Create Secure Edge Networks

Download the certified hardware image from the certified images page.

Log into Distributed Cloud Console and create a site token as per the instructions in the CE Deployment guides.

Note: You can also use an existing site token. In case you do not have any token, create one for using later for registration.

• Install the Distributed Cloud Services software using the downloaded image on the commodity device as per the instructions in the Create Baremetal Site guide.

• Log into your device terminal and perform initial configuration. Initial configuration includes setting site token, cluster name, and set default values for rest of the options, such as network configuration.

• Log into Console and select the Multi-Cloud Network Connect workspace.

• Select Manage from the configuration menu and Site Management > Registrations in the options.

• Click Pending Registrations tab and find the registration request for your device. Click Approve.

• Click Accept to confirm.

Note: Check for your device status in the Other Registrations tab. The ONLINE status indicates that the Site is provisioned and ready to use.

Perform the steps in Step 1: Deploy Site. This step performs automatic Site registration.

Create virtual networks and network interfaces for the inside and outside networks. Also, create a network connector for connecting inside network with outside network.

Step 2.1.1: Create outside and inside networks.

• Select Manage in the configuration menu and Networking > Virtual Networks in the options. Click Add virtual network.
• Enter a name for your network and select Site Local Network for the Network Type field.
• Click Add subnet, enter an IP address for the Prefix field, and enter prefix length for the Prefix Length field. Click Apply to add subnet.
• Click Add virtual network to create the virtual network.

Figure: Virtual Network Creation

• Repeat the above steps to create another network with the Network Type as Site Local Inside Network.

Step 2.1.2: Create outside and inside network interfaces.

• Select Manage in the configuration menu and Networking > Network Interfaces in the options. Click Add network interface.
• Enter a name for your network interface, set Ethernet for the Type field, and set eth0 for the Device Name field.
• Click Select Virtual Network, select the outside network created in the previous step and click Select Virtual Network to apply the virtual network.
• Select Enable for the Enable DHCP Client field.
• Select Disable DHCP Server for the Enable DHCP Server field.
• Click Add network interface to complete creating the network interface.

Figure: Network Interface Creation

• Repeat the above steps to create another network interface with the following configuration:
  • Set Ethernet for the Type field and set eth1 for the Device Name field.
  • Click Select Virtual Network, select the inside network created in the previous step and click Select Virtual Network to apply the virtual network.
  • Select Disable for the Enable DHCP Client field.
  • Select Enable DHCP Server for the Enable DHCP Server field.

Step 2.1.3: Create network connector.

• Select Manage in the configuration menu and Networking > Network Connectors in the options.
• Click Add network connector.
• Enter a name for your network and select Default Gateway Snat for the Network Connector Type field.
• Select Site Local Network for the Outside Virtual Network Type field.
• Click Select outside network and select the outside network created in Step 2.1.1.
• Select Site Local Inside Network for the Inside Virtual Network Type field.
• Click Select inside network and select the inside network in Step 2.1.1.
• Click Add network connector to complete creating the network connector.

Figure: Network Connector Creation

• Navigate to the Manage in the configuration menu and Fleets in the options. Click Add fleet to load fleet creation form.
• Enter a name for your fleet and set a label in the Fleet Label Value field.

Figure: Fleet Basic Configuration

Click Add fleet to complete fleet creation.

• Select Sites from configuration menu and Site List from options.
• Click ... > Edit to open Site edit form.
• Click in the Labels field and select ves.io/fleet as the label.
• Select the value as the label of the fleet you created in Step 2.2.

Figure: Add Fleet Label to Site

• Click Save changes to add your Site to the fleet.

• Select Manage in the configuration menu and Networking > Network Connectors in the options.
• Find the network connector created and click ... > Edit.
• Scroll down to the Proxy Type field and select Forward Proxy.
• Click Save changes.

• Select Manage in the configuration menu and Site Management > Discovery in options. Click Add discovery and enter the configuration as per the following guidelines:

  • Enter a name in the Name field.
  • Select Virtual Site for the Where field.
  • Click Select ref, select hipster-webapp-west as the Site, and click Select ref.
  • Select Site Local Network for the Network Type field.
  • Select Kubernetes for the Type field.
  • Select K8s for the Discovery Service Access Information field and select Kubeconfig for the Oneoff field.

Figure: Service Discovery Configuration

• Encrypt Kubeconfig file for your EKS cluster using the F5 Distributed Cloud Blindfold:

vesctl request secrets encrypt --policy-document <policy-doc> --public-key <public-key> hipster-app-kubeconfig > hipster-app-bf-secret

• Click Kubeconfig and enter the configuration as per the following guidelines:
  • Select Blindfold for the Secret info field.
  • Enter the encrypted secret in the Location field.
  • Select EncodingNone for Secret Encoding field.

Figure: Service Discovery Secret Configuration

• Select Apply and Add discovery to create discovery object.

• Select Manage > Endpoints.

• Click Add endpoint and enter the configuration as per the following guidelines:

  • Enter a name in the Name field.
  • Enter Site for the Where field and select hipster-webapp-west for the Select ref field.
  • Select Site Local Network for the network type.
  • Select Service Selector Info for Endpoint Specifier field.
  • Select Kubernetes for the Discovery field and Service Name for the Service field.
  • Enter frontend.hipster as the service name. Here hipster is the K8s namespace name.
  • Select TCP as the protocol.
  • Enter 80 for the Port field.
  • Click Add endpoint to create endpoint.

• Select Manage > Healthcheck.

• Click Add healthcheck and enter the configuration as per the following guidelines:

  • Enter a name in the Name field.
  • Select HTTP Healthcheck the Health check field.
  • Enter / for path
  • Enter 5 for Timeout and Interval fields. This sets timeout and interval as 5 seconds for health check.
  • Enter 3 and 1 for Unhealthy Threshold and Healthy Threshold fields.
  • Click Add healthchcek.

• Select Manage > Clusters.

• Click Add cluster and enter the configuration as per the following guidelines:

  • Enter a name in the Name field.
  • Select the endpoint created for the Select endpoint field.
  • Select the healthcheck object created for the Select healthcheck field.
  • Select Round Robin for the LoadBalancer Algorithm field.
  • Click Add cluster.

• Select Manage > Routes. Enter a name and click Add route.

• Enter the configuration as per the following guidelines:

  • Click Add match. Select ANY for the HTTP Method field and Regex for the Path Match field. Enter (.*?) for the Regex field and click Add match.
  • Select Destination List for the Route action field and click Add destination. Click Select cluster and select the cluster object created. Click Select cluster and Add destination to add the cluster.
  • Click Add route to create the route.

• Select Manage > Advertise Policies.
• Click Add advertise policy and select Site for the Where field.
• Click Select ref and select the Site created in the Step 1: Provision section.
• Select TCP as the protocol and 443 as the port.
• Click Add advertise policy to complete creating the advertise policy.

Use the public key and policy document obtained. This example shows the sample of generating a secret for your application domain. Store the output to a file.

vesctl request secrets encrypt --policy-document secure-kgw-demo-policy-doc --public-key hipster-co-public-key tls.key > tls.key.secret

Note: The tls.key is the private key of the certificate you generated.

• Select Manage > Virtual Hosts.

• Click Add virtual host and set the configuration as per the following guidelines:

  • Enter name, application domain, and your proxy type. This sample uses HTTPS_PROXY as the proxy type and hello-web-4.helloclouds.app as the domain.
  • Select previously defined route.
  • Select previously created advertise policy.
  • Click TLS Parameters and click Add TLS certificate in the TLS configuration form.
  • Generate Base64 string of your certificate and enter it in the string:/// format in the Certificate URL field. You can use the echo <certficiate> |base64 command.
  • Click Private key and select Secret info as Blindfold secret and enter the secret in the Location field. Select Secret Encoding as EncodingNone. Click Apply and Add virtual host.

Note: Use the secret created in previous step.

• Change to the system namespace and select Security > Firewall > Network Policies. Click Add network policy.

• Set a name for the policy and select Endpoints Reachable via all Outside Interfaces in the Select Endpoint field of Attachment section. This makes the policy apply to all endpoints.

Figure: Network Policy Endpoint Configuration

• Click Configure in the Egress section and configure egress rules as per the following guidelines:

  • Select Deny for the Action field.
  • Select IPv4 Prefix List for the Select Other Endpoint field.
  • Set 8.8.8.8/32 for the IPv4 Prefix List field.
  • Enter a name for the Rule Name field and click Apply.

Figure: Network Policy Egress Rule

• Click Continue to create the network policy.

Navigate to Security > Firewall > Forward Proxy Policy.

Step 4.2.1: Create a forward proxy policy to allow access to GitHub.

• Click Add forward proxy policy and enter the following configuration:

  • Set a name for the policy.
  • Select All Proxies on Site for the Select Forward Proxy field in the Proxy section.
  • Select Allowed Connections in the Select Policy Rules section and click Configure under the TLS Domains field.

Figure: Forward Proxy Policy Rule Configuration

• Click Add item in the TLS Domains screen and enter github.com in the Exact Value field. You can change Enter Domain field to exact value or suffix value or regex values. However, the default is exact value.

Figure: Forward Proxy Policy TLS Domain Configuration

• Click Apply to add the TLS domain to the forward proxy policy configuration.
• Click Continue to complete creating the forward proxy.

Step 4.2.2: Create another forward proxy policy to block access to malicious sites of your choice.

• Set a name for the policy.
• Select All Proxies on Site for the Select Forward Proxy field in the Proxy section.
• Select Denied Connections in the Select Policy Rules section.
• Click Configure for the TLS Domains field, click Add item in the TLS domains screen, and select a value for the Enter Domain field.
• Enter a domain as per your domain type selection and click Apply. This example setting suffix value.

Figure: Forward Proxy Policy TLS Deny Configuration

• Similarly, click Configure for the HTTP URLs field and add URLs of the Sites to which access is to be blocked and click Apply. This example shows sample Sites that are blocked.

Figure: Forward Proxy Policy HTTP Deny Configuration

• Click Continue to complete creating the forward proxy policy.

• Select Security > Firewall > Network Firewall. Click Add network firewall and set the following configuration:

  • Set a name for the firewall.
  • Select Active Forward Proxy Policies for the Select Forward Policy Configuration field in the Forward Proxy Policy section.
  • Select the deny policy created in the previous step for the Forward Proxy Policies field.
  • Click Add item and add the GitHub allow policy.
  • Select Active Network Policies for the Select Network Policy Configuration field in the Network Policy section.
  • Select the deny policy for IP address range 8.8.8.8/32 created in the previous step for the Network Policies field.

Figure: Network Firewall Configuration

• Click Continue to complete creating network firewall.

• Select Manage > Site Management > Fleets and find your fleet from the displayed list.
• Click ... > Edit to open the fleet edit form.
• Click Select network firewall and select the firewall created in the previous step.
• Click Save changes to apply the network firewall to the fleet of Sites.

Figure: Network Firewall Addition to Fleet

Note: After adding the network firewall to the fleet, any updates to the network policy or forward proxy policy are applied to all Sites that are part of that fleet.

• Change to your application namespace and create WAF.

  • Navigate to Security > App Firewall > App Firewall.
  • Click Add firewall.
  • Enter a name and select BLOCK for the Mode field.
  • Click Add firewall to complete creating the WAF.

Figure: WAF Creation

• Navigate to your virtual host and apply the WAF.

  • Navigate to Manage > Virtual Hosts. Find your virtual host from the displayed list and click ... > Edit to open the virtual host edit form.
  • Scroll down and click WAF Config to open the WAF configuration form.
  • Select WAF for the WAF Config field. Click Select WAF, select the created WAF, and click Apply.
  • Click Save changes to apply WAF to virtual host configuration.

Figure: Apply WAF to Virtual Host

• Use curl command load github.com and GitHub should be allowed.
• Use curl command to load the URLs you configured to block in the forward proxy deny policy. The requests should be rejected.
• Enter ping 8.8.8.8/32 from the command line and this should be unsuccessful.

• Navigate to Sites > Site List and click on your site to open its dashboard.
• Click on the Requests tab and check the sample requests. Your requests to the blocked sites are displayed along with the HTTP return code.

Figure: Sampled Site Requests

• Change to system namespace and navigate to Notifications > Alerts. By default, active alerts are displayed for all sites. Filter the alerts for your site by entering your site name in the Search field.
• Switch to all alerts using the All option. All alerts for your site are displayed.

Figure: Site Alerts

Note: You can also post your alerts to a 3rd party monitoring system or communication platform, such as OpsGenie or Slack. For more information, see the Alerting guides.