On This Page
Prepare a Node on VMware ESXi
Overview
This procedure is for preparing a VM on VMware ESXi before adding it as a node to an existing TOS Aurora cluster.
For all other installation procedures, such as installing TOS Aurora and adding nodes on other platforms, see the menu for the appropriate procedure.
If you are preparing a data node, start with high availability.
If you are preparing a worker node, start with multi-node cluster.
Read and understand Prerequisites, then proceed with Install and Set Up TufinOS.
Prerequisites
General Requirements
- You cannot use IP Tables. All IP tables rules will be flushed when adding the node.
-
Your servers must have sufficient CPUs, disk storage and main memory for TOS Aurora to work effectively. Consult with your sales engineer or Tufin support to ensure your resources or sufficient.
VMware Requirements
- Your ESX host must be running VMware ESXi 6.5, 6.7, 7.0 or 8.0 only. ESXi 8.0 requires TufinOS 4.20 or later
-
Your ESX host disk(s) must be SSD with 7,500 IOPS and 250MB/s throughput, or higher.
Network Requirements
- You must allow access to required Ports and Services.
- If you intend to use syslog, allocate a syslog VIP on the same subnet as your primary VIP.
-
The node's network IP must be on the same subnet as the cluster primary VIP.
-
Make sure your first physical interface is correctly configured and all other interfaces are not on the same network.
To find the first network interface, run the following command:
[<ADMIN> ~]$ sudo /opt/tufinos/scripts/network_interface_by_pci_order.sh | awk -F'=' '/NET_IFS\[0\]/ { print $NF }'
sudo /opt/tufinos/scripts/network_interface_by_pci_order.sh | awk -F'=' '/NET_IFS\[0\]/ { print $NF }'Otherwise network errors such as connectivity failures and incorrect traffic routing might occur.
-
Download the TufinOS 4.30 installation package from the Download Center.
-
Download the TOS R23-1 PHF2.1.0 installation package from the Download Center.
-
Extract the TufinOS image from its archive.
The run file name includes the release, version, build number, and type of installation.
TufinOS ISO file example:
TufinOS-4.30-4368238-x86_64-Final.iso
TufinOS USB file example:
TufinOS-4.30-4368238-x86_64-Final.usb.img
-
Verify the integrity of the TufinOS installation package.
[<ADMIN> ~]# sha256sum -c TufinOS-X.XX-XXXXXX-x86_64-Final.iso.sha256
sha256sum -c TufinOS-X.XX-XXXXXX-x86_64-Final.iso.sha256[<ADMIN> ~]# sha256sum -c TufinOS-X.XX-XXXXXX-x86_64-Final.usb.img.sha256
sha256sum -c TufinOS-X.XX-XXXXXX-x86_64-Final.usb.img.sha256The output should return OK
Make sure the TufinOS release you are going to install, supports your target TOS Aurora release - see TufinOS 4 Supported Upgrade Paths.
The downloaded files are in .tgz format <FILENAME>.tgz.
Install and Set Up TufinOS
Before you proceed, read and understand Prerequisites - this may prevent unexpected failures.
- Extract the ISO image from file downloaded previously.
- Place the image file in a location on the VM that you can access from the VMware client (Workstation or vSphere).
- Shut down the VM.
-
Go to the VM settings and delete the current hard disk.
-
Create a new hard disk that meets your sizing requirements .
- Edit the properties of the virtual CD/DVD drive, and do one of the following:
Using vSphere:
- Select device type Datastore ISO file, and browse to the TufinOS ISO image.
- Under Device Status, select Connect at power on.
Using a workstation:
- Under Device Status, select Connect at power on.
- Under Connection, select Use ISO image file, and browse to the TufinOS ISO image.
- Save the settings.
- Power on the virtual machine. TufinOS installation begins.
- In the virtual machine console, follow the installation prompts. When prompted to enter about the console connection type, type one of the following:
-
kvm-aurora - for production deployments
-
kvm-aurora-light - for test/development/POV deployments
- When the installation is complete, the virtual machine will reboot.
- TufinOS 3.100 and later. Optional. Create a password for the root user.
Login as the tufin-admin user.
Run the following command:
sudo passwd root
sudo passwd rootEnter the password and then retype it.
-
Change the host name to a unique name in the cluster. Replace <mynode> with your preferred name.
- Synchronize the time with the primary data node. This can be achieved by all servers being synchronized via ntpd or chrony