Installing a Generic Post-Configured ES

How to request the creation of a generic post-configured Edge Service in order to scan firewalled and internal assets.

ES Process Post-configured (1)

Request a configuration only Edge Service in Delve

To request the creation of a configuration only URL for a generic Edge Service virtual machine, go to the "Settings" panel and click on the "Edge Services" link in the "System settings" box.

31916053In the "Manage Edge Services" panel displayed on the right, use the "+" button to request the creation of a new Edge Service.

From the window that appears, select the "Virtualization Platform" dropdown and choose the Configuration Only generation.

After a few minutes, the configuration URL will be accessible through the cog icon that appears at the right of the Edge Service name.

9ae7ab7b-359b-4111-8b2f-c70f833bda98

While the configuration URL gets generated, you can immediately start downloading a generic unconfigured Edge Service image that corresponds with your virtualization environment.

Once the cog icon appears, you can click on it to obtain further instructions and copy the Edge Service Configuration URL

download

Once the Edge Service has been created, Delve will wait for a connection from the Edge Service. The Status icon in the "Manage Edge Services" panel will stay orange when it isn't connected.

31916054​_

Download a generic Edge Service image archive

With the configuration URL copied, you can download a generic unconfigured Edge Service image that corresponds with your virtualization environment and extract the archive for installation.

Extract the generic Edge Service image archive to obtain its disk image

Due to the image size and compression type, we recommend using the free program 7-Zip to extract the Edge Service image locally before installation (WinZIP/WinRAR might not work properly).

Set-up & run a new VM that uses this disk image

With the disk image you just extracted, configure your virtualization platform to add a new VM that uses this disk image in conjunction with the appropriate networking configuration.

Make sure the VM can be reached through a local IP (either DHCP or Static) for the next configuration steps.

Use the configuration URL to finalize the Edge Service setup

If your generic Edge Service VM is up and running and has an IP on your local network, it will expose a single-use temporary configuration interface that should be accessible on your local network at the following address:

http://<local-IP-of-the-Edge-Service>/

This temporary configuration interface will be automatically turned OFF as soon as the Edge Service is successfully configured.

If you need to change previous settings, you can always re-download the generic image and request a re-generation of a different configuration URL for the same Edge Service through the "regenerate" icon in Delve.

353a8585-e8be-4dcb-b978-9f8cf5a3294d

 

Once you have accessed the temporary configuration interface, you should be presented with the following screen to select the desired local network configuration for the Edge Service:

Then press "submit" and on the next page, you can now enter the configuration URL you were given in Delve's interface by clicking on the cog icon in your Delve account.

Once you press "submit", the Edge Service will download the custom keys in addition to the configuration it needs to run and will be associated to your Delve account.

Soon after, you will see the message "Client keys were downloaded successfully." and the web interface will be turned off immediately.

If you chose a static IP configuration, the machine will reboot automatically, otherwise for DHCP you can just close the tab.

 

The VM console should now have changed and show connectivity to your Delve account.

It can take a couple of minutes for the status message to change to "connected properly".

Screenshot from 2020-01-07 16-23-29

Resolving potential connectivity issues

Once your Edge Service VM is up and running, it should connect to Delve automatically if your networking has been configured accordingly.

The Edge Service icon visible in Delve will turn green if the connection is successful.

If you run into connectivity issues, you can try and debug following these suggestions.

74.217.31.64/26 is our public IP range from which the Internet scans will originate, and is also the range to which the ES will connect.


It is recommended to whitelist traffic to and from this subnet for your perimeter scans in order to ensure scan results consistency and to allow egress traffic from the ES to this IP range.