System Settings

This section describes the fields in the System Settings tab.

Add/Edit Appliance

Name

The name of this appliance as it will appear in the Admin UI. Ensure each appliance has a unique identity within the Collective and that it can be resolved by all other peers in the Collective (see appliance-to-appliance communications). Please pay careful attention to this when using Controllers where there are specific requirements. For details about certificate renewal, see Managing Appliances > Certificate Renewal.

Settings

Automatic Hostname/IP Assignment

The Hostname/IP will be automatically assigned using the Cloud provider's metadata.

NOTE

This can only be used with AWS, Azure, GCP, and OpenStack.

Appliance Hostname/IP

This is the appliance's hostname - only use fully qualified domain names or IPv4 / IPv6 address.

NOTE

You cannot change the hostname of a Controller which is part of a multi-Controller group.

Interfaces

Configure the network interfaces in the appliance, add one entry for each that you want to use. For instance, if you are using a 4 port NIC, you should configure eth0 to eth3. You can specify IPv4 and IPv6 address format for each interface. When DHCP is used, then some DHCP options are enabled by default.

Configure Interface

When using DHCP - only the first interface configured is allowed to use the DHCP options. This is done to prevent any conflicts that might result. This is likely to mean that you will need to add routes to the default Gateway and local network separately. To find the IP addresses of an appliance that is using DHCP, click on its status in the dashboard.

When using Static addresses - there is the option to associate multiple sequential IP aliases to the SNAT pool. This feature will allow more internal connections to be established than the usual 65535 limit on a single IP address. Refer to Routing Client traffic for more details.

eth0 interface is enabled by default. You might want to add another, if for instance you require a management interface on the appliance.

Routes

Static routes for sending packets to destinations which do not match any of the subnets assigned to any interface above.

Configure Routes

The DHCP configuration (above) may apply the Default Route (if Default Gateway is enabled). Any DHCP route will always be applied first (unless the 60 second time out is reached).

The static routes are applied in the order shown. So starting from A, in order to reach C, which is only reachable from the intermediate network B - you should have the routes in the following order:
route B via A
route C via B
The order can be changed using the up and down arrows shown against each route when you hover over it.

DNS Servers

DNS servers to be used internally by the appliance. Not normally used by , which are configured in Sites>Name Resolvers. However it will be used to resolve Entitlement Actions when:

• DNS has not been configured for the Site.

• A resource name returns a hostname (rather than an IP address), such as with AWS load-balancers.

For more information on how Entitlement Actions are resolved please refer to DNS and name resolving.

NOTE

This might not need to be configured if using the DHCP DNS option in System>Appliances>System Settings>Interfaces

NTP Server

Configure one or more NTP servers for time synchronisation unless included in DHCP options.

NOTE

Accurate time is vital for the correct operation of the system. Always check the Dashboard to make sure there are no NTP errors reported.

Hostname

Hostname or IP address of the NTP server.

Configure NTP Authenticated Time Service

Appgate SDP supports the use of NTP Authenticated Time Service allowing the NTP client to verify that the server is known and trusted.

Symmetric Key Type

Enable NTP authentication by choosing one of the supported algorithms.

Keyno

Enter the key number you have been given; between 1 and 65535.

Key

Enter the key value you have been given; the key is case-sensitive.

SSH Server

Check to allow administrators to sign-in to the appliance using SSH.

Password Authentication

Check to allow administrators to use password authentication for SSH. If disabled, SSH keys must be used to sign-in to the appliance. For details of how to add SSH keys to an appliance please refer to System Security Best Practice.

Port

The default is port 22.

Allowed Sources (through appliance firewall)

To allow inbound traffic, the requesting IP address must match at least one of these source addresses. By default, the list contains 2 entries: address (0.0.0.0) and netmask 0 & address :: and netmask 0.

• If the list is empty, no connections are allowed.

• If an entry contains address, netmask and interface, then both subnet and interface must match.

• If an entry only contains address and netmask, then only subnet needs to match.

• If an entry only contains interface, then only the interface must match.

Example: