Field Notes: Requirements for Successfully Installing CloudEndure Migration and CloudEndure Disaster Recovery
AWS Architecture BlogField Notes: Requirements for Successfully Installing CloudEndure Migration and CloudEndure Disaster Recoveryby Daniel Covey | on10 SEP 2020| inArchitecture,CloudEndure Disaster Recovery,CloudEndure Migration,Technical How-to|Permalink|ShareCustomers have been usingCloudEndure MigrationandCloudEndure Disaster Recoveryto meet business needs for many years. In 2019, CloudEndure was acquired by AWS, and provided the licensing for CloudEndure to all of their users free of charge for migration. During this time, AWS has identified the requirements for replication to complete successfully after initial agent install. Customers can use the following tips to facilitate a smooth transition to AWS.In this blog, we look at four sections of the CloudEndure configuration process required for a successful installation:CloudEndure Port configurationCloudEndure JSON Policy OptionsCloudEndure Staging Area ConfigurationCloudEndure Configuration for ProxiesRequired CloudEndure PortsThere are 2 required ports that CloudEndure uses. TCP Ports 1500 and 443 have particular configurations based on source or staging area. TCP 1500 is used for replication of data, and 443 is for agent communication with theCloudEndure Console.Architecture OverviewThe following graphic is a high level overview of the required ports for CloudEndure, both from the source infrastructure, and the staging subnet you will be replicating to.StepsIs 443 outbound open to console.cloudendure.com on the source infrastructure?Check OS level firewallCheck proxy settingsEnsure there is no SSL intercept or Deep Packet Inspection being done to packets from that machine2. Is 443 outbound open to console.cloudendure.com in the AWS Security Group assigned to the replication subnet?Check no NACLs are in place to prevent SSL traffic outbound from the subnetCheck the machines on this subnet can reach the EC2 endpoint for the region.If you have any restrictions on accessing Amazon S3 buckets, you can have CloudEndure use a CloudFront distribution instead.Review The CloudEndure documentation for how to do this3. Is 1500 outbound open to the Staging Subnet from the source infrastructure?Check OS level firewallCheck proxy settings4. Is 1500 inbound from the source infrastructure open on the Security Group assigned to the replication subnet?Check no NACLs are in place preventing traffic.CloudEndure JSON PoliciesCloudEndure uses one of theseJSON policiesattached to IAM Users. These policies give CloudEndure specific access to your AWS account resources. This launches specific resources needed to ensure the tool is working properly. CloudEndure JSON policies use tag filtering to limit the creation and deletion of resources.For the JSON policy, CloudEndure expects a specific set of permissions, even in the case where we may not be using them. CloudEndure does a policy check first, to ensure all permissions are available. It is not recommended to change the JSON policies, as it can cause CloudEndure to fail initial replication configuration. Use one of the following three policies.AWS to AWSBest policy to use if you are doing Inter-AWS replication, such as Region-to-Region, or AZ-to-AZ replicationDefaultDefault JSON policy. Allows for access to any of the resources needed by CloudEndureTagging basedA more restrictive policy, for customers that need a more secure solution.Staging Area ConfigurationCloudEndure replicates to a “Staging Area”, where you control the Replication Server and the AWS EBS volumes attached to that server. You define which VPC and Subnet you want CloudEndure to replicate to, with the following considerations.Default SubnetYou designate your specific AWS Subnet to use for replication here. Leaving the option as “Default” uses the default subnet for the VPC, which is usually deleted by customers when first configuring their VPCs.2. Default Security groupThis is often created by the Cloudendure tool, cannot be changed, and will be added if replication disconnects. Any changes made to this SG will be reverted back to default rules.If utilizing a proxy, it is advised to add a Security Group that also allows access to the proxyProxy ServersSome customers utilize Proxy servers within their environment. Review the following guidance regarding specific changes to configurations within your environment needed for CloudEndure to operate effectively.Make sure to set proxy in replication settingsThis can be either IP address, or an FQDN2. Note the following for either Windows or LinuxWindows – CloudEndure agent runs as System, so please ensure the System account is part of the allow list in the proxy.Linux – CloudEndure Agent creates a linux user to run commands (named cloudendure), so this user will need to be part of the allow list in the proxy3. Make sure environment variables are set for the machinesWindows StepsControl Panel > System and Security > System > Advanced system settings.In the Advanced Tab of the System Properties dialog box, selectEnvironment VariablesOn theSystem Variablessection of theEnvironment Variablespane, selectNewto add the https_proxy environment variable orEditif the variable already exists.Enterhttps://PROXY_ADDR:PROXY_PORT/in the Variable value field. SelectOK.If the agent was already installed, restart the serviceAlternatively, you can open CMD as Administrator and enter the following command:setx https_proxy https://<proxy ip>:<proxy port>/ /mLinux StepsComplete one of the following lines in the terminal$ export http_proxy=http://server-ip:port/$ export http_proxy=http://127.0.0.1:3128/$ export http_proxy=http://proxy-server.mycorp.com:3128/ Please note to include the trailing /Cleaning UpAfter you have finished utilizing the CloudEndure tool, remove any resources you may no longer need.ConclusionIn conclusion, I have showed how best to prepare your environment for installation of the CloudEndure tool. CloudEndure is utilized to protect your business, and mitigate downtime during your move to the cloud. By following the preceding steps, you set up the configuration for success. Visit the AWS landing pages forCloudEndure MigrationandCloudEndure Disaster Recoveryto get a deeper understanding of the tool, get started with CloudEndure, or take the free onlinetechnical migrationortechnical disaster recoverytraining. Should you need assistance with other configurations, visit theCloudEndure Documentation Library, which includes every aspect of the tooling, as well as a helpfulFAQ.Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:CloudEndure,Disaster recovery,Field NotesDaniel CoveyDaniel Covey is a Solutions Architect with AWS who has spent the last 8 years helping customers protect their workloads during a Disaster. He has worked with CloudEndure before and after the acquisition by AWS, and continues to offer guidance to customers who want to ensure their data is safe from ransomware and disasters.
Customers have been using CloudEndure Migration and CloudEndure Disaster Recovery to meet business needs for many years. In 2019, CloudEndure was acquired by AWS, and provided the licensing for CloudEndure to all of their users free of charge for migration. During this time, AWS has identified the requirements for replication to complete successfully after initial […]
Daniel Covey
Architecture CloudEndure Disaster Recovery CloudEndure Migration Technical How-to