Network Reachability

1. The Access Tier server(s) should be located in your internet-facing DMZ and have a public IP address, so that it can be reached from anywhere on the internet.

2. Configure a public wildcard DNS record that follows your corporate domain name convention to map to the Access Tier’s public IP address
   • A common pattern is to use *.corp.example.com. Then, corporate services can be exposed to your users as website1.corp.example.com, sshserver2.corp.example.com, etc.
   • If you’re deploying multiple Access Tiers across multiple locations, you can further scope the subdomains into *.east.corp.example.com, *.west.corp.example.com, etc.
3. Expose the following ports to the internet so the Access Tier can accept inbound connections from the internet:

4. Ensure the Access Tier can make outbound connections to following addresses:

The netagent binary supports HTTPS proxy settings. If an Egress proxy is configured on the host via the HTTPS_PROXY environment variable, outbound connections from the Access Tier will automatically use it.

5. Ensure your networking policies allow traffic to flow from the Access Tier server to backend machines running the applications and services you need to secure access to.

Set Environment Variables

Set the environment variables on the Linux server on which you’ll be installing the container.

# Set env vars to specify Access Tier connectivity parameters
export API_KEY_SECRET=              # API key generated via the Command Center ("access_tier" or "Admin" scope)
export COMMAND_CENTER_URL=          # Command Center URL, such as https://net.banyanops.com
export ACCESS_TIER_NAME=            # Display name of an existing Access Tier in the Command Center
export ACCESS_TIER_PUBLIC_ADDRESS=  # (optional) public address for this Access Tier, such as "corp-dns-cname.example.com"
export HTTPS_PROXY=                 # (optional) specify to configure HTTPS_PROXY environment variable

Install

Note: If you’re using optional environment variables ACCESS_TIER_PUBLIC_ADDRESS or HTTPS_PROXY, append it to the end of the third line below.

docker run --privileged --cap-add=NET_ADMIN \
	   -v /dev:/dev -v /lib/modules:/lib/modules \
	   -e API_KEY_SECRET -e COMMAND_CENTER_URL -e ACCESS_TIER_NAME \
	   -p 80:80/tcp -p 443:443/tcp -p 8443:8443/tcp -p 51820:51820/udp \
	   -d gcr.io/banyan-pub/netagent:2.8.13

If your server needs root privilege to run docker via the sudo command, remember to add -E so your environment variables get passed through. Your command will then look like sudo -E docker run ...

Cloud Secure Edge’s (CSE) Netagent binary leverages Linux kernel networking, including IPTables and WireGuard. The Docker container needs to be run in privileged mode with the NET_ADMIN capability to configure networking correctly.

Once the Access Tier is installed, you can check its logs using docker logs to ensure it is functioning as expected.

Under Networks > Access Tiers > [Your Access Tier] section of the Command Center, select the Test Connection button to verify that your Access Tier is correctly installed.

Access Tier - Test Connection

Upgrading Netagent follows a very similar process to installing it. Stop the running container, and start up a new one with the latest version of Netagent.

Note: If you’re using optional environment variables ACCESS_TIER_PUBLIC_ADDRESS or HTTPS_PROXY, append it to the end of the third line below.

docker run --privileged --cap-add=NET_ADMIN \
	   -v /dev:/dev -v /lib/modules:/lib/modules \
	   -e API_KEY_SECRET -e COMMAND_CENTER_URL -e ACCESS_TIER_NAME \
	   -p 80:80/tcp -p 443:443/tcp -p 8443:8443/tcp -p 51820:51820/udp \
	   -d gcr.io/banyan-pub/netagent:2.8.13