NetFoundry for connecting a Branch location to cloud (Public / Private)

NetFoundry Platform Architecture

Introduction

Branch offices might want to connect to centralized data centers or public clouds over a secure & private network.

Branch offices users, as a part of business operations, may have to

  1. Connect to applications/ resources hosted in the public/private cloud.
  2. Access PaaS, SaaS, IaaS service offered by public clouds.

This article will guide you on steps to establish a Zero Trust Private connection between branch office locations and Public/ Private/ Hybrid Datacenters with NetFoundry Zero Trust Network as a Service.

mceclip0.png

In our lab set-up, the applications are hosted at Azure Pune and the Branch location, which is considered to be in AWS Singapore. The hosted edge routers are provisioned at AWS Singapore & Azure India.

Create a network

  • Log in to your NetFoundry console at https://nfconsole.io/.
  • Within your NetFoundry Organization click the “+” sign in the left navigation panel.

  • This will bring up a dialogue box asking what you would like to Add.  Choose “Add a New Network

  • Give your network a name.

  • Hit Create My Network to commence the provisioning of your network.

  • It will take approximately 5-10 minutes for the network provisioning to complete. Once your network is ready, you will see the spinning globe icon turning green.

  • NetFoundry automation creates and deploys the Network Controller and other monitoring/reporting elements necessary to manage this Network as a Service.

mceclip0.png

mceclip3.png

mceclip4.png

mceclip5.png

For additional information or assistance please see our Support Hub article Product v7-Create and Manage Networks.

Create edge routers

mceclip9.png

Edge Router Connectivity Diagram

Provision a NetFoundry-hosted Edge Router

NetFoundry hosted Edge Routers provide data transport as part of the fabric for endpoints and customer edge routers to dial to the fabric.  At least one publicly accessible Edge Router is required for endpoints and edge routers to create a fabric. Having a minimum of two hosted ERs is a best practice for redundancy and smart routing. 

  • From your Network Dashboard page, navigate to Edge Routers.
  • Under the Edge Routers tab, click on the + sign at the upper right to add an edge router.
  • Give your edge router a name.
  • Give your edge router a router attribute (optional). Router attributes are tags applied to a router. The same tag can be applied to other edge routers to form a group of NetFoundry-hosted Edge Routers.
  • Select NetFoundry Hosted as your hosting type, and choose the Data Center region strategic to Cloud Resources.
  • Hit Create to commence the provisioning of your edge router.
  • Once your edge router is registered, it will start accepting outbound fabric connections from a private-launched edge router, as well as from clients accessing the fabric.

mceclip9.png

mceclip10.png

mceclip14.png

mceclip0.png

mceclip0.png

To learn more about Edge Routers go to the Create and Manage Edge Routers article on the NetFoundry Support Hub.

Provision Branch Office, On-prem DC / AWS / Azure / OCI / any Public Cloud Edge Router

Customer self-hosted Edge Routers act as egress routers for branches to reach the applications/ resources hosted in their on-premise or cloud data center.

Create and Register Branch Office Edge Router(s), On-premise DC Edge Router

  • From your Network Dashboard page, navigate to Edge Routers.
  • Under the Edge Routers tab, click on the + sign at the upper-right to add an edge router.
  • Give your edge router a name.
  • Give your edge router a router attribute (optional). Router attributes are tags applied to a router. The same tag can be applied to other edge routers to form a group of Customer-hosted Edge Routers.
  • Select Customer Hosted as your hosting type.
  • Hit Create to complete the process.
  • A new customer-hosted edge router would be created with the registration key as below. This registration key is required to register the edge router to the network.
  • Copy your edge router registration key. You may also opt to save it as a JWT or a config file.

Use the below deployment guide to provision a Customer-hosted Edge Router into a branch office, On-premise DC, or a private cloud.

https://support.netfoundry.io/hc/en-us/articles/5700949793293-Deployment-guides-for-provisioning-customer-edge-routers-in-a-private-cloud

mceclip9.png

mceclip0.png

Create and Register AWS / Azure / OCI / any Public Cloud Edge Router

  • From your Network Dashboard page, navigate to Edge Routers.
  • Under the Edge Routers tab, click on the + sign at the upper-right to add an edge router.
  • Give your edge router a name.
  • Give your edge router a router attribute (optional). Router attributes are tags applied to a router. The same tag can be applied to other edge routers to form a group of Customer-hosted Edge Routers.
  • Select Customer Hosted as your hosting type.
  • Hit Create to complete the process.
  • A new customer-hosted edge router would be created with the registration key as below. This registration key is required to register the edge router to the network.
  • Copy your edge router registration key. You may also opt to save it as a JWT or a config file.

Use the below deployment guides to provision a Customer-hosted Edge Router into your AWS / Azure/ GCP/ OCI.

https://support.netfoundry.io/hc/en-us/articles/5701001893133-Deployment-guides-for-provisioning-customer-edge-routers-in-public-clouds

 

mceclip9.png

mceclip10.png

mceclip0.png

mceclip5.png

Creating a Service

The service definition provides the details of what device, or devices) will be utilized to provide access to services, either on the device(Zero Trust Client SDK Application) or on the network connected to the device (via its LAN, for example).  The service also defines how the endpoints acting as clients to the service will access the service.  Also, the service hosting details are provided.

In the AWS console, create an EC2 instance for an Nginx server with HTTP access in the same VPC as that of the NetFoundry Edge router and make a note of the Internal IP address.

  • From your Network Dashboard page, navigate to Services.
  • Under the Services tab, click on the + sign at the upper right to add a service.
  • Choose the type of your service. Clicking on Advanced Services allows you to create services with IP/Port ranges. Clicking on Simple Service allows you to create services with specific IP/Port.
  • Select Simple Service as the service type and give the service a name. Give your service a service attribute (optional). Service Attributes are tags applied to a service. The same tag can be applied to other services to form a group of services.
  • In the Edge Router Attributes field, specify the edge routers participating in this service. If all edge routers are participating in this service, then leave this field blank. 
  • In the Client Configuration box, type in the Hostname and Port for the service, if it does not have a hostname you can create one for it, just make sure you do not use reserved names e.g. web.com.
  • Toggle the Native Application SDK Based to No.
  • In the Host Configuration box, select Endpoint Hosted as your service host.
  • Select the associated endpoints capable of accepting connections from clients.
  • Select the Protocol Type.
  • In the Host Name/IP field, enter the IP address/ Port for the service. This is the internal IP address of the application server.
  • Hit Create to complete the process.

mceclip22.png

mceclip23.png

mceclip1.png

mceclip0.png

For additional information or assistance please see our Support Hub article Create and Manage Services.

Creating an AppWAN

The AppWAN defines the services that can be accessed by one or more client endpoints.

  • From your Network Dashboard page, navigate to AppWANs.
  • Under the AppWANs tab, click on the + sign at the upper right to add an AppWAN.
  • Give your AppWAN a name.
  • In the Service Attributes field, specify the services or service attributes to be associated with this AppWAN.
  • In the Edge Router Attributes field, specify the edge routers or edge router attributes to be associated with this policy.
  • In the Endpoint Attributes field, specify the endpoints or endpoint attributes to be associated with this policy.
  • Hit Create to complete the process.

Note: Use of endpoint/service/edge router attribute will select all endpoints/services/edge routers having that specific attribute. The @ symbol is used to tag Individual endpoints/services/edge routers and the # symbol is used to tag a group of endpoints/services/edge routers.

mceclip2.png

APPWAN 'AZ-AWS' is created to allow the Azure Pune Edge router to connect to the HTTP server in AWS.

mceclip3.png

mceclip1.png

APPWAN 'AWS-AZ' is created to allow the AWS Singapore Edge router to connect to the Nginx server in Azure.

mceclip1.png

For additional information or assistance please see our Support Hub article Create and Manage AppWANs.

Inter-cloud Application access

HTTP access to the Branch-AWS Hello world demo Server from Azure

Once the Service, AppWAN configuration is completed in the NetFoundry console, you will be able to make HTTP access to the Branch-AWS Hello world demo Server from the Azure.

The application or server is accessed via a private hostname that is not reachable via the internet. The application is therefore dark to the outside world and reachable only within the NetFoundry network.

mceclip2.png

HTTP access to Azure Nginx Server from Branch-AWS

Once the Service, AppWAN configuration is completed in the NetFoundry console, you will be able to make HTTP access to Azure Nginx Server from Branch-AWS PC.

The application or server is accessed via a private hostname that is not reachable via the internet. The application is therefore dark to the outside world and reachable only within the NetFoundry network.

mceclip9.png

 

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.