Create AWS Site (Orchestrated)

For the Ingress Gateway (One Interface) option:

• Click Configure.

• Click Add Item.

Note: Either a single master node site or a multi-node site with three (3) master nodes is supported. Therefore, if you are adding more than one node, ensure that there are three (3) master nodes for your site. Use Add Item to add more master nodes.

• From the AWS AZ Name menu, click See Suggestions to select an option that matches the configured AWS Region.

• From the Subnet for local Interface menu, select New Subnet or Existing Subnet ID.

Note: New subnet creation is not supported for a brownfield deployment with an existing VPC selected for the site. In this case, you must provide an existing subnet ID.

• Enter subnet address in IPv4 Subnet, or subnet ID in Existing Subnet ID.

• Confirm subnet is part of the CIDR block set in the previous step.

• Click Apply.

• From the Allowed VIP Port Configuration menu, configure VIP ports for the load balancer to distribute traffic among all nodes in a multi-node site. See the following options:

  • Disable Allowed VIP Port: Ports 80 and 443 will be not allowed.

  • Allow HTTP Port: Allows only port 80.

  • Allow HTTPS Port: Allows only port 443.

  • Allow HTTP & HTTPS Port: Allows only ports 80 and 443. This is populated by default.

  • Ports Allowed on Public: Allows specifying custom ports or port ranges. Enter port or port range in the Port Ranges field.

• In the Advanced Options section, enable the Show Advanced Fields option.

• From the Performance Mode menu, select an option:

  • L7 Enhanced: This option optimizes the site for Layer 7 traffic processing.

  • L3 Enhanced: This option optimizes the site for Layer 3 traffic processing. Only choose this option if the site is used for L3 connectivity and not any L7 features. Select whether to use this feature with or without jumbo frames.

Note: The L3 Enhanced feature works on CE sites with a minimum of 5 cores and a minimum of 3 GB memory.

Jumbo frames (Ethernet frames with a larger payload than the Ethernet standard maximum transmission unit of 1,500 bytes) are supported for L3 Enhanced.

If L3 Enhanced is not enabled on all CE sites in a Site Mesh Group, the MTU configured on the site-to-site tunnel interfaces will not be consistent. Therefore, it is recommended to enable L3-focused performance mode on all sites participating in a Site Mesh Group.

• Click Apply.

For the Ingress/Egress Gateway (Two Interface) option:

• Click Configure.

• Click Add Item.

Note: Either a single master node site or a multi-node site with three (3) master nodes is supported. Therefore, if you are adding more than one node, ensure that there are three (3) master nodes for your site. Use Add Item to add more master nodes.

• From the AWS AZ Name menu, select an option that matches the configured AWS Region.

• From the Workload Subnet menu, select an option:

  • New Subnet: Enter a subnet in the IPv4 Subnet field.

  • Existing Subnet ID: Enter a subnet in the Existing Subnet ID field.

Note: Workload subnet is the network where your application workloads are hosted. For successful routing toward applications running in workload subnet, an inside static route to the workload subnet CIDR needs to be added on the respective site object.

• From the Subnet for Outside Interface menu, select an option:

  • New Subnet: Enter a subnet in the IPv4 Subnet field.

  • Existing Subnet ID: Enter a subnet in the Existing Subnet ID field.

• From the Subnet for Inside Interface menu, specify the subnet for the node on the inside interface. You can select Autogenerate Subnet for automatic assignment or Specify Subnet for a custom IPv4 subnet.

Note: New subnet creation is not supported for a brownfield deployment with an existing VPC selected for the site. In this case, you must provide an existing subnet ID.

• Click Apply.

• In the Site Network Firewall section:

  • Optionally, add a firewall policy by selecting Active Firewall Policies or Active Enhanced Firewall Policies from the Manage Firewall Policy menu. Select an existing firewall policy, or select Add Item to create and apply a firewall policy or Configure for an enhanced version.

Note: See the Create Firewall Policy guide for more information.

• From the Manage Forward Proxy menu, select an option to use the site as a forward proxy for outgoing requests. This configuration allows you to filter Internet-bound outgoing traffic from the site:

  • Disable Forward Proxy if you want clients on-site to directly connect to services on the Internet. All outbound traffic is allowed.

  • Enable Forward Proxy with Allow All Policy if you want all outbound traffic to be allowed and need the CE to proxy the outbound connections and SNAT over the SLO IP.

  • Enable Forward Proxy and Manage Policies if you want the CE to proxy traffic for selected TLS domains or HTTP URLs: Select an existing forward proxy policy or select Add Item to create and apply a forward proxy policy.

Note: See the Forward Proxy Policies guide for more information.

Figure: Network Firewall Configuration for Node

• Enable Show Advanced Fields in the Advanced Options section.

• Select Connect Global Networks from the Select Global Networks to Connect menu, and perform the following:

  • Click Add Item.

  • From the Select Network Connection Type menu, select an option:

    • Select Direct Site Local Inside to a Global Network to allow subnets on the site’s VPC and subnets on other sites on the same global network to be routable to each other without NAT.

    • Select Direct Site Local Outside to a Global Network to allow subnets on the site’s VPC to route to subnets on other sites without NAT, but disable other sites to have a route to the current site’s subnets other than the outside subnet.

  • From the Global Virtual Network menu, select an existing global network or create a new network using Add Item. See the Virtual Networks guide for more information.

  • Click Apply.

• From the Site Mesh Group Connection Type menu, select an option:

  • Select Site Mesh Group Connection via Public IP if other sites in SMG are accessible only over the Internet.

  • Select Site Mesh Group Connection via Private IP if other sites in SMG are accessible over private connectivity.

• From the Select DC Cluster Group menu, select an option to set the site in a DC cluster group:

  • Not a Member of DC Cluster Group: Default option.

  • Member of DC Cluster Group via Outside Network: Select this option if other sites are reachable via SLO interface.

  • Member of DC Cluster Group via Inside Network: Select this option if other sites are reachable via SLI interface.

Note: For more information, see the Configure DC Cluster Group guide.

• From the Manage Static Routes for Inside Network menu, select Manage Static Routes. Click Add Item in the List of Static Routes subsection. Perform one of the following steps:

  • Select Simple Static Route and then enter a static route in the Simple Static Route field. Specify the destination in a.b.c.d/m format. The route is always added on SLI, and the ARP for the destination must resolve from the CE’s SLI.

  • Select Custom Static Route and then click Configure. Perform the following steps:

    • In the Subnets section, click Add Item. Select IPv4 or IPv6 option from the Version menu. Enter a prefix and a prefix length for the subnet. Click Apply. You can use the Add Item option to set more subnets.

    • In the Nexthop section, select a next-hop type from the Type menu. Select IPv4 or IPv6 from the Version menu in the Address subsection. Enter an IP address. From the Network Interface menu, select an option.

    • From the Static Route Labels field, select supported labels using Add Label. You can select more than one from this list.

    • From the Attributes menu, select supported attributes from the Attributes menu. You can select more than one from this list.

    • Click Apply to add the custom route.

    • Click Apply.

• Select Manage Static routes from the Manage Static Routes for Outside Network menu, and click Add Item. Follow the same procedure as that of managing the static routes for inside network.

• From the Allowed VIP Port Configuration for Outside Network menu, configure VIP ports for the load balancer to distribute traffic among all nodes in a multi-node site. See the following options:

  • Disable Allowed VIP Port: Ports 80 and 443 will be not allowed.

  • Allow HTTP Port: Allows only port 80.

  • Allow HTTPS Port: Allows only port 443.

  • Allow HTTP & HTTPS Port: Allows only ports 80 and 443. This is populated by default.

  • Ports Allowed on Public: Allows specifying custom ports or port ranges. Enter port or port range in the Port Ranges field.

• In the Allowed VIP Port Configuration for Inside Network menu, configure VIP ports for the load balancer to distribute traffic among all nodes in a multi-node site. See the following options:

  • Disable Allowed VIP Port: Ports 80 and 443 will be not allowed.

  • Allow HTTP Port: Allows only port 80.

  • Allow HTTPS Port: Allows only port 443.

  • Allow HTTP & HTTPS Port: Allows only ports 80 and 443. This is populated by default.

  • Ports Allowed on Public: Allows specifying custom ports or port ranges. Enter port or port range in the Port Ranges field.

• From the Performance Mode menu, select an option:

  • L7 Enhanced: This option optimizes the site for Layer 7 traffic processing.

  • L3 Enhanced: This option optimizes the site for Layer 3 traffic processing. Only choose this option if the site is used for L3 connectivity and not any L7 features. Select whether to use this feature with or without jumbo frames.

Note: The L3 Enhanced feature works on CE sites with a minimum of 5 cores and a minimum of 3 GB memory.

Jumbo frames (Ethernet frames with a larger payload than the Ethernet standard maximum transmission unit of 1,500 bytes) are supported for L3 Enhanced.

If L3 Enhanced is not enabled on all CE sites in a Site Mesh Group, the MTU configured on the site-to-site tunnel interfaces will not be consistent. Therefore, it is recommended to enable L3-focused performance mode on all sites participating in a Site Mesh Group.

• Click Apply.

For the App Stack Cluster (One Interface) option:

• Click Configure.

• In the App Stack Cluster (One Interface) Nodes in AZ section, click Add Item. Perform the following:

Note: Either a single master node site or a multi-node site with three (3) master nodes is supported. Therefore, if you are adding more than one node, ensure that there are three (3) master nodes for your site. Use Add Item to add more master nodes.

• From the AWS AZ Name menu, select an option that matches the configured AWS Region.

• Select New Subnet or Existing Subnet ID from the Subnet for local Interface menu.

Note: New subnet creation is not supported for a brownfield deployment with an existing VPC selected for the site. In this case, you must provide an existing subnet ID.

• Enter a subnet address in IPv4 Subnet or subnet ID in Existing Subnet ID.

• Click Apply.

• In the Site Network Firewall section:

  • Optionally, add a firewall policy by selecting Active Firewall Policies or Active Enhanced Firewall Policies from the Manage Firewall Policy menu. Select an existing firewall policy, or select Add Item to create and apply a firewall policy or Configure for an enhanced version.

Note: See the Create Firewall Policy guide for more information.

• Optionally, select Enable Forward Proxy with Allow All Policy or Enable Forward Proxy and Manage Policies from the Manage Forward Proxy menu. For the latter option, select an existing forward proxy policy, or select Add Item to create and apply a forward proxy policy.

Note: See the Forward Proxy Policies guide for more information.

• In the Storage Configuration section, from the Select Configuration for Storage Classes menu, select Add Custom Storage Class.

• Click Add Item.

• In the Storage Class Name field, enter a name for the storage class as it will appear in Kubernetes.

• Optionally, enable the Default Storage Class option to make this new storage class the default class for all clusters.

Note: By default, a site deployed in AWS supports Amazon Elastic Block Store (EBS).

• Click Apply.

• In the Advanced Options section, select Connect Global Networks from the Select Global Networks to Connect menu, and perform the following:

  • Click Add Item.

  • From the Select Network Connection Type menu, select an option:

    • Select Direct Site Local Inside to a Global Network to allow subnets on the site’s VPC and subnets on other sites on the same global network to be routable to each other without NAT.

    • Select Direct Site Local Outside to a Global Network to allow subnets on the site’s VPC to route to subnets on other sites without NAT, but disable other sites to have a route to the current site’s subnets other than the outside subnet.

  • From the Global Virtual Network menu, select an existing global network or create a new network using Add Item. See the Virtual Networks guide for more information.

  • Click Apply.

  • To create a new global network, click Add Item from the Global Virtual Network menu:

    • Complete the form information.

    • Click Continue.

    • Click Apply.

  • From the Manage Static Routes for Site Local Network menu, select Manage Static routes. Click Add Item and perform one of the following steps:

    • From the Static Route Config Mode menu, select Simple Static Route. Enter a static route in Simple Static Route field. Specify the destination in a.b.c.d/m format. The route is always added on SLI, and the ARP for the destination must resolve from the CE’s SLI.

    • From the Static Route Config Mode menu, select Custom Static Route. Click Configure. Perform the following steps:

      • In Subnets section, click Add Item. Select IPv4 Subnet or IPv6 Subnet from the Version menu.

      • Enter a prefix and prefix length for your subnet.

      • Click Apply.

      • Use the Add Item option to set more subnets.

    • In Nexthop section, select a next-hop type from the Type menu.

    • Select IPv4 Address or IPv6 Address from the Version menu.

    • Enter an IP address.

    • From the Network Interface menu, select a network interface or select Add Item to create and apply a new network interface.

    • From the Static Route Labels field, select supported labels using Add Label. You can select more than one from this list.

    • From the Attributes menu, select supported attributes. You can select more than one from this list.

    • Click Apply to add the custom route.

    • Click Apply.

• From the Site Mesh Group Connection Type menu, select an option:

  • Select Site Mesh Group Connection via Public IP if other sites in SMG are accessible only over the Internet.

  • Select Site Mesh Group Connection via Private IP if other sites in SMG are accessible over private connectivity.

• From the Select DC Cluster Group menu, select an option to set the site in a DC cluster group:

  • Not a Member of DC Cluster Group: Default option.

  • Member of DC Cluster Group: Select the DC cluster group from the Member of DC Cluster Group via Outside Network menu to connect the site using an outside network.

Note: For more information, see the Configure DC Cluster Group guide.

• From the Allowed VIP Port Configuration menu, configure the VIP ports for the load balancer to distribute traffic among all nodes in a multi-node site. See the following options:

  • Disable Allowed VIP Port: Ports 80 and 443 will be not allowed.

  • Allow HTTP Port: Allows only port 80.

  • Allow HTTPS Port: Allows only port 443.

  • Allow HTTP & HTTPS Port: Allows only ports 80 and 443. This is populated by default.

  • Ports Allowed on Public: Allows specifying custom ports or port ranges. Enter port or port range in the Port Ranges field.

• From the Site Local K8s API access menu, select an option for API access:

  • Select Disable Site Local K8s API access if you do not want to access the k8s API for the site directly and instead are using it as one of the sites in virtual Kubernetes (vk8s) and want to access it via vk8s API only.

  • Select Enable Site Local K8s API access if you want to configure the site for managed K8s and want to access the site’s API endpoint directly.

  • From the Enable Site Local K8s API access menu, select an existing managed K8s cluster name or create a new one by clicking on Add Item. For instructions on K8s cluster creation, see Create K8s Cluster.

• Click Apply.

Note: The Distributed Cloud Platform supports both mutating and validating webhooks for managed K8s. Webhook support can be enabled in the K8s configuration (Manage > Manage K8s > K8s Clusters). For more information, see Create K8s Cluster in the Advanced K8s cluster security settings section.

• From the Services to be blocked on site menu, select the service you want to be blocked/allowed on the CE node. This configuration only blocks access to the services running on the CE nodes and not to the services to which the CE is acting as a load balancer or a default gateway. See the following options:

  • Block DNS, SSH & WebUI services on Site: Default option.

  • Allow access to DNS, SSH & WebUI services on Site: Select this option to allow incoming traffic to these services.

  • Custom Blocked Services Configuration: Select this option and click Add Item to block specific services. Select the service to block (DNS or SSH) on the SLO or SLI network from the Blocked Services Value Type menu.

• To view and change the default settings:

  • Click View Configuration.

  • From the AWS Direct Connect VIF Configuration drop-down menu, select an option for the Virtual Interface (VIF):

    • Hosted VIF mode: With this mode, F5 will provision an AWS Direct Connect Gateway and a Virtual Private Gateway. The hosted VIP you provide will be automatically associated and will set up BGP peering.

    • Standard VIF mode: With this mode, F5 will provision an AWS Direct Connect Gateway and a Virtual Private Gateway, a user-associated VIP, and will set up BGP peering.

  • For the Hosted VIF mode option:

    • Click Add Item.

    • Enter a VIF ID.

    • Select the Region of the VIF.

  • Click Apply.

  • From the Site Registration & Connectivity to RE menu, select how the tunneling will traffic data between site and regional edge (RE). If you select the AWS option, provide the CloudLink ADN name.

  • From the ASN Configuration menu, select whether to assign a custom autonomous system number (ASN) or use the default option.

  • Click Apply.

Click Save and Exit to complete creating the site. The Status field for the site object displays Validation in progress. After validation, the field displays Validation Succeeded.

If you used an existing VPC, Console will validate whether certain existing objects are available and valid. This provides current information to help troubleshoot and fix any potential issues without having to wait until the full site deployment process completes.

After you click Save and Exit, the validation process begins and is displayed as Validation in progress.

If the site deployment validation failed, a message with Validation Failed will be displayed. Click on the tooltip to display a popup message with the error.

If the site deployment validation succeeded, a message with Validation Succeeded will be displayed.