Use the VSync Tool

System Requirements

You can install the VSync tool on a virtual machine (VM) or a bare-metal server running Ubuntu 18.04. It is recommended that you use a bare-metal server for better performance. The VSync tool server must have at least 2 CPU cores, 4 GB RAM, and a 40-GB hard drive. However, depending on the size and frequency of the threat intelligence updates and the number of VOS devices that need to be updated, you may need to use a server with more computation power, memory, and storage.

The following table describes the system requirements when VOS devices are updated daily with 100 MB.

Network Connectivity Requirements

It is recommended that you install the VSync tool on a server with at least two 1-Gbps network interfaces. You use one of the interfaces as the northbound interface (typically, eth0) and the second as the southbound interface (typically eth1). You connect the northbound interface of the VSync server to the same network to which the northbound interface of the Director node connects. You connect the southbound interface to the same network to which the southbound interface of the Director node connects.

Communication with Intelligence Sources

The VSync tool downloads threat intelligence files from either a web server or a RESTful API server using the HTTPS protocol. You can configure multiple threat intelligence sources, each of which can be available from a different web server or REST API server. You can configure an optional authorization header to send as part of download requests, and you can configure a different authorization header for each threat intelligence source.

The following design considerations apply to various deployment scenarios:

• If the threat intelligence source files are available on the internet or from public cloud storage, the preferred communication path is using the northbound interface. You must configure the appropriate firewalls or proxies to allow the VSync tool to download the feeds.
• If the threat intelligence source files are available on the internal network, the preferred communication path is using the southbound interface. If you deploy the VSync tool in HA mode, it is recommended that each VSync tool node be collocated with the Director node at each location of the HA deployment. Both the nodes running the VSync tool must be able to communicate with the threat intelligence source using the southbound interface over the backbone network.
• If you deploy the Director node and VSync tool in a service provider environment, and if the threat intelligence sources are located within the customer environment, the preferred communication path is using the northbound interface to reach the customer network. The customer must configure their firewall to allow the VSync tool to download the threat intelligence files from the sources identified in their network.

Communication with VOS Devices

For the VSync tool to communicate with VOS devices, the preferred path is to use the southbound interface, which connects to the control plane network. Threat intelligence updates are first sent to the Controller nodes, which then send the data to the VOS devices over IPsec tunnels that are already established between the Controller and VOS devices. It is recommended that you use use the Director node as a reference to configure the routing information related to the southbound (control plane) network, to ensure connectivity between the VSync tool and the VOS devices.

HA Considerations

If you deploy the Versa solution in high availability (HA) mode in different locations, it is recommended that you deploy one instance of the VSync tool at each location. At each location, you connect the northbound interface of the VSync tool to the same network to which the northbound interface of the Director node connects, and you connect the southbound interface of VSync tool to the same network to which the southbound interface of the Director node connects. This arrangement ensures that both instances of the VSync tool have access to each other and to the southbound interfaces of the Director node using the southbound interfaces.

International Characters and Encoding of URLs

• When you specify URLs that include international characters encoded as UTF-8, UTF-16, or UTF-32, VOS devices normalize the UTF-8, UTF-16, and UTF-32 strings.
• When URLs contain non-ASCII characters in them, you can encode the URLs using percent-encoding or percent-u-encoding. If you encode the URLs using any standard URL encoding method, the VOS software supports normalization of the URLs to URL byte streams.
• Before HTTP URLs are matched against the URL patterns or strings specified in the domain or URL files, the HTTP URLs are normalized or decoded as applicable.
• The VSync tool supports only percent-encoded URLs in the source URL or domain threat feed files.

Performance and Scaling

The VSync tool has been tested in an SD-WAN topology consisting of 1000 appliances and three threat feed sources. The threat feeds were one IP address file source and two URL file sources, and each file contained 64,000 entries.

Add the VSync Southbound IP Address to the Device Template

To allow the VSync tool to communicate with VOS device's, the southbound IP address of VSync node must be in the VOS device's template. You can add this address to the device template, or you can issue the following command on the VOS device:

set devices template template-name config system vnf-manager-ip-addresses vsync-southbound-ip-address

If there are multiple redundant VSync nodes, you must add the IP addresses of both VSync nodes as VNF managers.

Copy the SSH Key to the VSync Node

To allow the VSync node to access VOS devices and securely copy files to them without requiring passwords, copy the SSH private key from the Director node to the VSync node. The SSH private key is created by the Director node as part of the zero-touch provisioning (ZTP) process. For example:

[admin@vsync-host1]$ scp Administrator@10.100.197.2:/var/versa/vnms/ncs/homes/admin/.ssh/id_dsa /opt/versa/vsync/var/id_rsa_appl
Administrator@10.100.197.2's password:
id-rsa        100% 1675   1.7mb/s  00.00
[admin@vsync-host1]$ sudo chown versa:versa /opt/versa/vsync/var/id_rsa_appl
[sudo] password for admin:
[admin@vsync-host1]$ sudo chmod 600 /opt/versa/vsync/var/id_rsa_appl

Then edit the SSH configuration file, /etc/ssh/ssh_config, using either vi or nano, and add the following line at the end to define the ssh-dsa key type, which is ssh-dss, so that this public key type is available for user authentication:

PubkeyAcceptedKeyTypes +ssh-dss

By default, the VSync tool also uses the /opt/versa/vsync/var/id_rsa_appl file as the SSH key file used to authenticate VOS devices. If the VOS device SSH key file is in a different location, set the path to that location in the JSON configuration file, as discussed below.

Director nodes use the DSA key for SSH access to VOS devices. The SSH key on the Director node is in the /var/versa/vnms/ncs/homes/admin/.ssh/id_dsa file.

Set Up the JSON Configuration File

The VSync tool operates by running a VSync process, called vsyncd. You define the vsyncd configuration parameters in a JSON file. By default, the file is /opt/versa/vsync/var/vsyncd-cfg.json. You can find a sample configuration file at /opt/versa/vsync/var/vsyncd-cfg.json.sample. To define the VSync tool parameters for your environment, make a copy of the sample configuration file and change the values as appropriate.

The JSON configuration file consists of three sections:

• General configuration
• Director configuration
• Threat intelligence source configuration

In the general configuration section, you specify paths to various files and directories, and timeout values. The following is an example of the JSON configuration in the general section. The table describes the configuration parameters.

1 {
2    "vsync-name"             :"vsync-12345"
3    "workingdir"             : "/opt/versa/vsync/var",
4    "logfile"                : "/var/log/versa/vsync/versa-vsyncd.log",
5    "download-timeout"       : "300",
6    "max-rsync-procs"        : "20"
7    "appl-keyfile"           : "/opt/versa/vsync/var/id-rsa-app1",
8    "sync-on-start"          : "true",
9    "status-check-frequency" : "300",
10   "include-dev-names"      : [ "Branch-A" ],
11   "exclude-dev-names"      : [ "Branch-B" ],

In the Director configuration section, you specify information about the Director node. The following is an example of the JSON configuration in the Director section. The table describes the configuration parameters.

12   "versa-dir-info"   : {
13     "host"             : "10.200.1.4",
14     "rest-port"        : "9182",
15     "rest-user"        : "Administrator",
16     "rest-password"    : "Versa@123",
17     "refresh-interval" : "86400"
18   },

In the threat intelligence source section, you specify one or more sources. For each source, you set parameters for the start time and frequency of intelligence updates and the intelligence source format. The following is an example of the JSON configuration in the threat intelligence source section. The table describes the configuration parameters.

19   "vsync-entries"      : [
20     {
21        "name"                      : "versa-test-url",
22        "src"                       : "https://spack.versa-networks.com/html/Threat-URL-list.txt",
23        "auth-header"               : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
24        "format"                    : "txt",
25        "start-time"                : "00.00.00",
26        "frequency"                 : "3600",
27        "max-entries-per-file"      : "50000",
28        "max-files"                 : "5",
29        "no-file-cnt-in-fname"      : "true"
30        "url-for-empty-file"        : "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ",
31        "empty-file-if-no-xlations" : "true",
32        "urlfile"                   : "true",
33        "url-match-strings"         : "true",
34        "target-objects"  :  [   
35          {
36            "tenant"                :  "ACME",
37            "url-category"          :  "uc1"
38         }
39       ]
40    }

Associate Objects with Files

As the final step in configuring the VSync tool, in the device template you associate address group objects, custom application objects, and custom URL category objects with files. Currently, you must perform this configuration from the CLI on the Director node. You cannot configure it from the Director GUI. This section provides examples of associating objects with files.

The following example associates an address group object and address file with the tenant ACME-Tenant in the template named ACME. Note that you enter the set command on a single line. The example here shows it as two lines for readability.

Administrator@Director> configure
Entering configuration private mode
Administrator@Director% set devices template ACME config orgs org-services ACME-Tenant objects
address-groups group Azure-Addresses address-files [ azure-ipdata.csv ]
Administrator@Director% commit

The following example associates a URL filter object and an address file with the same tenant and template. Again, you enter the set command on a single line. The example here shows it as two lines for readability.

Administrator@Director% set devices template ACME config orgs org-services ACME-Tenant
url-filtering user-defined-url-categories url-category Test-URLs url-file versa-test-urldata.csv
Administrator@Director% commit

Modify Limits for IP Addresses, Domain Names, and URL File Entries

By default, a VOS device cannot load an IP address file, a URL files, or a domain file if the file contains more than 64,000 entries. To adjust the maximum number of file entries, you run the vsync_cfg_appl.py script on the VSync host. This script has the following parameters:

The following usage information indicates the required parameters, in addition to the default configuration available in vsyncd configuration file.

admin@Director02:/home/admin$ cd /opt/versa/vsync/python/vsyncd
admin@Director02:/opt/versa/vsync/python/vsyncd$ ./vsync_cfg_appl.py -h
Usage: vsync_cfg_appl.py [options]

Options:
-h, --help            show this help message and exit
-c cfilepath, --cfgfile=cfilepath
                        Path to config file in json format
-t tenant, --tenant=tenant
                        Tenant name
-k keyfile, --keyfile=keyfile
                        SSH keyfile for appliances
-l logfile, --logfile=logfile
                        Log file to write logs to
-f ipflimit, --ip-file-limit=ipflimit
                        Limit for max IP Address per file
-g ipgrouplimit, --ip-group-limit=ipgrouplimit
                        Limit for max IP Address per Group
-u urlflimit, --url-file-limit=urlflimit
                        Limit for max URL entries  per file  

The following command shows an example of running the vsync_cfg_appl.py script. Note that you enter the command on a single line. The example here shows it as multiple lines for readability.

admin@Director02:/opt/versa/vsync/python/vsyncd$ ./vsync_cfg_appl.py 
-c /opt/versa/vsync/var/vsyncd-cfg-test.json 
-t VersaProvider -k /opt/versa/vsync/var/id_rsa_appl2 -l /var/tmp/vcfg.log -f 32768

This example command includes the following options:

• –c option—Specifies the configuration in the /opt/versa/vsync/var/vsyncd-cfg-test.json file, from which to obtain information about all affected VOS devices and VOS device connectivity.
• –t option—Specifies the tenant, VersaProvider, whose VOS devices to update.
• –k option—Specifies the keyfile, /opt/versa/vsync/var/id_rsa_appl2, to use to authenticate with the VOS devices.
• –l option—Writes logs to the /var/tmp/vcfg.log file.
• –f 32768 option—-Configures a maximum number of 32,768 entries in the IP address file (equivalent to the max-entries-per-file value in the JSON configuration file).