This guide is intended for IT infrastructure architects and DevOps professionals responsible for deploying or enabling Web Access in the AWS public cloud.
This guide applies to Nasuni Edge Appliance version 10.1 and later.
Introduction
To enable access to Web Access through the public internet, assign the Edge Appliance a static Public IP address in AWS. A security group restricts external access to the Edge Appliance to ports 443 (HTTPS) and 80 (HTTP).
Web Access can also be deployed behind an application load balancer (ALB). An ALB offloads encryption/decryption, simplifies SSL/TLS certificate management, and integrates with other services for enhanced security and performance. For more information on setting up an AWS ALB, see Deploying Web Access with AWS Application Load Balancer.
Prerequisites
An Edge Appliance must be deployed to AWS and joined to the NMC.
A public FQDN for your instance and corresponding SSL/TLS server certificate.
Access to DNS to set up the FQDN.
Creating an Elastic IP
Elastic IPs are the only way to assign a public IP address in AWS. If an elastic IP address is not used, the public IP address changes whenever the instance is powered off. The public FQDN also changes with the IP address, preventing CNAME records from resolving.
To create an Elastic IP, follow these steps:
Log in to AWS Console.
Navigate to EC2 → Elastic IPs → Allocate Elastic IP address.
For the Public IPv4 address pool, select Amazon’s pool of IPv4 addresses (or choose an alternate pool if appropriate for your organization).
For the Network border group, select the region the instance is to run in.
To allocate the elastic IP address, click Allocate.
After the IP is allocated, select the new IP address and choose Actions → Associate Elastic IP address.
Select the Instance, then choose the instance running NEA Web Access.
Click Associate.
Navigate to EC2 → Instances.
On the Instances page, choose the associated instance.
The Public IP address displays under Details.
Security Groups
To secure the instance and enable public access to the Web Access console, assign a security group that allows HTTP and HTTPS traffic.
Creating a security Group
To create a security group, follow these steps:
Navigate to EC2 → Security Groups → Create security group. The Create security group page appears.
Enter a Security Group Name and Description, such as “Nasuni WebAccess”.
For the VPC, select the VPC with the running instance.
Configure Inbound rules by following these steps:
Click Add rule.
From the Type drop-down list, select HTTPS.
From the Source drop-down list, select Anywhere IPv4.
Click Add rule.
From the Type drop-down list, select HTTP.
From the Source drop-down list, select Anywhere IPv4.
Note: Adding HTTP does not enable HTTP access. It enables browser redirection from HTTP to HTTPS, which can be convenient for end users.
Configure Outbound rules.
One of the security groups assigned to the instance must be configured to permit outbound access. Refer to Firewall and Port Requirements for a restricted list of FQDNs.
Click Create security group.
Assigning the security group
To assign the security group, follow these steps:
Select the Instance and right-click to open the options panel.
Choose Security → Change Security Groups.
Note: An instance can have multiple security groups. It is recommended to place security settings for public access in one group and security settings for administration or SMB/NFS connections in another. However, all settings can be grouped together.
Select the group created in the previous step and click Add security group.
Click Save these changes.
Testing
Navigating to the public IP address of the NEA should now load the Web Access interface, after displaying a certificate warning. (This assumes that a share has been enabled for Web Access on the appliance.)
SSL Certificate and FQDN
After the Web Access page loads, a signed certificate for the desired FQDN must be installed on the appliance, and the FQDN must be registered with the customer’s DNS provider.
For more information on SSL Setup, see Generating SSL CA-signed or self-signed server certificate.