Deployment Guides

Deployment Guides#

Replicator virtual appliances can be deployed in local hypervisors, Amazon Web Services (as an AMI via the AWS Marketplace), Google Cloud Platform, Microsoft Azure, or Oracle Cloud Infrastructure. Hardware appliances are also available upon request.

Contact Plixer Technical Support or a local reseller for availability and licensing or visit www.plixer.com to learn more.

Note

Profile data from a Replicator 19.1.1 appliance can be migrated to a different v20.0.2+ instance. Refer to this guide for further details.

On this page:

Virtual appliances

Virtual appliance deployment

Hardware appliance

Hardware appliance deployment

Headless instances

Headless deployments

Basic configuration

Note

The information in this section applies specifically to Replicator 20.0.0+ standalone deployments and “headless” appliances. Refer to the Scrutinizer manual for instructions to enable the local Replicator instance on a Scrutinizer deployment. Contact Plixer Technical Support to learn more about licensing options.
Standalone Replicator deployments can be upgraded by adding a Plixer One/Scrutinizer license under Admin > Plixer > Scrutinizer in the web interface. However, this will require the instance to be provisioned with additional resources as described in these Scrutinizer deployment guides and sizing recommendations.

Virtual appliance deployment#

Basic requirements for virtual appliances:

Component	Recommended (for production environments)
Memory	8 GB
Storage	100 GB 15K RAID 0 or 10 configuration
Processor	2 CPU cores, 2.0+ GHz

Local hypervisors#

Cloud platforms#

Hardware appliance deployment#

Replicator hardware appliances support higher flow rates due to their dedicated resources and are strongly recommended for environments with extremely high flow replication requirements. They are available through Plixer Technical Support.

After receiving your package, follow this guide to deploy the appliance.

Headless deployments#

Additional Replicator instances (for greater replication capacity, high availability, etc.) can be deployed as “headless” appliances to minimize their resource footprint. These deployments do not include the web interface component; they must be registered and managed from a main standalone Replicator instance or a Plixer One/Scrutinizer deployment and cannot be configured independently.

Registering a headless instance#

Before deploying a headless appliance, it must first be registered on the main instance as follows:

Note

Additional Replicator instances must be supported by the current license key. Contact Plixer Technical Support for further details.

Deploying a headless instance#

Follow these steps to deploy a headless Replicator instance after it has been registered:

Basic configuration#

After deploying and starting the appliance, follow the basic configuration steps below to prepare Replicator for use.

Initial setup#

After the Replicator appliance completes its first boot sequence, log in with the credentials plixer:plixer to start the initial setup script:

Provide the following information when prompted by the script:
- Static IP address
- Netmask
- Gateway
- FQDN
- DNS IP address
- NTP server IP address
Enter any additional information requested.
At the end of the script, press Enter to apply the settings and wait for the server to reboot again to apply the settings.

After the final appliance reboot, log in to the web interface at the IP address provided with the default admin:admin credentials and proceed to add a license.

Note

The default password for the web interface admin account can be changed from the Admin > Users & Groups > User Accounts page.
The default self-signed certificate can be replaced with a CA-signed certificate if desired.

Adding a license#

To add/register a Replicator license key, navigate to Admin > Plixer > Replicator Licensing in the web interface after completing the initial appliance setup process.

A license key can be obtained by contacting Plixer Technical Support and providing them with the Machine ID displayed on the licensing page. The key should then be pasted into the License Key field and saved.

Details for the current license (validity, appliance/server counts, etc.) will be displayed on the page after a key has been added.

Note

For AWS AMI deployments, the default password for the web interface admin user is the instance ID of the Replicator instance, which can be copied from the Instance Summary view of the AWS console.
Replicator now shares the same UI with Plixer One/Scrutinizer (requires Scrutinizer 19.7.0+ and Replicator 20.0.0+). The IP address for accessing the web interface is assigned during the initial setup process after the appliance first boots.

Configuring SSL#

SSL support is automatically enabled during the initial setup process for a standalone Replicator instance. A self-signed SSL certificate with default values is created at the same time.

This self-signed certificate can later be replaced with a CA-signed certificate if desired.

Installing a CA-signed SSL certificate#

As long as the system is set to use the self-signed SSL certificate created during the initial setup process, browsers will return an untrusted certificate warning, which users must override to access the web interface.

To avoid this, an SSL certificate that has been signed by an internal or commercial Certificate Authority (CA) will need to be installed.

Generating a custom certificate signing request (CSR)#

SSH to the primary reporter as the plixer user:
```
ssh plixer@PRIMARY_REPORTER_IP
```
[Optional] Create a new directory for the custom CSR, keys, and certificates:
```
sudo mkdir /home/plixer/CustomCerts 
```
This will provide a static location for storing and managing future certificates.
Create a CSR config/details file:
```
sudo touch /home/plixer/CustomCerts/csr_config.txt
```
Tip
- If the details for the CSR do not change from year to year, csr_config.txt can be re-used to create a new CSR when the old certificate expires.
- When generating a new CSR, key, and certificate, including a date in the filename will help identify the correct files in case future changes (e.g., upgrades) overwrite the existing certificate.

Add the details for the CSR to csr_config.txt in the following format:

[req] 
default_bits=2048 
prompt=no 
default_md=sha256 
req_extensions=req_ext 
distinguished_name=dn 

[dn] 
C=US 
ST=Maine 
L=Kennebunk 
O=Plixer, LLC 
OU=IT 
emailAddress=support@plixer.com 
CN=replicator.plxr.local 

[req_ext] 
subjectAltName=@alt_names 

[alt_names] 
DNS.1=replicator.plxr.local 

Note

[alt_names] is now required. To specify multiple Subject Alternative Names (SANs), use one line for each entry, with incrementing DNS numbers (DNS.2=, DNS.3=, etc.).

Generate the new CSR and key:

cd /home/plixer/CustomCerts
sudo openssl req -new -sha256 -nodes -out newRequest.csr -newkey rsa:4096 -keyout newCaKey.key -config csr_config.txt

The custom CSR (/home/plixer/CustomCerts/newRequest.csr) can then be sent to any preferred CA for signing.

Installing the signed certificate#

Important

In some cases, Replicator 19.01 and Scrutinizer 19.5.x deployments will also have localhost.crt and localhost.key files in addition to ca.crt and ca.key. These files were generated during the deployment/upgrade process but should not be used.

The following steps will ensure that the correct certificates are in place and in use:

After receiving the CA-signed certificate, follow these steps to install it:

Copy the new certificate to the /home/plixer/CustomCerts directory (or any temporary directory if CustomCerts was not previously created) on the Replicator server.

Backup the current CA certificate and key:

sudo cp /etc/pki/tls/certs/ca.crt /etc/pki/tls/certs/ca.crt.bak 
sudo cp /etc/pki/tls/private/ca.key /etc/pki/tls/private/ca.key.bak

Move the new certificate to the correct location:

cp /home/plixer/CustomCerts/CA_CERT_FILENAME.crt /etc/pki/tls/certs/ca.crt

Move the new key generated with the CSR to the correct location:
```
sudo cp /home/plixer/CustomCerts/NEW_KEY_FILENAME.key /etc/pki/tls/private/ca.key 
```
If the CustomCerts directory was not created/used, the key can be found in the same directory the CSR was generated in.

Restart the nginx service (httpd on pre-v20.0.0 Replicator or pre-v19.7.0 Scrutinizer deployments):
```
sudo systemctl restart nginx 
```

To verify that the web interface is using the correct SSL certificate, use a browser to navigate to the login page using the FQDN specified in the CA-signed certificate. The browser should no longer return an untrusted certificate warning and the padlock icon in the address bar should be locked instead of open.

Note

The private key may need to be encrypted with the /usr/bin/ask.sh passphrase:

openssl rsa -in server.key -out server.key.new

Non-default CSR configurations#

Certificate signing requests can also be generated with non-default configurations (stronger encryption, no email address, etc.) using the values in the csr_config.txt file in the above instructions.

After the desired configuration has been saved, continue to follow the same instructions to generate the CSR and install the CA-signed certificate.

Deployment Guides

Contents

Deployment Guides#

Virtual appliance deployment#

Local hypervisors#

Cloud platforms#

Hardware appliance deployment#

Headless deployments#

Registering a headless instance#

Deploying a headless instance#

Basic configuration#

Initial setup#

Adding a license#

Configuring SSL#

Installing a CA-signed SSL certificate#

Generating a custom certificate signing request (CSR)#

Installing the signed certificate#

Non-default CSR configurations#