Network Reachability

1. The Access Tier server(s) should be located in your internet-facing DMZ and have a public IP address, so that it can be reached from anywhere on the internet.

2. Configure a public wildcard DNS record that follows your corporate domain name convention to map to the Access Tier’s public IP address
   • A common pattern is to use *.corp.example.com. Then, corporate services can be exposed to your users as website1.corp.example.com, sshserver2.corp.example.com, etc.
   • If you’re deploying multiple Access Tiers across multiple locations, you can further scope the subdomains into *.east.corp.example.com, *.west.corp.example.com, etc.
3. Expose the following ports to the internet so the Access Tier can accept inbound connections from the internet:

4. Ensure the Access Tier can make outbound connections to following addresses:

The netagent binary supports HTTPS proxy settings. If an Egress proxy is configured on the host via the HTTPS_PROXY environment variable, outbound connections from the Access Tier will automatically use it.

5. Ensure your networking policies allow traffic to flow from the Access Tier server to backend machines running the applications and services you need to secure access to.

Supported Operating Systems

The netagent binary, which is the core component of a Access Tier, can be installed on virtual or physical 64-bit Linux servers on most Linux distributions.

Officially Supported: the following distros are officially supported:

• Ubuntu 20.04, 22.04

Support Deprecated: the following Linux distros are no longer supported:

• CentOS 6.x, RHEL 7.x
• Ubuntu 12.04, 14.04, 16.04, 18.04
• Amazon-Linux-2
• CentOS 7.x and RHEL 8.x

Download

Ensure you have assumed root privileges:

user@host$ sudo su -
root@host#

Download and extract the Tarball installer, and cd into the directory:

# create folder for the Tarball
mkdir -p /opt/banyan-packages
cd /opt/banyan-packages

# download and unzip the files
wget https://www.banyanops.com/netting/netagent-2.8.14.tar.gz
tar zxf netagent-2.8.14.tar.gz
cd netagent-2.8.14

Configure

Before you start the netagent binary you need to enter its registration parameters - obtained in Step 1 - in the config.yaml file.

# edit the `config.yaml` file to specify Access Tier registration parameters
#  command_center_url          # Command Center URL, such as https://net.banyanops.com
#  api_key_secret              # API key generated via the Command Center ("access_tier" or "Admin" scope)
#  access_tier_name            # Name of an existing Access Tier in the Command Center
#  access_tier_public_address  # (optional) public address for this Access Tier, such as "corp-dns-cname.example.com"
#  https_proxy                 # (optional) specify to configure HTTPS_PROXY environment variable

vi config.yaml

Install

# double check the configuration params
cat config.yaml

# run the setup script so netagent can be managed using systemctl
./setup-netagent.sh

# manage using systemctl  
sudo systemctl [start|stop|status] netagent

Once the Access Tier is installed, you can check its logs on the host at /var/log/banyan/netagent.log to ensure it is functioning as expected.

Under Networks > Access Tiers > [Your Access Tier] section of the Command Center, select the Test Connection button to verify that your Access Tier is correctly installed.

Access Tier - Test Connection

Instead of manually creating the config.yaml file used to configure the Netagent binary, you can instead set environment variables and call a “bootstrap” script to install Netagent. This method is particularly useful for automated deployments.

# Set env vars to specify Access Tier connectivity parameters
export API_KEY_SECRET=              # API key generated via the Command Center ("access_tier" or "Admin" scope)
export COMMAND_CENTER_URL=          # Command Center URL, such as https://net.banyanops.com
export ACCESS_TIER_NAME=            # Name of an existing Access Tier in the Command Center
export ACCESS_TIER_PUBLIC_ADDRESS=  # (optional) public address for this Access Tier, such as "corp-dns-cname.example.com"
export HTTPS_PROXY=                 # (optional) specify to configure HTTPS_PROXY environment variable

# Run the bootstrap script
./x/bin/configure-bootstrap

Upgrading Netagent is similar to installing it:

Step 1: Download the latest Tarball and extract it

Ensure you have assumed root privileges:

user@host$ sudo su -
root@host#

Download and extract the Tarball installer, and cd into the directory:

# create folder for the Tarball
mkdir -p /opt/banyan-packages
cd /opt/banyan-packages

# download and unzip the files
wget https://www.banyanops.com/netting/netagent-2.8.14.tar.gz
tar zxf netagent-2.8.14.tar.gz
cd netagent-2.8.14

Step 2: Run the setup script

./setup-netagent.sh

The setup script will ask the user whether they wish to overwrite /opt/banyan/config.yaml with the installer’s config.yaml. Enter no to proceed.