quickstart [--lic] [-y]

this script installs some libraries available @github.com/openmsa

Commands:
all:          install everything: workflows, microservices and adapters
ms:           install the microservices from https://github.com/openmsa/Microservices
wf:           install the workflows from https://github.com/openmsa/Workflows
da:           install the adapters from https://github.com/openmsa/Adapters
mano:         install/update the python-sdk from https://github.com/openmsa/etsi-mano
py:           install/update the python-sdk from https://github.com/openmsa/python-sdk
quickstart:   install/update the local quickstart from https://github.com/ubiqube/quickstart

Options:
--lic:     force license installation
-y:           answer yes for all questions

In case of calling this script on an existing setup, it will take care of merging the code from the Github master branch into your local development branch. With the option -y, an automated merge will be attempted, without the option, the script will ask for user input.

Mini lab package description

Adapters

Table 1. Adapters installed as part of the quickstart
Vendor Model / OS Description github.com/openmsa

A10 Networks

Thunder® Convergent Firewall

Thunder® Convergent Firewall

a10_thunder

ADVA

FSP 3000 Access Connect

FSP 3000 Access Connect

adva_nc

ADTRAN

ADTRAN

adtran_generic

Amazon Web Service

EC2 / VPC

EC2: instance management

aws_generic

Atlassian

JIRA REST API

README

rest_generic

Checkpoint

R80

Next Generation Firewalls (NGFW)

checkpoint_r80

Cisco

Catalyst IOS

Catalyst Switches

catalyst_ios

Cisco

ASA

Cisco ASA series

cisco_asa_generic

Cisco

IOS

Cisco ISR/ASR series

Cisco

Nexus 9000

Cisco Nexus 9000 Series Switches

cisco_nexus9000

Cisco

Email Security Appliance

Cisco Email Security Appliance

esa

Cisco

Web Security Appliance

Cisco Web Security Appliance

wsa

Citrix

ADC (formelly Netscaler)

Citrix ADC

citrix_adc

Dell

Server / BIOS management with REDFISH API

Redfish API with Dell integrated Remote Access Controller

dell_redfish

Dogtag

PKI management

Dogtag PKI

dogtag_pki

DTMF

RedFish API

DMTF Redfish®

redfish_generic

Elastic.co

Elasticsearch

README

rest_generic

ETSI-MANO

NFVO

nfvo_generic

ETSI-MANO

VNFM

vnfm_generic

F5

BIG-IP

F5 BIG-IP iSeries Platform

f5_bigip

Flexiwan

SDWAN

README

rest_generic

Fortinet

FortiGate NGFW

FortiGate Next-Generation Firewall (NGFW)

fortigate

Fortinet

FortiWeb WAFW

FortiWeb: Web Application Firewall and API Protection

fortiweb

Fujitsu

IPCOM

FUJITSU Network IPCOM

fujitsu_ipcom

Fujitsu

Virtuora NC

FUJITSU Network Virtuora NC

virtuora_nc

Huawei

AR2200 Series Routers

AR2200 Series Routers

huawei_generic

Hewlett Packard Enterprise

HP 2530 Switch Series

HP 2530

hp2530

Hewlett Packard Enterprise

Server / BIOS management with REDFISH API

Lights Out (iLO) server management

hpe_redfish

Intel

Server / BIOS management with REDFISH API

Redfish API with Dell integrated Remote Access Controller

intel_redfish

Juniper

SRX Series Services Gateways (junOS)

SRX NG Firewall

juniper_srx

Kubernetes - K8s

kubernetes.io

kubernetes_generic

Lanner

IPMI

IPMI manual

lanner_ipmi

Linux

Generic adapter based on remote (SSH) CLI command execution

linux_generic

Microsoft Azure

Generic REST

README

rest_generic

MikroTik

MikroTik Management tools

mikrotik_generic

MySQL

MySQL database management. See this doc for specifics.

MySQL

mysql_generic

NEC

IX, NFA

Netbox

REST Generic

README

rest_generic

Netconf

Generic

NETCONF

netconf_generic

Nokia

Nokia

OneAccess

Generic, Netconf

Virtual Network Function

OpenStack

OpenStack API Documentation

openstack_keystone_v3

Oracle

VM Manager

Oracle VM Manager

ovm

PaloAlto

VA, Chassis/Vsys

PAN‑OS®

pfSense

Firewall

pfSense

pfsense_fw

Rancher

rancher.com

rancher_cmp

Redhat Ansible

Ansible Playbook

ANSIBLE

REST API

Generic

README

rest_generic

REST API

Netbox

Netbox API Overview

rest_netbox

RSA Netwitness

Threat detection and response

RSA Netwitness

rsa_netwitness

Stormshield

SNS

SNS

stormshield

Terraform

Infrastructure management

Terraform

terraform_generic

VeEX

RTU

RTU-300/320

veex_rtu

VMware

vSphere

REST API

vmware_vsphere

Microservices

Table 2. Microservices installed as part of the quickstart
Vendor Description github.com/openmsa

ADVA

FSP 3000 Access Connect

ADVA

Redhat Ansible

Ansible Playbook

ANSIBLE

Amazon Web Service

Amazon Elastic Compute Cloud

AWS

Checkpoint R80

Next Generation Firewalls (NGFW)

CHECKPOINT

Cisco ASA, IOS, Catalyst

Firewall, router and switch management

CISCO

Citrix ADC

Citrix Application Delivery Controller

CITRIX

ENEA

Enea NFV Access

ENEA

FlexiWan

Open source SD-WAN

FLEXIWAN

Fortinet

Fortigate and FortiWeb firewall

FORTINET

Juniper JunOS

SRX NG Firewall

JunOS generic

Linux Generic

LINUX

Netbox

NetBox

NETBOX

OpenStack

OpenStack API

OPENSTACK

OneAccess

Virtual Network Function

ONEACCESS

PaloAlto

PAN‑OS®

PALOALTO

pfSense

pfSense firewall

PFSENSE

RedFish API

DMTF Redfish®

REDFISHAPI

VMware vSphere vCenter

vCenter REST API

VMWARE

Workflows

Table 3. Workflows installed as part of the quickstart
Name Description github.com/openmsa

BIOS Automation

Automate BIOS setting and image upgrade with RedFish API

BIOS_Automation

Ansible

Enables the MSactivator™ to call an Ansible playbook

Ansible

Instance Management on Amazon Web Service

Enables the MSactivator™ to Start a VM on AWS

AWS Instance Management

Topology Backend Workflow

Used by MSactivator™ to manage the topology

Topology

YANG to Microservice converter

Convert YANG definition file to executable Microservices

convert YANG to MicroService