Deploy

Introduction

So you've downloaded the latest version of the Opmantek FirstWave Virtual Appliance from Machine from https://opmantekfirstwave.com/networksoftware-tools-downloaddownloads/ and and now you want to set it up and take it for a test drive to see how NMIS and the Opmantek FirstWave networking modules can help you administer your network.  No problem.  Easy.

...

1. Import the OVA (Open Virtual Appliance Machine Format) or OVF file into VMware, Virtualbox,...your chosen choice of hypervisor.
2. Start up the new VM, you can also optionally set a static IP address.
3. Access NMIS and the other Opmantek FirstWave applications in your browser via the machines IP address.

Using the

...

OVA

...

All Opmantek FirstWave Virtual Appliance Machine releases since January 2018 are published as a single "ova" file (Open Virtual ApplianceMachine), which encapsulates all necessary data in a single archive.

The import instructions below can be used to deploy the Opmantek FirstWave Virtual Appliance Machine straight from that one downloaded file.

Releases before Jan 2018 consist of a ZIP archive that bundles an "ovf" (Open Virtualization Format) file and disk images. This ZIP archive needs to be unpacked before your virtualization platform will recognize the appliance.

After unzipping the file you should see a folder with a structure like this:

Image Removed

Because the OVF file type is in an open format it should be recognized by your virtualization software or by a conversion tool provided by your virtualization software.  

How to import the Virtual Appliance into your virtualization infrastructure

VMware ESXi using the Opmantek OVA file

There are several options for VMware software.  Options 2 & 3 require the VMware OVF Tool, find the tool by doing a search on google or by visiting VMware's site, the other requires VMware Fusion (for Mac).  Options 2 & 3 assume you have it installed and know where it is.

1. Importing the OVA file to ESXi

You can import the OVA file directly into ESXi using ovftool, from the PC or server you run ovftool, run the command like this:

ovftool --name="NMIS" -dm="thin" -ds=datastore_name-number nmis-8.6.7G-VM-CentOS-6.10-64bit.ova vi://user:password@host_ip_address

Remember to set the Virtual Machine name you like, the datastore you want, and point it at the server you want to deploy to.

2. Upgrade the Virtual machine hardware version (optional)

The Opmantek Virtual Appliance ships with the virtual machine hardware version set very low for maximum compatibility, but you may want to upgrade the hardware version to a higher level (to leverage performance benefits, remove memory limitations, etc.) as described on the VMware website.

VMware ESXi using the older Opmantek ZIP file with OVF inside

1. Importing the OVF to ESXi

If you are using the older Opmantek ZIP VM you will have an OVF file.

ovftool --name="NMIS" -dm="thin" -ds=datastore_name-number ./NMIS8-OVF/NMIS8.ovf vi://user:password@host_ip_address

Remember to set the Virtual Machine name you like, the datastore you want, and point it at the server you want to deploy to.

2. VMware Fusion

Recent versions of VMware Fusion allow importing .ovf files directly from the application.  If this option does not exist or work you will need to use option # 3.  

To import: Select File->Import, then "Choose File", find NMIS8-OVF/NMIS8.ovf as the file to import, then select continue.  Fusion will import the file and then present you with the VM's default configuration.

Image Removed 2.Image Removed 3.Image Removed 4.Image Removed

3. Convert OVF to VMX

This option is for non-Fusion (or older) VMware products that do not support the OVF format directly; in this case you have to convert the appliance into VMware's native format VMX. As mentioned above this conversion requires the VMware ovftool.

mkdir NMIS8
ovftool NMIS8-OVF/NMIS8.ovf NMIS8/NMIS8.vmx 

You should now be able to import/load the vmx file with your VMware software and skip to step 3.

4. Upgrade the Virtual machine hardware version (optional)

The Opmantek Virtual Appliance ships with the virtual machine hardware version set very low for maximum compatibility, but you may want to upgrade the hardware version to a higher level (to leverage performance benefits, remove memory limitations, etc.) as described on the VMware website.

VirtualBox

VirtualBox will import directly from an OVF/OVA file so you can just start up VirtualBox and select "Import Appliance..."

Image Removed

Browse to where you unzipped the file and select the ovf file

Image Removed

Select the file, you should see a screen something like this:

Image Removed

It should be safe to Import.  The import process may take a couple of minutes to complete, just enough time to grab a cup of coffee I'd say.

If you have any trouble the VirtualBox documentation is here: https://www.virtualbox.org/manual/ch01.html#ovf

Below is an example of how to enable Host I/O Cache using VirtualBox:

Image Removed

CentOS 7 on VirtualBox

It's highly likely that VirtualBox users will find themselves at the dracut emergency shell prompt when first booting our vm that runs CentOS 7. 

Image Removed

When faced with this obstacle reboot the vm selecting the rescue kernel. 

Image Removed

After it boots login as normal and try the try the following dacut command.  

dracut -f /boot/<kernel_image> <kernel_name>

Image Removed

 If the command completes successfully reboot the vm normally.  Be aware that future kernel updates may require this maneuver be done again.

Other Hypervisors

To use OVF/OVA files with other virtualisation systems like KVM you may have to convert the OVF file to a native format; Two well-known tools for this purpose are virt-v2v (available in CentOS6/RHEL) and virt-convert (in Debian).

Hyper-V

The Windows Hyper-V technology does not fully support the OVF industry standard. Microsoft documents a complex and somewhat limited procedure on their page about converting OVF files to Hyper-V. There are third-party conversion tools available that simplify this deployment scenario, for example StarWind's free V2V Converter  which worked well in our tests.

Start up the VM and set a custom IP Address, DNS... (optional)

At this point the VM has DHCP enabled, and therefore it will receive a dynamic IP address suitable for your environment. The easiest way to access the VM at that point is from the virtualization software terminal. So go ahead and boot the VM. After the VM is finished booting you will be welcomed by a login prompt. First, log in using the default credentials.

If it's desirable to customize the network settings we offer the following options:

...

Root's home directory contains 2 example network configurations, one for static IP's and one for DHCP.  Copy the one you require to /etc/sysconfig/network-scripts/ and edit it to suit:

cp ifcfg-ens192.static /etc/sysconfig/network-scripts/<interface_name>

Be sure to verify the following settings:

• IPADDR
• NETMASK
• BROADCAST
• GATEWAY
• NAME; the interface name as found with the ip address command
• DEVICE; the interface name as found with the ip address command
• DNS;

Next restart the network service for the setting to take affect.  In our testing the DHCP address was still present, and the static IP assigned as a secondary (this can be seen with the 'ip address' command).  The DHCP address can be removed by using the 'ip address command del' command or be rebooting the system.

TYPE=Ethernet
IPADDR=192.168.10.201
NETMASK=255.255.255.0
BROADCAST=192.168.10.255
GATEWAY=192.168.10.51
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp0s3
UUID=9099afe7-6dd6-4aec-bd93-8950b67ab8f5
DEVICE=enp0s3
ONBOOT=yes
DNS1=192.168.10.80
DNS2=8.8.8.8

Set Up Firewall (optional)

Please note that by default the Opmantek VM Appliance does NOT have a firewall active. If you would like local firewalling on your VM, you can easily enable that:

The standard iptables tools are installed, and all you would have to do, is enter your desired rules in /etc/sysconfig/iptables, followed by service iptables restart AND a final one-off run of chkconfig iptables on.  The service call enables your firewall rules, while the chkconfig call enables activation of the firewall rules on boot. Until and unless the chkconfig step is taken, your firewall rules won't persist when the VM is rebooted. Besides this, somewhat low-level, method of configuring an iptables firewall there are also various user-friendly frontends available for installation with yum.

Troubleshooting Network Problems

The most common problem is with how CentOS 6 handles interface discovery, it wants to hang onto MAC addresses which of course in a virtual environment you want managed by the Hypervisor.

Run the command "ifconfig -a", the result should look like this:

[root@nmis64 ~]# ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:0C:29:E8:CF:F9 
    inet addr:192.168.1.42 Bcast:192.168.1.255 Mask:255.255.255.0
    inet6 addr: 2001:470:1f05:5a0:20c:29ff:fee8:cff9/64 Scope:Global
    inet6 addr: fe80::20c:29ff:fee8:cff9/64 Scope:Link
    UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
    RX packets:6640287 errors:0 dropped:0 overruns:0 frame:0
    TX packets:4282058 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:1000 
    RX bytes:974072080 (928.9 MiB) TX bytes:606513312 (578.4 MiB)
lo Link encap:Local Loopback 
    inet addr:127.0.0.1 Mask:255.0.0.0
    inet6 addr: ::1/128 Scope:Host 
    UP LOOPBACK RUNNING MTU:16436 Metric:1
    RX packets:2337305 errors:0 dropped:0 overruns:0 frame:0
    TX packets:2337305 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:0 
    RX bytes:371309377 (354.1 MiB) TX bytes:371309377 (354.1 MiB)

If you do not see an interface called eth0 then run this command and reboot your VM.

rm -f /etc/udev/rules.d/70-persistent-net.rules
reboot

Accessing the Application Modules on the VM

...

Image Removed

...

All the module names are clickable and link to the respective applications; but you can also navigate directly to NMIS, Open-AudIT or any of the other Opmantek applications.

Simply open your favourite web browser and navigate to:

• http://<vm ip address>/nmis8 for NMIS,
• http://<vm ip address>/open-audit for Open-AudIT Community,
• or http://<vm ip address>/omk for the list of all Opmantek applications.

The default access credentials are username "nmis", password "nm1888" (more info regarding credentials can be found on this page).

Example NMIS log in page:

Image Removed

Once you've got either the NMIS dashboard or one of the Opmantek application dashboards open, you can also navigate between modules using the "Modules" and "NMIS Modules" menus, respectively.

Once you have Access you will likely want to start configuring NMIS and the nodes you want to manage. Continue below to the NMIS Setup and Configuration quick start guide to learn how.

NMIS Setup and Configuration 

NMIS8 - A Quick Getting Started Guide

Secure Access with https

The VM ships with support for secure https access enabled, and you can use https instead of http in any of the URLs mentioned above.

However, the included certificate-key pair is the same for all VM downloads, and it is a self-signed certificate (for "opmantek.local"): this will cause your browser to display security warnings.

If you want to use https access operationally it is highly recommended that you replace this shared default key-certificate pair with your own (or use an automated certification authority like https://letsencrypt.org/ for example).

Application Module Licensing

The first step to using a module is knowing how to open it, the next is to get a license for it. This process is simple and painless: all products on the appliance (except opFlow) now support free licenses (which are not time-limited but limited to 20 nodes). For these applications the initial dialog offers the generation of such a free license; for opFlow the licensing dialog offers guidance for obtaining a trial or a full license. Example screen shot of activating free Open-AudIT trial below:

Image Removed

You can also use the "opLicensing" module (reachable at http://<vm ip address>/omk/opLicense or from the Modules menu) to manage your licenses comfortably (including the ability to download previously purchased licenses from the Opmantek website). More info about opLicensing can be found here.

Exploring and Configuring Application Modules

All modules on the Virtual Appliance come with their configuration set to very minimal but safe defaults; to explore the full functionality available you will very likely have to make config modifications to suit your environment. These configuration options are all documented on this site, the Opmantek Community Wiki, in the per-application section (or "Application Space"); certain common, shared aspects are discussed in the "opCommon" space.

For all recent Opmantek applications you'll find links to the respective sections of Wiki in the "Help" menu (usually under "Online Documentation"); there's also an online version check on the welcome/landing page, and on each application's "About" page which helps with keeping your modules up to date.

...

Supported Hypervisors

Configure

Out of the box there is nothing to do - just start the virtual machine and connect to the application URL (the machines IP address), done!

If you would like to configure the virtual machine to use static IP address or set the hostname or set the security to your liking, see here - Getting Started, Configuring the Virtual Machine. 

By default the virtual machine will get it's IP address from DHCP.

Run

Start the virtual machine and simply use a browser to connect to the IP address of your virtual machine.

From here either click the "Simple Configuration Wizard" icon or check out a particular Module by clicking it's icon.  For more on configuring application settings, see here - Getting Started, Configuring the Applications

Our individual applications are covered in great detail in their own wiki spaces (see below).