Install an Access Tier using Debian Packages with SonicWall CSE

1.1 Log into the Command Center, and navigate from Networks > Access Tiers.

1.2 Select + Create Access Tier, and configure the required parameters when going through the installation wizard. An existing API key is required; these should appear in the dropdown menu of the API Key field on the Configure tab. If you don’t have an existing API key, navigate from Settings > API Keys and select + Add API Key, then select the access_tier scope.

1.3 If you will be using this Access Tier to secure an existing Service Tunnel, enter the required information to set up Service Tunnels.

1.4 Optional: If you want to enable Private Resource Discovery (to view a summary of commonly accessed private resources accessed by end users via Service Tunnels), then, under Advanced Settings, toggle on Enable Private Resource Discovery.

1.5 Select Continue to proceed to the Install tab.

1.6 Take note of the installation parameters for use in subsequent sections.

Network Reachability

1. The Access Tier server(s) should be located in your internet-facing DMZ and have a public IP address, so that it can be reached from anywhere on the internet.

2. Configure a public wildcard DNS record that follows your corporate domain name convention to map to the Access Tier’s public IP address
   • A common pattern is to use *.corp.example.com. Then, corporate services can be exposed to your users as website1.corp.example.com, sshserver2.corp.example.com, etc.
   • If you’re deploying multiple Access Tiers across multiple locations, you can further scope the subdomains into *.east.corp.example.com, *.west.corp.example.com, etc.
3. Expose the following ports to the internet so the Access Tier can accept inbound connections from the internet:

4. Ensure the Access Tier can make outbound connections to following addresses:

The netagent binary supports HTTPS proxy settings. If an Egress proxy is configured on the host via the HTTPS_PROXY environment variable, outbound connections from the Access Tier will automatically use it.

5. Ensure your networking policies allow traffic to flow from the Access Tier server to backend machines running the applications and services you need to secure access to.

Supported Operating Systems

The netagent binary, which is the core component of a Access Tier, can be installed on virtual or physical 64-bit Linux servers on most Linux distributions.

Officially Supported: the following distros are officially supported:

• Ubuntu 20.04, 22.04

Support Deprecated: the following Linux distros are no longer supported:

• CentOS 6.x, RHEL 7.x
• Ubuntu 12.04, 14.04, 16.04, 18.04
• Amazon-Linux-2
• CentOS 7.x and RHEL 8.x

Download

Ensure you have assumed root privileges:

user@host$ sudo su -
root@host#

Create a folder for DEB:

mkdir -p /opt/banyan-packages
cd /opt/banyan-packages

On Debian/Ubuntu hosts, grab the DEB package:

# add the Banyan DEB repo
curl https://www.banyanops.com/onramp/deb-repo/banyan.key | apt-key add -
apt-add-repository "deb [arch=amd64] https://www.banyanops.com/onramp/deb-repo xenial main"

# install it
apt install banyan-netagent2=2.10.2

Then, cd into /opt/banyan-packages directory, extract the Tarball installer that has been placed there, and cd into the directory:

cd /opt/banyan-packages

tar zxf netagent-2.10.2.tar.gz
cd netagent-2.10.2

Configure

Before you start the netagent binary you need to enter its registration parameters - obtained in Step 1 - in the config.yaml file.

# edit the `config.yaml` file to specify Access Tier registration parameters
#  command_center_url          # Command Center URL, such as https://net.banyanops.com
#  api_key_secret              # API key generated via the Command Center ("access_tier" or "Admin" scope)
#  access_tier_name            # Name of an existing Access Tier in the Command Center
#  access_tier_public_address  # (optional) public address for this Access Tier, such as "corp-dns-cname.example.com"
#  https_proxy                 # (optional) specify to configure HTTPS_PROXY environment variable

vi config.yaml

Install

# double check the configuration params
cat config.yaml

# run the setup script so netagent can be managed using systemctl
./setup-netagent.sh

# manage using systemctl  
sudo systemctl [start|stop|status] netagent

Once the Access Tier is installed, you can check its logs on the host at /var/log/banyan/netagent.log to ensure it is functioning as expected.

Under Networks > Access Tiers > [Your Access Tier] section of the Command Center, select the Test Connection button to verify that your Access Tier is correctly installed.

Access Tier - Test Connection

Upgrading Netagent follows a very similar process to installing it.

Step 1: Use upgrade to download the latest Tarball.

For DEB packages, use apt-get upgrade banyan-netagent2.

Step 2: Extract the package

Running upgrade will download the latest tarball file into /opt/banyan-packages. cd into /opt/banyan-packages directory. Extract the Tarball installer that has been placed there, and cd into the directory:

cd /opt/banyan-packages

tar zxf netagent-2.10.2.tar.gz
cd netagent-2.10.2

Step 3: Run the setup script

./setup-netagent.sh

The setup script will ask the user whether they wish to overwrite /opt/banyan/config.yaml with the installer’s config.yaml. Enter no to proceed.