Docs 545 AWS Conductor deployment guide

docs/_deploy_aws_conductor_network_design.md

@@ -0,0 +1,25 @@
+<!--- AWS Conductor Deployment Guide - Network Design Reference --->
+
+The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your environment.
+
+| Parameter | Example Value | Description |
+|-----------|--------------|-------------|
+| Authority Name | `Authority128` | Organizational authority name |
+| Conductor Name | `Conductor` | Conductor system name |
+| Conductor Node Name | `node0` | Conductor node name |
+| Conductor Instance Type | `c5.xlarge` | AWS EC2 instance size |
+| Conductor VPC CIDR | `10.0.0.0/16` | AWS VPC for the conductor |
+| Conductor Subnet CIDR | `10.0.1.0/24` | Control subnet within the conductor VPC |
+| Conductor Private IP | `10.0.1.10` | Private IP assigned to the conductor ENI |
+| Conductor Elastic IP | `203.0.113.10` | AWS Elastic IP — the address managed routers use to reach this conductor |
+| SSR Version | `7.1.4` | SSR software version installed via BYOL |
+| Tenant Name | `corp` | LAN-side user tenant |
+| Service Name | `Internet-Traffic` | Internet breakout service |
+| Service Address | `0.0.0.0/0` | All internet-bound traffic |
+| Router Name | `aws-branch1` | Example router name |
+| Router Node Name | `node0` | Router node name |
+| Router Instance Type | `c5.xlarge` | AWS EC2 instance size |
+| Router WAN Subnet | `10.1.1.0/24` | WAN (public) subnet in the router VPC |
+| Router LAN Subnet | `10.1.2.0/24` | LAN (private) subnet in the router VPC |
+| Router WAN Elastic IP | `203.0.113.20` | Elastic IP on the router WAN ENI (external peering address) |
+| Router LAN IP | `10.1.2.1` | Static LAN gateway address on the router |

docs/deploy_appendix_aws_conductor.mdx

@@ -0,0 +1,200 @@
+---
+title: "Appendix: AWS Configuration"
+sidebar_label: "Appendix: AWS Configuration"
+---
+import NetworkDesign from './_deploy_aws_conductor_network_design.md';
+
+This appendix contains the complete SSR PCLI configuration for the `Conductor` and `aws-branch1` described in this guide. This configuration reflects the final state after completing all steps through [Step 5 — Configure the Router on the Conductor](deploy_aws_router_config.mdx).
+
+:::important
+- Replace `203.0.113.10` with your actual conductor Elastic IP.
+- Replace `203.0.113.20` with your actual router WAN Elastic IP.
+- The PCI addresses `0000:00:06.0` (WAN) and `0000:00:07.0` (LAN) are the defaults for EC2 instances deployed with the BYOL CloudFormation template when a management subnet is provided. Verify these against your specific instance using `sudo dpdk-devbind.py --status` before applying the router configuration.
+:::
+
+## Applying This Configuration
+
+This configuration can be applied to a freshly initialized conductor using the PCLI import function.
+
+1. Save the configuration below to a file — for example, `aws-conductor.cfg`.
+
+2. Copy the file to the conductor:
+
+   ```bash
+   scp aws-conductor.cfg admin@203.0.113.10:/tmp/
+   ```
+
+3. Log in to the conductor PCLI:
+
+   ```bash
+   ssh admin@203.0.113.10
+   ```
+
+4. Enter configuration mode and import:
+
+   ```text
+   admin@node0.Conductor# import config /tmp/aws-conductor.cfg
+   ```
+
+5. Review any validation warnings, then commit:
+
+   ```text
+   admin@node0.Conductor (config)# commit
+   Are you sure you want to commit the candidate config? [y/N]: y
+   ```
+
+Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode.
+
+## Complete Configuration
+
+```text
+config
+    authority
+        name              Authority128
+
+        conductor-address  203.0.113.10
+
+        tenant  corp
+            name  corp
+        exit
+
+        service  Internet-Traffic
+            name           Internet-Traffic
+            scope          public
+            security       internal
+
+            access-policy  corp
+                source  corp
+            exit
+
+            address  0.0.0.0/0
+        exit
+
+        router  Conductor
+            name                 Conductor
+            inter-node-security  internal
+
+            node  node0
+                name  node0
+                role  conductor
+
+                device-interface  mgmt-dev
+                    name         mgmt-dev
+                    type         ethernet
+                    pci-address  0000:00:05.0
+                    forwarding   false
+
+                    network-interface  mgmt-intf
+                        name  mgmt-intf
+                        type  management
+
+                        address  10.0.1.10
+                            ip-address     10.0.1.10
+                            prefix-length  24
+                            gateway        10.0.1.1
+                        exit
+                    exit
+                exit
+            exit
+        exit
+
+        router  aws-branch1
+            name                 aws-branch1
+            inter-node-security  internal
+
+            node  node0
+                name  node0
+                role  combo
+
+                device-interface  wan-dev
+                    name               wan-dev
+                    type               ethernet
+                    pci-address        0000:00:06.0
+                    forwarding         true
+
+                    network-interface  wan1
+                        name                  wan1
+                        global-id             1
+                        type                  external
+                        conductor             true
+                        management            true
+                        default-route         true
+                        source-nat            true
+                        dhcp                  v4
+
+                        management-vector
+                            name      mgmt-vec-wan
+                            priority  100
+                        exit
+
+                        neighborhood          internet
+                            name                 internet
+                            topology             spoke
+                            external-nat-address 203.0.113.20
+                        exit
+                    exit
+                exit
+
+                device-interface  lan-dev
+                    name               lan-dev
+                    type               ethernet
+                    pci-address        0000:00:07.0
+                    forwarding         true
+
+                    network-interface  lan1
+                        name        lan1
+                        global-id   2
+                        type        external
+                        tenant      corp
+                        source-nat  true
+                        dhcp        disabled
+
+                        address  10.1.2.1
+                            ip-address     10.1.2.1
+                            prefix-length  24
+                        exit
+                    exit
+                exit
+            exit
+
+            service-route  internet-route
+                name          internet-route
+                service-name  Internet-Traffic
+
+                next-hop  node0 wan1
+                    node-name  node0
+                    interface  wan1
+                exit
+            exit
+
+            dns-config  static
+                address  1.1.1.1
+                address  8.8.8.8
+            exit
+        exit
+    exit
+exit
+```
+
+## Interface Summary
+
+| Interface | Device Interface | PCI Address | Type | Configuration |
+|-----------|-----------------|-------------|------|---------------|
+| `wan1` | `wan-dev` | `0000:00:06.0` | External | DHCP v4, conductor, management, default-route, source-nat, neighborhood `internet` with external-nat-address `203.0.113.20` |
+| `lan1` | `lan-dev` | `0000:00:07.0` | External | tenant `corp`, static `10.1.2.1/24`, source-nat |
+
+## Service Route Summary
+
+| Service Route | Service | Type | Next Hop |
+|--------------|---------|------|---------|
+| `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` |
+
+## Design Notes
+
+**AWS NAT and External NAT Address** — AWS performs 1:1 NAT between each Elastic IP and the private IP assigned to the corresponding ENI. The `external-nat-address` setting in the `internet` neighborhood tells the SSR to advertise the Elastic IP (`203.0.113.20`) to peers rather than the private DHCP address. Without this, SVR peer connections cannot be established because the private IP is not routable from outside the VPC.
+
+**Management over Forwarding** — The `wan1` interface carries both internet traffic and conductor management sessions simultaneously. Management traffic originating from the host OS at `169.254.x.x` link-local addresses is source-NAT'd to the WAN DHCP address before leaving the interface. The `default-route: true` setting ensures Linux routes all outbound OS traffic through the SSR forwarding engine so the auto-generated `management-conductor` service route applies.
+
+**Management Interface (eth0)** — The first ENI (`eth0` / `ge-0-0`) is not configured in SSR. Linux manages it for out-of-band SSH access. This is the recommended pattern for AWS deployments, as it preserves SSH reachability when the SSR service is offline for maintenance or upgrades.
+
+**Source / Destination Check** — The WAN and LAN ENIs on the router EC2 instance must have source/destination checking disabled. This is an AWS-specific requirement that allows the SSR to forward packets where it is not the source or destination.

docs/deploy_aws_conductor.mdx

@@ -0,0 +1,70 @@
+---
+title: AWS Conductor Deployment Guide
+sidebar_label: Overview
+---
+import NetworkDesign from './_deploy_aws_conductor_network_design.md';
+
+This guide walks a network engineer through deploying a **BYOL Session Smart Conductor on AWS EC2** and connecting it to a managed SSR router. When you have completed the steps in this guide, the conductor EC2 instance will be running SSR 7.1.4, configured with an authority name, conductor address, and the shared services needed to bring a branch router online with internet breakout over the router's WAN forwarding interface.
+
+## Guide Topics
+
+| Step | Topic | Description |
+|------|-------|-------------|
+| 1 | [Launch the Conductor EC2 Instance](deploy_aws_conductor_instance.mdx) | Create the AWS EC2 instance that will host the conductor |
+| 2 | [Install SSR 7.1.4 and Initialize the Conductor](deploy_aws_conductor_install.mdx) | Wait for BYOL installation and verify access to the conductor GUI |
+| 3 | [Configure the Conductor](deploy_aws_conductor_config.mdx) | Set the authority name, conductor address, tenant, and internet service |
+| 4 | [Launch the Router EC2 Instance](deploy_aws_router_instance.mdx) | Create the AWS EC2 instance for the managed router |
+| 5 | [Configure the Router on the Conductor](deploy_aws_router_config.mdx) | Define router interfaces, management over forwarding, and internet service route |
+| — | [Appendix — AWS Configuration](deploy_appendix_aws_conductor.mdx) | Complete PCLI configuration reference for conductor and router |
+
+## Network Topology
+
+```mermaid
+graph TD
+    Internet((Internet))
+    subgraph AWS["Amazon Web Services"]
+        subgraph CondVPC["Conductor VPC — 10.0.0.0/16"]
+            ConductorEC2["SSR Conductor\n(Conductor)\nPrivate: 10.0.1.10\nElastic IP: 203.0.113.10\nc5.xlarge · SSR 7.1.4"]
+        end
+        subgraph RouterVPC["Router VPC — 10.1.0.0/16"]
+            RouterEC2["SSR Router\n(aws-branch1)\nWAN: DHCP / 203.0.113.20\nLAN: 10.1.2.1/24\nc5.xlarge · SSR 7.1.4"]
+        end
+    end
+    LAN["LAN Devices\n10.1.2.0/24\nTenant: corp"]
+
+    Internet <-->|"HTTPS / GUI"| ConductorEC2
+    RouterEC2 <-->|"Internet Breakout\n(Internet-Traffic)"| Internet
+    RouterEC2 <-->|"Management over Forwarding\nPorts 930 / 4505 / 4506"| ConductorEC2
+    LAN <-->|"LAN"| RouterEC2
+```
+
+## Roles
+
+| Device | Type | Role |
+|--------|------|------|
+| `Conductor` | AWS EC2 (`c5.xlarge`) | Standalone SSR Conductor — centralized management and provisioning |
+| `aws-branch1` | AWS EC2 (`c5.xlarge`) | Conductor-managed SSR router with internet breakout |
+
+## Network Design Reference
+
+<NetworkDesign/>
+
+## Prerequisites
+
+Before beginning, ensure the following are available:
+
+- **AWS account** with permissions to launch EC2 instances, create VPCs and subnets, allocate Elastic IPs, and deploy CloudFormation stacks.
+- **Juniper BYOL subscription** — access to the [Session Smart Networking Platform BYOL](https://aws.amazon.com/marketplace/pp/prodview-lz6cjd43qgw3c) offering in the AWS Marketplace. Accept the terms and conditions before deploying.
+- **Artifactory credentials** — username and token for the Juniper software repository. These are required for BYOL software installation.
+
+  :::note
+  Contact your Juniper account team if you do not have Artifactory credentials.
+  :::
+
+- **IAM key pair** — an existing EC2 key pair in the target region for SSH access to both instances.
+- **Networking** — a VPC and subnet for the conductor, and a separate VPC (or the same VPC with additional subnets) with at least two subnets for the router (WAN and LAN). The conductor subnet must be reachable from the router's WAN subnet on ports 930, 4505, and 4506.
+- **Two Elastic IPs** allocated in your target region: one for the conductor and one for the router WAN interface.
+
+:::note
+BYOL instances require the conductor to run SSR 6.3.0-R1 or later. This guide targets SSR 7.1.4, which meets that requirement.
+:::

docs/deploy_aws_conductor_config.mdx

@@ -0,0 +1,83 @@
+---
+title: "Step 3: Configure the Conductor"
+sidebar_label: "Configure the Conductor"
+---
+import NetworkDesign from './_deploy_aws_conductor_network_design.md';
+import AuthorityName from './_set_authority_name.md';
+import ConductorAuthority from './_conductor_to_authority.md';
+
+This step configures the authority-level settings on the conductor: the authority name, conductor address, corporate tenant, and internet service. These objects are shared across all routers managed by this conductor.
+
+All steps are performed from the **Conductor GUI** at `https://203.0.113.10` unless otherwise noted.
+
+## 1. Assign the Conductor's Asset ID
+
+<ConductorAuthority/>
+
+## 2. Set the Authority Name
+
+<AuthorityName/>
+
+:::note
+Use your organization's name as the authority name (for example, `Authority128`). The authority name cannot be changed after routers have been provisioned without re-onboarding them.
+:::
+
+## 3. Set the Conductor Address
+
+The conductor address is the IP address that managed routers use to reach this conductor. For an AWS deployment, this must be the **Elastic IP** assigned to the conductor's control ENI — not the private IP — because routers connecting from outside the conductor VPC reach the conductor through the internet.
+
+1. From the **Authority Settings** page, scroll to **Conductor Addresses** and select **ADD**.
+2. In the **New Conductor Address** window, enter `203.0.113.10`.
+3. Click **SAVE**.
+4. Select **VALIDATE** then **COMMIT**.
+
+:::important
+You must use the Elastic IP (`203.0.113.10`) as the conductor address, not the private IP (`10.0.1.10`). Routers outside the conductor VPC connect to the conductor over the internet using the Elastic IP.
+:::
+
+## 4. Create the Corporate Tenant
+
+Tenants logically partition the network. The `corp` tenant represents corporate LAN users and is referenced by the LAN interface configuration on each managed router.
+
+1. In the Conductor GUI, select **Configuration**.
+2. Select **Authority**.
+3. Scroll to **Tenants** and select **ADD**.
+4. Enter the name `corp` and select **SAVE**.
+5. Select **VALIDATE** then **COMMIT**.
+
+:::info
+Tenants are authority-wide. A single `corp` tenant definition applies to all routers that assign it to a LAN interface.
+:::
+
+## 5. Create the `Internet-Traffic` Service
+
+The service configuration element defines the IP destinations that the SSR routes. This step creates a service representing all internet-bound traffic from corporate LAN users.
+
+1. In the Conductor GUI, select **Configuration**.
+2. Select **Authority** from the left panel.
+3. Scroll down to **Services** and select **ADD**.
+4. Enter the name `Internet-Traffic` and select **SAVE**.
+5. On the Service screen, verify **Enabled** is set to `true`.
+6. Scroll down to **Service Addresses** and select **ADD**.
+7. Enter `0.0.0.0/0` and select **SAVE**.
+8. Scroll down to **Access Policy** and select **ADD**.
+   - Set **Source** to `corp`.
+   - Select **SAVE**.
+9. Select **VALIDATE** then **COMMIT**.
+
+## What Was Configured
+
+At the end of this step, your authority contains:
+
+| Object | Name | Value |
+|--------|------|-------|
+| Authority | `Authority128` | |
+| Conductor Address | | `203.0.113.10` (Elastic IP) |
+| Tenant | `corp` | LAN-side user population |
+| Service | `Internet-Traffic` | `0.0.0.0/0`, access from `corp` |
+
+The conductor is now ready to accept router onboarding.
+
+## Next Step
+
+Proceed to [Step 4 — Launch the Router EC2 Instance](deploy_aws_router_instance.mdx).