Isolating workloads with a secure private network

Objectives

• Deploy a Virtual Router Appliance (VRA)
• Define VLANs and IP subnets to deploy virtual machines and bare-metal servers
• Secure the VRA and enclosure with firewall rules

1. Configure VPN
2. Deploy VRA
3. Create Virtual Server
4. Route access through VRA
5. Configure enclosure firewall
6. Define APP zone
7. Define INSIDE zone

Before you begin

Provision Virtual Router Appliance

The first step is to deploy a Virtual Router Appliance (VRA) that will provide IP routing and the firewall for the private network enclosure. The internet is accessible from the enclosure by an IBM Cloud-provided public facing transit VLAN, a gateway and, optionally, a hardware firewall to create the connectivity from the public VLAN to the secure private enclosure VLANs. In this solution tutorial, a VRA provides this gateway and firewall for the perimeter.

1. From the catalog, select a Gateway Appliance
2. At the Gateway Vendor section, select AT&T. You can choose between "up to 20 Gbps" or "up to 2 Gbps" Uplink Speed.
3. At the Hostname section, enter a Hostname and a Domain for your new VRA.
4. If you check the High Availability check box, you get two VRA devices working in an active/backup setup using VRRP.
5. At the Location section, select the Location and the Pod in which you need your VRA.
6. Select Single Processor or Dual Processor. You get a list of Servers. Choose a Server by clicking its radio button.
7. Select the amount of RAM. For a production environment, it is recommended to use a minimum of 64GB of RAM. 8GB minimum for a test environment.
8. Select a SSH Key (optional). This SSH key will be installed on the VRA, so the user vyatta can be used to access the VRA with this key.
9. Hard Drive. Keep the default.
10. In the Uplink Port Speeds section, select the combination of speed, redundancy and private and/or public interfaces that meets your needs.
11. In the Add-ons section, keep the default. If you want to use IPv6 on the public interface, select IPv6 address.

In the right pane, you can see your Order Summary. Select the I have read and agree to the Third-Party Service Agreements listed below: checkbox and then click the Create button. Your gateway will be deployed.

The Device list will show the VRA almost immediately with a Clock symbol against it, indicating transactions are in progress on this device. Until the VRA creation is complete, the Clock symbol remains and, beyond viewing details, it is not possible to perform any configuration actions against device.

Initial VRA setup

1. From your workstation, use the SSL VPN to log in to the VRA using the default vyatta account, accepting the SSH security prompts.

   ssh vyatta@<VRA Private IP Address>
   

   If SSH prompts for a password, the SSH key was not included in the build. Access the VRA using the web browser using the VRA Private IP Address. The password is from the Software Passwords page. On the Configuration tab, select the System/login/vyatta branch and add the desired SSH key.

   Setup of the VRA requires the VRA to be placed into [edit] mode using the configure command. When in edit mode the prompt changes from $ to #. After a successful VRA configuration change you can view your changes with the compare command and check your changes with the validate command. By committing a change with the commit command it will be applied to the running configuration, and automatically saved to the startup configuration.

2. Enhance security by only allowing SSH login. Now that SSH login is successful using the private network, disable access via userid/password authentication.

   configure
   set service ssh disable-password-authentication
   commit
   exit
   

   From this point in this tutorial, it is assumed that all VRA commands are entered at the edit prompt after using the configure command.

3. Review the initial configuration.

   show
   

   The VRA is pre-configured for the IBM Cloud IaaS environment. This includes the following:

   • NTP server
   • Name servers
   • SSH
   • HTTPS web server
   • Default time-zone US/Chicago

4. Set the local time zone as required. Auto-complete with the tab key will list the potential time zone values.

   set system time-zone <timezone>
   

5. Set the ping behavior. Ping is not disabled to aid in routing and firewall troubleshooting.

   set security firewall all-ping enable
   set security firewall broadcast-ping disable
   

6. Enable stateful firewall operation. By default, the VRA firewall is stateless.

   set security firewall global-state-policy icmp
   set security firewall global-state-policy udp
   set security firewall global-state-policy tcp
   

7. Commit and automatically save your changes to the startup configuration.

   commit
   

Order the first virtual server

A virtual server is created at this point to aid in diagnosis of VRA configuration errors. Successful access to the VSI is validated over the IBM Cloud private network before access to it is routed via the VRA in a later step.

1. Order a virtual server.
2. On the order page:
   • Select Public.
   • Set Billing to Hourly.
   • Set the VSI Hostname and Domain name. This domain name is not used for routing and DNS but should align with your network naming standards.
   • Set Location to the same as the VRA.
   • Set Profile to C1.1x1
   • Add the SSH Key you specified earlier.
   • Set Operating System to CentOS 7.x - Minimal
   • In Uplink Port Speeds, the network interface must be changed from the default of public and private to only specify a Private Network Uplink. This ensures that the new server has no direct access to the Internet.
   • Set Private VLAN to the VLAN number of the private VLAN ordered earlier.
3. Select the checkbox to accept the 'Third-Party' service agreements, then click Create.
4. Monitor for completion on the Devices page or via email.
5. Make note of the Private IP address of the VSI for a later step and that under the Network section on the Device Details page that the VSI is assigned to the correct VLAN. If not, delete this VSI and create a new VSI on the correct VLAN.
6. Verify successful access to the VSI via the IBM Cloud private network using ping and SSH from your local workstation over the VPN.

   ping <VSI Private IP Address>
   SSH root@<VSI Private IP Address>
   

Route VLAN access through the VRA

The private VLAN(s) for the virtual server are associated by the IBM Cloud management system to this VRA. At this stage, the VSI is still accessible via the IP routing on the IBM Cloud private network. You will now route the subnet via the VRA to create the secure private network and validate by confirming that the VSI is now not accessible.

1. Proceed to the Gateway Details for the VRA via the Gateway Appliances page and locate the Associated VLANs section on the lower half of the page. The associated VLAN will be listed here. At this stage, the VLAN and associated subnet are not protected or routed via the VRA, and the VSI is accessible via the IBM Cloud Private network. The status of VLAN is shown as Route Around. Click on the Manage VLANs button.

   The Associate VLAN link is enabled allowing you to add other provisioned VLANs. If no VLANs are available on the same router as the VRA, the link is grayed out. This will require you to order a VLAN to request a private VLAN on the same router as the VRA. Initial VLAN association can take a couple of minutes to complete. After completion, the VLAN is shown under the Associated VLANs heading.

2. Click on the check box to the left of the associated VLAN and then click on Route Through to route the VLAN/Subnet via the VRA. This can take a few minutes. A screen refresh will show the status is Route Through.

3. Click on the VLAN number to view the VLAN details. Under Devices, the provisioned VSI can be seen. Under Subnets, the Primary Subnet which is to be used with the VRA is seen. Make a note of the Private VLAN Number <nnnn> as this will be used in a later step.

   For proper identification of a VLAN, check VLAN identification

4. Click on the subnet to see the IP subnet details. Make a note of the subnet network, gateway addresses and CIDR (/26) as these are required for further VRA configuration.

5. Validate the that the subnet/VLAN is routed to the VRA and the VSI is NOT accessible via the management network from your workstation using ping.

   ping <VSI Private IP Address>
   

This completes setup of the VRA via the IBM Cloud console. The additional work to configure the enclosure and IP routing is now performed directly on the VRA via SSH.

Configure IP routing and secure enclosure

When the VRA configuration is committed, the running configuration is changed and the changes are automatically saved to the startup configuration.

If you want to return to a previous working configuration, by default, the last 20 commit points can be viewed, compared, or restored. See the supplemental documentation Basic System Configuration Guide for details on show system commit, compare, rollback.

Secure the VRA

1. Apply VRA security policy. By default, policy-based firewall zoning does not secure access to the VRA itself. This is configured through Control Plane Policing (CPP). VRA provides a basic CPP rule set as a template. Merge it into your configuration:

   configure
   merge /opt/vyatta/etc/cpp.conf
   

   This creates a new firewall rule set named CPP. View the additional rules and commit in [edit] mode.

   show security firewall name CPP
   commit
   

2. Securing public SSH access. Due to an outstanding issue at this time with the Vyatta firmware, it is not recommended to use set service SSH listen-address x.x.x.x to limit SSH administrative access over the public network. Alternatively, external access can be blocked via the CPP firewall for the range of public IP addresses used by the VRA public interface. The <VRA Public IP Subnet> used here is the same as the <VRA Public IP Address> with the last octet being zero (x.x.x.0).

   set security firewall name CPP rule 900 action drop
   set security firewall name CPP rule 900 destination address <VRA Public IP Subnet>/24
   set security firewall name CPP rule 900 protocol tcp
   set security firewall name CPP rule 900 destination port 22
   commit
   

3. Validate VRA SSH administrative access over the IBM internal network. If access is lost to the VRA via SSH after performing commits, you can access the VRA via the KVM Console available at the Device Details page of the VRA via the Action menu.

This completes the setup of the secure private network enclosure protecting a single firewall zone containing a VLAN and subnet. Additional firewall zones, rules, virtual and bare-metal servers, VLANs and subnets can be added following the same instructions.

Remove resources

In this step, you will clean up the resources to remove what you created.

• Cancel any virtual servers or bare-metal servers
• Disassociate and Cancel any VLANs
• Cancel the VRA

The VRA is on a monthly paid plan. Cancellation does not result in a refund. It is suggested to only cancel if this VRA will not be required again in the next month. If a dual VRA High-Availability cluster is required, this single VRA can be upgraded on the Gateway Details page.

Related content

• IBM Virtual Router Appliance
• Static and Portable IP Subnets
• IBM QRadar Security Intelligence Platform
• Vyatta documentation