Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Install a VM for HPE Mist Networking Authentication Proxy

Follow these steps to install an HPE Mist Networking Edge virtual machine (VM) for the HPE Mist Authentication Proxy functionality.

System Requirements

Minimum hardware requirements for a HPE Mist Networking Edge VM to support the HPE Mist Networking Auth Proxy functionality:

  • Hypervisor: VMware ESXi (Versions – 6.7.0 and 7.0)
  • CPU: 2 vCPUs
  • RAM: 16-GB RAM
  • Hard Disk: 32 GB, thick provisioned
  • Network Interface Card (NIC): Single virtual NIC
Note:

You need to provide unrestricted access to debian and mistsys repo in the environments where you create the VM for initial setup. Also, ensure that the firewall has Port-80 and Port-443 open.

HPE Mist Networking Edge VM as HPE Mist Auth Proxy

HPE Mist Networking Edge virtual machine (VM) requires out-of-band management (OOBM) interface to act as HPE Mist Networking Auth Proxy.

You can specify a port on which the client contacts the RADIUS server. By default, the client uses port 1812 (as specified in RFC 2865). You can also specify an accounting port to send accounting packets. The default port is 1813 (as specified in RFC 2866).

You must configure TCP port 2083 to allow outbound connections destined to radsec.nac.mist.com.

Additionally, you must provide HPE Mist Networking Edge VM access to the EP terminator service [ep-terminator.mistsys.net (TCP 443)] on the HPE Mist Networking cloud. See Firewall Configuration: HPE Mist Networking Ports and IP Addresses.

Figure 1: HPE Mist Networking Edge as Auth Proxy—Flow of Connections Network flow diagram showing data from Third-Party Device to HPE Mist Networking Access Assurance via RADIUS, OOBM, Mist Networking Edge, and RadSec protocols.

Install HPE Mist Networking Edge VM

  1. Download the installation image from the management portal. See Create a HPE Mist Networking Edge VM Using the VMWare ESXi Portal.
  2. In the VMware ESXi portal, upload the ISO to the VMware storage.
    1. On the vSphere Web client, select your virtual machine (VM) from the left navigation bar.
    2. Select the datastore under Storage from the inventory.
    3. Click Datastore browser and select the datastore to which you will upload the file.
      Figure 2: Select Datastore to Upload File VMware vSphere Web Client interface showing details of datastore1 including type VMFS5, UUID, 1 connected host, 4 virtual machines, and toolbar options for management.
    4. Click Upload and then select the ISO file that you have downloaded in the previous step.
      Figure 3: Upload ISO File Datastore browser interface with options to upload, download, and delete files. Datastore1 is selected, folders like EL and IS visible, cursor over Upload button.
    5. Refresh the Datastore browser to see the uploaded file in the list.
      Figure 4: Refresh Datastore Browser Datastore Browser interface showing files and folders in datastore1 with options to upload, download, delete, move, copy, create directories, and refresh.
  3. Create a VM with the following configuration.
    1. On the Select a create type page, select Create a new virtual machine.
    2. On the Select a name and guest OS page, enter the required details.
      Figure 5: Enter Details of HPE Mist Networking Edge VM VMware ESXi interface for creating a virtual machine, step Select a name and guest OS, with Mist Networking Edge Auth Proxy as name, Linux family, Debian GNU/Linux 10 64-bit version selected.
      • Name—Enter a name for the VM.
      • Compatibility—Select the ESXi version running on the vSphere. For example: ESXi 7.0 U2 virtual machine.
      • Guest OS family—Select the guest operating system family. For example: Linux.
      • Guest OS version—Select a guest operating system version. for example: Debian GNU/Linux 10 [64-bit].
    3. On the Customize settings page, make the required changes.
      Figure 6: Customize Settings for VM VMware interface for customizing virtual machine settings: 2 CPU cores, 8 GB memory, 32 GB hard disk, VLAN75-x520 network, Datastore ISO connected CD/DVD.
      See Virtual Mist Networking Edge for detailed instructions.
    4. Click Finish after you complete the setup.

    Power on the VM when it is created.

  4. When the HPE Mist Networking Edge VM powers on, install the VM.

    On the HPE Mist Networking Edge VM install page, select Install and press Enter. The default selection is Graphical install.

    Figure 7: Install HPE Mist Networking Edge VM Debian GNU/Linux installer menu in BIOS mode with Install option highlighted and other options like Graphical install and Help visible.

    After the installation, the system displays the ‘mxedge login:’.

    On the installation page, you can see the progress of the installation for some time (30 seconds to a minute) and a request to wait.

    After you select Install, the installation proceeds automatically without any user intervention.

Create a HPE Mist Networking Edge VM on the Management Portal

  1. From the left menu of the management portal, select Mist Edges. Then on the top right of the page, click Create Mist Edge.
    Figure 8: Create HPE Mist Networking Edge VM Screenshot of HPE Mist Networking Edge dashboard interface showing no HPE Mist Networking Edges, Clusters, or Tunnels in the organization and highlighting the Create Mist Edge button for adding new devices.
  2. On the Create Mist Edge page, enter a name for the HPE Mist Networking Edge device and select VM as the model.
    Figure 9: Enter Details for HPE Mist Networking Edge VM Create the interface with title, name input field containing MistAuthProxy-1, Model dropdown with VM selected, Create and Cancel buttons, and a Close button.
  3. Copy the registration code and save the information.
    Figure 10: Copy Registration Code Configuration interface for MistAuthProxy-1 showing fields for name MistAuthProxy-1, model VM, registration status Unregistered, registration code with copy button, Mist Networking Edge ID with copy button, and cluster No Cluster.

    Note that by default Dynamic Host Configuration Protocol (DHCP) provides the out-of-band management (OOBM) IP address. On the management portal, you can see the assigned static OOBM IP address as shown in the following figure. We recommend that you use a static out-of-band management IP address for the HPE Mist Networking authentication proxy use case.

    Figure 11: HPE Mist Networking Edge VM Out-of-Band Management IP Address Configuration interface for HPE Mist Networking Edge device MistAuthProxy-1 showing device info, tunnel IP config, management passwords, IGMP snooping, DHCP relay, status as Disconnected, and OOBM IP settings. Save and Cancel buttons available.

    For the HPE Mist Networking authentication proxy use case, you do not need to configure the tunnel interface IP.

  4. On the HPE Mist Networking Edge Inventory page, scroll down to the Clusters pane and click Create Cluster.
    Figure 12: Create HPE Mist Networking Edge Cluster User interface for managing clusters with an empty table and a message stating no clusters exist. A Create Cluster button is in the top-right corner.
  5. On the Create Mist Cluster page, enter the cluster name and select your deployed HPE Mist Networking Edge VM.
    Figure 13: Select HPE Mist Networking Edge VM for Cluster Create Mist Cluster interface with fields for Cluster Name and Mist Edges, and buttons for Create and Cancel.
  6. Click Create to continue.
  7. Provision your HPE Mist Networking Edge VM.

    After you configure the Edge on the management portal, connect to the console interface.

    1. When your HPE Mist Networking Edge VM boots up for the first time, log in to the VM using the following credentials:
      • Username: mist
      • Password: Mist@1234
      • Root (su -) password: mist
    2. Get the current management IP address from DHCP by issuing the ip a command. In the command output, you can see that the OOBM interface is ens192..
    Figure 14: Provision HPE Mist Networking Edge VM Terminal session showing network configuration on Debian GNU/Linux. Interface lo: IP 127.0.0.1/8, status UP. Interface ens192: IP 10.0.75.51/24 highlighted in red, status UP, MAC 005056ae:a7f3, IPv6 fe80::20c:29ff:feae:a7f3/64.
    Now, you can initiate an SSH session and connect to the HPE Mist Networking Edge VM with the username mist. Example:

    Switch to root:

    Issue the su – command and use mist as the password.
  8. Initiate SSH from the HPE Mist Networking Edge VM and perform bootstrap.

    To perform a bootstrap on the HPE Mist Networking Edge VM and onboard the device to the management portal, use the following CLI commands:

    When the process completes, the CLI displays the following message:

    After successful registration, the VM automatically reboots and downloads the configuration from the managementportal.

    After the reboot, you can see the updated status of the VM on the management portal. The Status field on the Inventory page displays Connected and a corresponding orange icon.

    Figure 15: HPE Mist Networking Edge VM in HPE Mist Networking Edge Inventory Mist Edge Inventory interface displaying details of a Mist Edge device, including status as connected, name MistAuthProxy-1, registration as registered, cluster MistAuthProxy-Cluster, OOBM IP address 10.0.75.23, OOBM MAC address 00:0c:29:3e:af:73, site unassigned, model VM, uptime 29 minutes, last seen at 06:01:06 PM on Jun 16. Buttons for claiming or creating Mist Edge are visible.

See Also