199 lines
No EOL
10 KiB
Markdown
199 lines
No EOL
10 KiB
Markdown
# Sophos HA on STACKIT
|
|
|
|
This directory contains the **Terraform configuration** for deploying a **High Availability (HA) cluster** of two **Sophos Firewalls** on the **STACKIT** cloud platform. The configuration includes all necessary resources such as networks, virtual machines (appliances), volumes, interfaces, and security groups.
|
|
|
|
## Content Readme
|
|
* [Directory Structure](#directory-structure)
|
|
* [Prerequisites](#prerequisites)
|
|
* [Infrastructure Guide](#infrastructure-guide)
|
|
* [Application Guide](#application-guide)
|
|
---
|
|
## Directory Structure
|
|
|
|
#### [`01-provider.tf`](./01-provider.tf)
|
|
This file initializes the **STACKIT Terraform Provider**. It defines which cloud platform is being managed and specifies the version to be used. The **latest version** is always selected; in the specific deployment, **Version 0.69.0** was used.
|
|
|
|
#### [`02-config.tf`](./02-config.tf)
|
|
This is where the most important **configuration variables** are defined, determining the target project and hardware specifications. Parameters include `project_id`, the path to the `service_account_key_path`, and default settings for `default_region`, `default_az`, and the VM `flavor` (e.g., `m2i.2`).
|
|
|
|
#### [`03-sophos-image.tf`](./03-sophos-image.tf)
|
|
This file configures the creation of the necessary STACKIT images. The local **QCOW2 files** (`PRIMARY-DISK.qcow2` and `AUXILIARY-DISK.qcow2`), which contain the Sophos installation, are converted into usable cloud images.
|
|
|
|
#### [`04-sophos-network.tf`](./04-sophos-network.tf)
|
|
Here, the four **Sophos-specific networks** (Management, LAN, Synchronization, WAN) and the associated components are configured:
|
|
* `sophos_mgmt_net`
|
|
* `sophos_lan_net`
|
|
* `sophos_sync_net`
|
|
* `sophos_wan_net`
|
|
* A **VIP (Virtual IP) Interface** for HA operation. The VIP should not be attached to any VM.
|
|
* A **Public IP address** for external access (e.g., WAN).
|
|
* The necessary **Security Groups and Rules** to control traffic.
|
|
|
|
#### [`05-sophos-appliance1.tf`](./05-sophos-appliance1.tf) and [`06-sophos-appliance2.tf`](./06-sophos-appliance2.tf)
|
|
These files each define one of the two Sophos VMs that form the HA cluster. The configuration includes:
|
|
* Creation of the two **Volumes** (boot and auxiliary disk) for the VM.
|
|
* Creation of the **VM** itself.
|
|
* Creation and correct sequential attachment of the **four network interfaces**:
|
|
1. Management (`mgmt`)
|
|
2. LAN (`lan`)
|
|
3. Synchronization (`sync`)
|
|
4. WAN (`wan`)
|
|
|
|
---
|
|
|
|
## Prerequisites
|
|
|
|
Before deploying the Sophos HA construct, ensure the following tools and assets are available:
|
|
|
|
### 1. Software Tools
|
|
|
|
* **Terraform CLI:** You need the **Terraform Command Line Interface** installed and configured to execute the Infrastructure-as-Code files (`*.tf`).
|
|
* **STACKIT CLI (Optional):** The **STACKIT Command Line Interface** is not strictly required for the Terraform deployment itself but can be useful for managing your STACKIT Project and is *recommended* for mapping the MAC addresses.
|
|
|
|
### 2. Sophos Assets
|
|
|
|
* **Sophos Images (QCOW2 Format):** The Sophos appliance images must be available as **two QCOW2 files**.
|
|
* Place these files directly in the root directory and ensure they are named exactly:
|
|
* `PRIMARY-DISK.qcow2`
|
|
* `AUXILIARY-DISK.qcow2`
|
|
* **Sophos Serial Number/License:** A valid **Sophos Serial Number** or **License** is required to activate the appliances and enable HA functionality after they have been successfully deployed.
|
|
---
|
|
## Infrastructure Guide
|
|
|
|
### Step 1: Prepare the Environment
|
|
|
|
1. **Clone the Repository:**
|
|
```bash
|
|
git clone <repository-url>
|
|
cd Sophos-HA
|
|
```
|
|
2. **Provide Sophos Images:**
|
|
* Place the two Sophos QCOW2 image files directly into the root directory of the cloned repository.
|
|
* Ensure they are named correctly or adjust the path as a variable: `PRIMARY-DISK.qcow2` and `AUXILIARY-DISK.qcow2`.
|
|
|
|
### Step 2: Configure Terraform Variables
|
|
|
|
1. **Create Variables File:**
|
|
* The required variables are defined in `02-config.tf`. To provide the values, create a new file named **`00-variables.auto.tfvars`** in the root directory.
|
|
* Fill in the values based on your project and environment:
|
|
2. **Configure STACKIT Service Account:**
|
|
* **Generate** a STACKIT Service Account Key (JSON format) and place the path to this key in the `service_account_key_path` variable.
|
|
|
|
3. **Configure Terraform Backend:**
|
|
* **Recommendation:** For production environments, it is highly recommended to configure a remote backend (e.g., a **STACKIT Object Storage Bucket**) in `01-provider.tf` to store the `tfstate` securely. Alternatively, you can use the default local backend configuration for testing purposes.
|
|
|
|
### Step 3: Execute Terraform
|
|
|
|
1. **Initialize Terraform:**
|
|
* Ensure that you are in the project folder (`cd Sophos-HA`).
|
|
* Initialize the working directory and download the necessary providers (including the STACKIT provider).
|
|
```bash
|
|
terraform init
|
|
```
|
|
2. **Review the Plan:**
|
|
* Check the infrastructure changes Terraform intends to make.
|
|
```bash
|
|
terraform plan
|
|
```
|
|
3. **Apply the Configuration:**
|
|
* Execute the plan to deploy all resources (Networks, Images, Volumes, VMs/Appliances).
|
|
```bash
|
|
terraform apply
|
|
```
|
|
* Wait until the process is complete and the VMs are fully provisioned and booted.
|
|
|
|
### Step 4: Initial Sophos Appliance Configuration
|
|
|
|
After successful deployment, the two Sophos Appliances need an initial configuration via the console to enable management access.
|
|
|
|
1. **Access the Console:**
|
|
* In the STACKIT Portal, access the **Console** of **Appliance 1** (`sophos-appliance1`).
|
|
2. **Initial Login:**
|
|
* The Sophos appliance should boot into the main menu.
|
|
* The standard password for Sophos appliances is **`admin`** (case sensitive).
|
|
3. **Configure Management Interface:**
|
|
* From the main menu, select **`1. Network Configuration`**.
|
|
* Select **`1. Interface Configuration`**.
|
|
* Identify the interface corresponding to the **Management Network** (e.g., Port 1) and configure it with the pre-defined ipv4 IP and CIDR block from the Terraform configuration (specifically the **`sophos_mgmt_net`** ).
|
|
|
|
4. **Repeat for Appliance 2:**
|
|
* Perform the same initial console configuration for **Appliance 2** (`sophos-appliance2`), assigning it the pre-defined IP and CIDR within the same `sophos_mgmt_net` subnet.
|
|
|
|
5. **Access Web Interface:**
|
|
* Use a jump host VM within the same subnet `sophos_mgmt_net` or your local device with appropriate routing to access the Sophos WebAdmin console. (`https://<mgmt-ip>:4444`)
|
|
|
|
## Application Guide
|
|
|
|
This section outlines the configuration steps required within the Sophos WebAdmin interface to establish the High Availability (HA) cluster and configure public connectivity.
|
|
|
|
### Step 1: Initial Wizard and Registration
|
|
|
|
1. **Run the Setup Wizard:**
|
|
* Log in to the WebAdmin of both appliances (`https://<mgmt-ip>:4444`).
|
|
* Complete the basic setup wizard on **both** appliances.
|
|
* **Firmware Check:** Ensure both appliances are running the **exact same firmware version**.
|
|
* *Tip:* If firmware versions match immediately, you can configure the second appliance as an "HA Spare" directly during the first wizard step. Otherwise, configure both as standalone first and update firmware.
|
|
2. **Registration:**
|
|
* After the reboot, log in with the admin credentials.
|
|
* Register both firewalls. A valid license (minimum **Home License**) is required to enable HA functionality.
|
|
|
|
### Step 2: Configure Sync Interface
|
|
|
|
Perform these steps on **both** appliances:
|
|
|
|
1. **Network Configuration:**
|
|
* Navigate to **Network > Interfaces**.
|
|
* Edit the Port identified as the **Sync Interface**.
|
|
* Set the **Network Zone** to **DMZ**.
|
|
* Assign the IP address allocated by Terraform for the Sync network.
|
|
2. **Device Access:**
|
|
* Navigate to **Administration > Device Access**.
|
|
* Enable **SSH** on the **DMZ** zone (required for HA communication).
|
|
|
|
### Step 3: Configure High Availability (HA)
|
|
|
|
Configure the **Auxiliary (Sophos 2)** appliance first, then the **Primary (Sophos 1)**.
|
|
|
|
#### 1. Configure Sophos 2 (Auxiliary)
|
|
* Navigate to **System Services > High Availability**.
|
|
* **Initial Device Role:** Select **Auxiliary (Interactive Mode)**.
|
|
* **Node Name:** Assign a name (e.g., `Sophos-Node2`).
|
|
* **Passphrase:** Set a secure passphrase (note this down, it must match on the Primary).
|
|
* **Dedicated HA Link:** Select the **DMZ Port** configured in Step 3.
|
|
* Click **Save** or **Enable HA**.
|
|
|
|
#### 2. Configure Sophos 1 (Primary)
|
|
* Navigate to **System Services > High Availability**.
|
|
* **Initial Device Role:** Select **Primary (Interactive Mode)**.
|
|
* **Cluster ID:** Select an ID (0-63).
|
|
* **Node Name:** Assign a name (e.g., `Sophos-Node1`).
|
|
* **Passphrase:** Enter the same passphrase used on the Auxiliary.
|
|
* **Dedicated HA Link:** Select the **DMZ Port**.
|
|
* **Peer HA Link IPv4:** Enter the IP address of the **Sophos 2 Sync Interface**.
|
|
* **Monitored Ports:** Select the interfaces to monitor (usually LAN and WAN).
|
|
* **Peer Administration Settings:** Enter the **Management IP** of Sophos 2.
|
|
* **Hypervisor MAC:** Set **Use host or hypervisor-assigned MAC address** to **True**.
|
|
* *Important:* This setting is critical for STACKIT/OpenStack environments to ensure traffic routing works correctly during failover.
|
|
* Click **Enable HA**.
|
|
|
|
### Step 4: Post-HA Network Configuration (VIP)
|
|
|
|
Once the HA cluster is built, the primary appliance handles traffic. You must now configure the public-facing interface to use the Virtual IP (VIP).
|
|
|
|
1. **Assign VIP Address:**
|
|
* On the active (Primary) appliance, navigate to **Network > Interfaces**.
|
|
* Edit the **WAN Port**.
|
|
* Manually change the IP address to the **local VIP Address**.
|
|
2. **Enable WAN Services:**
|
|
* Navigate to **Administration > Device Access**.
|
|
* Enable necessary services on the **WAN** zone (e.g., User Portal, VPN).
|
|
* **Testing:** Temporarily enable **Ping** on WAN to verify connectivity.
|
|
|
|
### Step 5: Verification and Failover Test
|
|
|
|
1. **Ping Test:**
|
|
* Ping the **Public IP** output by the Terraform script. It should be reachable.
|
|
2. **Failover Test:**
|
|
* Shut down the **Primary VM** via the STACKIT Portal or Sophos WebUI.
|
|
* The **Auxiliary VM** should take over the role of Primary after a short interruption.
|
|
* Verify that the Public IP remains pingable. |