31

Aviatrix Cloud Sandbox Starter - Spin up Cloud Networks in Minutes

Introduction

Aviatrix Sandbox Starter Tool (SST) is a community-based and community-supported tool that deploys following small test/lab cloud network environment in minutes.

This SaaS like lightweight tool first deploys an Aviatrix Controller in AWS. Once the Controller is up, the tool uses Terraform to create Aviatrix transit (Hub and Spoke) topology in AWS.

Two EC2 test instances will be deployed and connected, that can be used to run test cases, POC or SRE work using the Aviatrix platform with simplicity, automation, visibility, and control.

The self-guided UI workflow can also deploy Azure Network and connect to AWS.

Additional use-cases can then be added directly from Controller UI or Terraform following step by step tool user guide.

SST itself can be deployed using three different options

  1. Cloud AMI 
  2. Cloud AMI via Terraform Module
  3. Local Machine 

This document uses the recommended Cloud AMI Option#1 to deploy the SST and Cloud Networks.

The Sandbox Starter Tool itself is free but there is a cost of running the lab. Please refer to this link for a detailed cost breakdown.

Notes:

When subscribing to the platform, you must set up your account after clicking subscribe to generate your controller license key (which will be emailed to the address used in the set up process). This will be used as input to the sandbox starter and subsequently configured during your controller launch.

This tool works the best for a brand new Aviatrix Controller deployment. If you previously deployed Aviatrix Controller, make sure you delete the following first

  • Aviatrix EC2 roles
  • Aviatrix EC2 policies are deleted
  • Delete Aviatrix default key-pair

Launch Sandbox Starter AWS EC2 Instance

You can deploy this tool in any AWS region. Make sure you have a proper EIP and VPC quota for your region. In our example, we will be deploying the Sandbox Starter tool in the N. Virginia region (us-east-1).

  • Click here for the N. Virginia region EC2 setting

  • Click here to search for the Sandbox Starter Public AMI under the Images section and select the latest Sandbox Starter AMI

  • Click the "Launch Instance from Image" button and select t3.micro or t2.micro instance size

  

  • Click Configure Instance Details and provide the following information. Leave everything else as default
    • Network: Select the default VPC.
    • Subnet: Select the public subnet
    • Auto-assign Public IP: Enable

  • Click Add Storage button. Do not change anything here
  • Click Add Tags. Do not change anything here
  • Click Configure Security Group and block inbound access to SST EC2
  • Create a new security group with the following information
    • Security Group Name: Aviatrix_Sandbox_Starter_SG
    • Delete the SSH TCP 22 rule and add a new HTTPS TCP 443 rule. You must make sure that only your IP address has access to Sandbox Tool
    • Ignore the warning

Reference: Authorize inbound traffic for your Linux instances

  • Review and launch now

  • Select the Key Pair and Launch

  • Click on the instance ID to show the details and copy the Public IPv4 address

  • Once the instance "Running", browse to https://<Public IPv4 address>
    • In our example it is https://54.173.15.154/
    • The tool uses a self-signed certificate
      • Accept the warning and proceed
      • If using Chrome and you get a connection error message, you can bypass that by clicking anywhere and typing thisisunsafe

You should see the "Aviatrix Sandbox Starter" user interface (UI) now.

Standard Mode Wizard with AWS

Standard is the recommended workflow. This will deploy the controller and topology in the regions specified in the diagram.

  

 

Provide AWS Credentials

You can get the Access Key under the "Security Credential" area in AWS console. If you don't have one, you should create one.

Launch the Controller in AWS

Notes

  • The controller version will default to that which is needed for ACE courses. You can choose other available versions with the understanding that they may not be compatible those courses.
  • Be sure to subscribe to the AWS marketplace offerings mentioned in the Before You Begin section above and set up your account to generate the Controller License required as input.
  • In the future, we might add the option to launch Controller in other Clouds

Launch Global Transit (Hub) and two Spokes in AWS

Launch Test EC2 instances

Test EC2 (Amazon Linux VMs) will be launched in their respective Spoke VPCs

Provide an Existing Key Pair Name

This must be configured in your AWS account in us-east-2 (Ohio) region as per-requisite. You will need this Key Pair to login to test EC2 instances to verify the end-to-end connectivity.

Select No for "Launch Aviatrix Transit in Azure"

Success Message

Upon success, you will receive the necessary public and private IP addresses. The entire process should take somewhere between 22-30 minutes.

Now you can log in to Aviatrix Controller UI by clicking the controller URL.

Note: The user name is admin and the password is the one you selected earlier in the process.

Lock Inbound Access to Controller

After the Controller is deployed, you must do the following to lock the inbound access so that no one has access to it.

1-  Enable the security group management feature so all of the gateways' IP addresses are allowed to reach the controller on HTTPS/port 443

2- Lock all inbound access to Controller except your own IP address

Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html 

Experience the Platform and Deploy Use Cases

Follow the instructions in the Test Plan to experience the Aviatrix Multi-Cloud platform and deploy recommended use case.

Besides that, users are highly encouraged to deploy more use-cases based on their needs and requirement by following the official documentation at https://docs.aviatrix.com

Standard Mode Deployment with AWS and Azure

Azure deployment is optional. You must have an Azure subscription and related information if you are planning on extending the network in Azure.

For Sandbox deployment both in AWS and Azure, follow the video here

https://youtu.be/INqXNQgWgmg

 

Advance Mode Wizard

Advance mode is for users who would want to change the region, naming convention, and subnet scheme.

  

Provide AWS Credentials

Before launching the controller, you can change the region and subnet details as shown in the following screenshot.

Notes

  • Be sure to subscribe to the AWS marketplace offerings mentioned in the Before You Begin section above and set up your account to generate the Controller License required as input.
  • In the future, we might add the option to launch Controller in other Clouds 

Launch Global Transit (Hub) and two Spokes in AWS

Launch Aviatrix Global Transit (Hub) and two Spokes in the AWS region as per your requirement.

Launch Test EC2 instances

Test EC2 (Amazon Linux VMs) will be launched in their respective Spoke VPCs

Provide an Existing Key Pair Name

This must be configured in your AWS account in us-east-2 (Ohio) region as per-requisite. You will need this Key Pair to login to test EC2 instances to verify the end-to-end connectivity. 

This concludes the deployment in AWS. Optionally you can also deploy Aviatrix Transit network in Azure and provide connectivity between AWS and Azure clouds.

Launch Aviatrix Transit in Azure

Connect AWS and Azure with a Single Click

Success Screen

Lock Inbound Access to Controller

After the Controller is deployed, you must do the following to lock the inbound access so that no one has access to it.

1- Enable the security group management feature so all of the gateways' IP addresses are allowed to reach the controller on HTTPS/port 443

2- Lock all inbound access to Controller except your own IP address

Destroy / Delete the entire LAB

Once you are done testing and validating Cloud Networks, you may destroy or delete the entire lab. First, turn off AWS access security on the controller by logging into the controller, click on "Settings" in the left-hand nav. Click on "Controller", then "Access Security" in the top tabs. Under "Controller Security Group Management", click "Disable".

Back in the sandbox starter, use the "Destroy" option on the top right of the browser UI.

If you destroyed SST before getting a chance to destroy your environment, you will need to manually delete these resources in order (always check you are in the appropriate region first):

  1. Terminate the Spoke and Transit gateways in AWS (if applicable)
  2. Remove the Resource Groups in Azure (if applicable)
  3. Disable Termination Protection on the EC2 instance for the Controller
  4. Terminate the Controller EC2 instance
  5. Remove the SSH keypair
  6. Delete the Security Groups
  7. Delete the VPC where the Gateways and Controller was deployed
  8. Delete the IAM Roles and Policies starting with ‘aviatrix’

Note that if you deployed CoPilot, it must be deleted manually by logging into AWS/Azure Console.

Support Model

This community-based and open-source tool is NOT supported by the Aviatrix Enterprise support team. For any questions or issues related to this tool, please use the Aviatrix Community platform.

Open Source

  1. Code for this open-source tool is available at https://github.com/AviatrixSystems/sandbox-starter
  2. Terraform module for Sandbox Starter launch is available here at https://github.com/terraform-aviatrix-modules/terraform-aviatrix-aws-sandbox-starter
  3. The container code is available here
54replies Oldest first
  • Oldest first
  • Newest first
  • Active threads
  • Popular
  • I cannot make the terraform work for ace-lac-zero.

     Bottom Expand Full screen

    Terraform v1.0.6
    on linux_amd64
    Initializing plugins and modules...
    Initializing modules...
    Downloading terraform-aviatrix-modules/mc-spoke/aviatrix 1.2.3 for aws_spoke_1...
    - aws_spoke_1 in .terraform/modules/aws_spoke_1
    Downloading terraform-aws-modules/ec2-instance/aws 2.21.0 for aws_spoke_bastion...
    - aws_spoke_bastion in .terraform/modules/aws_spoke_bastion
    Downloading terraform-aviatrix-modules/mc-transit/aviatrix 2.1.4 for aws_transit_1...
    - aws_transit_1 in .terraform/modules/aws_transit_1
    Downloading terraform-aviatrix-modules/mc-spoke/aviatrix 1.2.3 for azure_spoke_2...
    - azure_spoke_2 in .terraform/modules/azure_spoke_2
    Downloading terraform-aws-modules/security-group/aws 3.18.0 for security_group_1...
    - security_group_1 in .terraform/modules/security_group_1
    There are some problems with the configuration, described below.
    
    The Terraform configuration must be valid before initialization so that
    Terraform can determine which modules and providers need to be installed.
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 15, in variable "name":
    │   15:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 32, in variable "gw_name":
    │   32:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 54, in variable "connected_transit":
    │   54:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 61, in variable "hybrid_connection":
    │   61:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 68, in variable "bgp_manual_spoke_advertise_cidrs":
    │   68:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 75, in variable "learned_cidr_approval":
    │   75:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 88, in variable "enable_segmentation":
    │   88:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 95, in variable "ha_region":
    │   95:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 102, in variable "cidr":
    │  102:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 114, in variable "ha_cidr":
    │  114:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 126, in variable "lan_cidr":
    │  126:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 138, in variable "enable_firenet":
    │  138:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 145, in variable "enable_transit_firenet":
    │  145:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 152, in variable "enable_egress_transit_firenet":
    │  152:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 159, in variable "bgp_polling_time":
    │  159:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 166, in variable "bgp_ecmp":
    │  166:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 173, in variable "enable_multi_tier_transit":
    │  173:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 180, in variable "enable_advertise_transit_cidr":
    │  180:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 193, in variable "enable_bgp_over_lan":
    │  193:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 205, in variable "instance_size":
    │  205:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 212, in variable "ha_gw":
    │  212:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 219, in variable "insane_mode":
    │  219:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 226, in variable "az1":
    │  226:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 233, in variable "az2":
    │  233:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 240, in variable "az_support":
    │  240:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 247, in variable "single_az_ha":
    │  247:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 254, in variable "single_ip_snat":
    │  254:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 261, in variable "enable_encrypt_volume":
    │  261:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 297, in variable "bgp_lan_interfaces":
    │  297:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 304, in variable "ha_bgp_lan_interfaces":
    │  304:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 311, in variable "enable_active_standby_preemptive":
    │  311:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 318, in variable "legacy_transit_vpc":
    │  318:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    ╷
    │ Error: Unsupported argument
    │
    │   on .terraform/modules/aws_transit_1/variables.tf line 325, in variable "enable_s2c_rx_balancing":
    │  325:   nullable    = false
    │
    │ An argument named "nullable" is not expected here.
    ╵
    
    Operation failed: failed running terraform init (exit 1)
    Like
  • Any plans of adding an option to use AWS EC2 instance profile and its credentials instead of a user-managed access key and secret? It seems like a more secure option than using a key and secret for your user account (and you can limit the role used by the instance profile only to the permissions actually needed for the deployment). 

    Like
    • Peter Matuska This is a good suggestion. I and John Smoker will keep it in mind for future enhancement. As of now we don't have any plans to add this functionality.

      Like
Like31 Follow
  • 31 Likes
  • 2 days agoLast active
  • 54Replies
  • 10385Views
  • 36 Following