Installing the DSG

• 1: Installing the DSG patch on ESA
• 2: Configuring the DSG Cluster
• 3: Forward Logs to the Audit Store
• 4: Registering the DSG node with ESA
• 5: Updating the host name or domain name of the DSG or ESA

1 - Installing the DSG patch on ESA

Steps to install the DSG patch (ESA_PAP-ALL-64_x86-64_10.2.2+MR.xxxx.DSGUP.4.1.0.xx.pty) on the ESA to extend its Web UI with the DSG menu.

1. Login to the ESA Web UI.

2. Navigate to Settings > System > File Upload.

3. Click Choose File to upload the DSG patch file.

4. Select the file and click Upload.

   The uploaded patch appears on the Web UI.

5. On the ESA CLI Manager, navigate to Administration > Installation and Patches > Patch Management.

6. Enter the root password.

7. Select Install a Patch and press OK.

8. Select the uploaded patch.

9. Select Install.

   The patch is successfully installed.

After the DSG patch is installed, the DSG component is visible on the ESA Web UI. The details of the DSG component can be verified from the About screen on the ESA. To verify the DSG installation, run the following steps.

1. Login to the ESA Web UI.
2. Click the (Information) icon, and then click About.
3. Verify that the DSG version is reflected as DSG 4.1.0.

2 - Configuring the DSG Cluster

Creating a DSG cluster

1. On the DSG Web UI, navigate to System > Trusted Appliances Cluster.

   The Join Cluster screen appears.

2. Click Create a new Cluster to create a DSG cluster.

   The Create Cluster screen appears.

3. Click Create and select a preferred communication method.

4. Click Save to create a cluster.

Adding DSG Nodes to an existing Cluster

This section outlines the steps to add additional DSG nodes to an existing cluster in which a DSG node is already part of the Trusted Appliance Cluster (TAC).

Before you begin

• Ensure that the communication process between the DSG and the ESA is properly established.

  For more information about communcication process, refer to the Set ESA Communication

• Ensure that the DSG patch is applied on the ESA.

  For more information about applying the DSG patch on the ESA, refer to the Installing the DSG patch on ESA

1. On the ESA Web UI, navigate to Cloud Gateway > {DSG build number} > Cluster > Monitoring.

   The Cluster screen appears.

2. Select the Actions drop down list in the Cluster Health pane.

   The following options appear:

   • Apply Patch on Cluster
   • Apply Patch on selected Nodes
   • Change Groups on Entire Cluster
   • Change Groups on Selected Nodes
   • Add Node

3. Perform the following steps to add a node.

   1. Click Add Node.

      The Add new node to cluster screen appears.

   2. Enter the FQDN or IP address of the DSG node to be added in the cluster in the Node IP field.

      Caution: Make sure that the DSG host address matches the Subject Alternative Name(SAN) field or Common Name(CN) in the DSG server certificate.
      For more information about checking the DSG host address, refer to the section Ascertaining the host address in the DSG server certificate

   3. Enter the administrator user name for the ESA node user in the Node User Name field.

   4. Enter the administrator password for the ESA node user in the Node Password field.

   5. Enter the node group name in the Deployment Node Group field.

      Note: If the deployment node group is not specified, by default it will get assigned to the default node group.

   6. Click Submit.

   7. Click Refresh Dropdown > Deploy or Deploy to Node Groups.

      For more information about deploying the configurations to entire cluster or the node groups, refer to the section Deploying the Configurations to Entire Cluster and Deploying the Configurations to Node Groups.

      The node is added to the cluster.

3 - Forward Logs to the Audit Store

After installing or upgrading to the DSG 4.1.0, you must configure the DSG to forward the DSG logs to the Audit Store on the ESA using the steps provided in this section.

Ensure that you have configured the Audit Store component on the ESA. Configuring this component allows the Audit Store to store and report the DSG appliance and audit logs.

For more information about Audit Store, refer to the section Logging Architecture.

Forwarding appliance logs to the Audit Store

The appliance logs (syslog), transaction metrics, error metrics, and usage metrics are forwarded through the td-agent service to the Audit Store on the ESA.

To forward appliance logs to the Audit Store:

1. Login to the DSG CLI Manager.

2. Navigate to Tools > PLUG - Forward logs to Audit Store.

3. Enter the password of the DSG root user and select OK.

4. Enter the username and password of the DSG administrator user and select OK.

5. Select OK .

6. Enter the IP address for the ESA and select OK. You can specify multiple IP addresses separated by comma.

7. Enter y to fetch certificates and select OK.

   These certificates are used to validate and connect to the target node. It is required to authenticate with the Audit Store while forwarding logs to the target node.

   If the certificates already exists on the system, then specify n in this screen.

8. Enter the username and password of the ESA administrator user and select OK.

   The td-agent service is configured to send logs to the Audit Store and the CLI menu appears.

9. Repeat step 1 to step 8 on all the DSG nodes in the cluster.

Forwarding audit logs to the Audit Store

The audit logs include protect, reprotect, unprotect, RPP, and Pycore logs. The audit logs are forwarded through the Log Forwarder service to the Audit Store on the ESA, where they are stored.

To forward audit logs to the Audit Store:

1. Login to the DSG CLI Manager.

2. Navigate to Tools > ESA Communication.

3. Enter the password of the DSG root user and select OK.

4. Select the Logforwarder configuration option. Press Tab to select Set Location Now and press Enter.

5. Select the ESA that you want to connect with, and then press Tab to select OK and press ENTER.

   Note: If you want to enter the ESA details manually, then select the Enter manually option. You will be asked to enter the ESA IP address or hostname when this option is selected.

6. Enter the ESA administrator username and password to establish communication between the ESA and the DSG. Press Tab to select OK and press Enter.

7. Enter the IP address or hostname for the ESA. Press Tab to select OK and press ENTER. You can specify multiple IP addresses separated by comma.

8. After successfully establishing the connection with the ESA, the following Summary dialog box appears. Press Tab to select OK and press Enter.

9. Repeat step 1 to step 8 on all the DSG nodes in the cluster.

4 - Registering the DSG node with ESA

Before you begin

• Ensure that the TAC is created on the ESA.

• Ensure that the ESA communication is completed.

Note: Ensure that only one DSG node is registered with the ESA.

1. On the ESA CLI Manager, navigate to Tools > Register DSG Details.

2. Enter the root password, press Tab to select OK and press Enter.

3. Enter the FQDN of the DSG and enter the DSG administrator credentials in the Username and Password text boxes. Press Tab to select OK and press Enter.

   The DSG TAC Registration screen appears.

4. After successfully registering the DSG with the ESA, the ESA communication is established successfully between the DSG and the ESA.

5 - Updating the host name or domain name of the DSG or ESA

Perform the following steps if the hostname or FQDN of a DSG node is changed.

1. Remove this DSG node from the DSG TAC.

   1. On the DSG Web UI, navigate to System > Trusted Appliances CLuster.

   2. Under the Management drop down, select Leave Cluster.

2. If the custom certificates are used, regenerate these certificates with the updated hostname.
   

3. If the custom certificates are not used, regenerate the certificate using the following command.
   

   python3 -m ksa.cert.manager --installation-apply
   

   Caution: Run this command only on the DSG node where the hostname or FQDN has changed.

4. Ensure that the TAC is created on ESA.

   For more information about creating a TAC, refer to Create a TAC on ESA.

5. Run the ESA communication process.
   For more information, refer to Setting up ESA communication.

6. If the current DSG node was registered with ESA, then re‑register the DSG node because the hostname has been updated.
   For more information, refer to Registering the DSG.

7. If single DSG node was present in the DSG-DSG TAC, then re‑register the DSG node because the hostname has been updated.
   For more information, refer to Registering the DSG.

8. If DSG node is not registered with the ESA and there are multiple DSG nodes present in DSG-DSG TAC, then add the DSG node to the cluster.
   Adding a DSG node

Perform the following steps if the hostname or FQDN of a ESA node is changed.

1. If the custom certificates are used, regenerate these certificates with the updated hostname.
   

2. If the custom certificates are used, then to choose the latest certificates, run the following steps.

   1. On the DSG Web UI, navigate to Settings > Network > Manage Certificates.

   2. Under the Management area, select Change Certificates.

   3. Under CA Certificate(s), unselect the CA certificate from ESA. Click Next.

   4. Under Server Certificates, retain the default settings. Click Next.

   5. Under Client Certificates, ensure that only the latest DSG System client certificate and key is selected.

   6. Click Apply.

3. If the custom certificates are not used, regenerate the certificate using the following command.
   

python3 -m ksa.cert.manager --installation-apply

Caution: Run this command only on the ESA node where the hostname or FQDN has changed.

4. Update the ESA configuration after updating the host name or domain name of the ESA machine.
   For more information, refer to Update the ESA configuration.

5. After updating the certificates, ensure that the set ESA communication steps are performed on each DSG node.
   

   For more information about set ESA communication, refer to Set communication process.

6. Configure the DSG to forward the logs to Insight on the ESA.
   For more information, refer to Forwarding Logs to Insight|