1 Introduction

This document provides step-by-step instructions on how to deploy a Kemp Virtual LoadMaster using the Azure Resource Manager (ARM) portal. This document is intended to provide an overview of LoadMaster in Azure Government and to introduce some basic aspects of LoadMaster functionality.

1.1 Load Balancing in Microsoft Azure

Before we create a LoadMaster Virtual Machine (VM) with Azure Government, it is important to understand the traffic flow so that VMs in Microsoft Azure can be configured appropriately.

Microsoft Azure Infrastructure as a Service (IaaS) deployments accept traffic only on published endpoints. Any request to access Microsoft Azure workloads passes through the default load balancing layer of the Microsoft Azure platform. The figure below depicts the default deployment without the use of a Kemp LoadMaster in Azure.

Any workload being published consists of an availability set, which represents a single VM or multiple VMs. When a VM is created, if an availability set exists, you have an option to connect the VM to an existing availability set. As more VMs are connected to an existing VM (and thus to an existing availability set), the built-in Microsoft Azure load balancer distributes connections when creating a load-balanced endpoint.

If you wish to use LoadMaster in Azure Government for your deployment, the following steps must be completed:

1. The LoadMaster in Azure Government needs to be deployed first.

2. All the VMs that need to be load balanced using the LoadMaster can then be created and must be connected to the existing LoadMaster VM to create the required grouping.

3. Finally, when creating endpoints, we cannot use the Load-Balance traffic on an existing endpoint option in Azure as we do not want to use the Microsoft Azure Load Balancer to load balance incoming connections.

The figure below depicts the flow when LoadMaster for Azure is deployed:

Notice that VM1, VM2 and VM3 in this example are grouped into a single availability set and the endpoint for published Virtual Services is created only on the LoadMaster VM. By doing this, we receive all load balanced traffic on the LoadMaster VM and the logic of load balancing incoming connections are applied as per the configured Virtual Service on the LoadMaster for a given workload.

Also, notice that VM1, VM2 and VM3 will not have any endpoints as they are not going to be published directly to the internet.

There may be exceptions to this rule for connections that require direct connectivity to the VM such as Remote Desktop Connections to Windows Server OS.

1.2 Known Issues/Limitations

There are a couple of known issues/limitations to be aware of:

• Transparency is not possible in HA setups in Azure environments. For more information and requirements, refer to the Transparency Feature Description document on the Kemp Documentation page.
• Do not downgrade from firmware version 7.2.36 or higher to a version below 7.2.36. If you do this, the LoadMaster becomes inaccessible and you cannot recover it.
• The Virtual Service IP address must be the same IP address as the network interface.
• Alternate default gateway support is not permitted in a cloud environment.

2 Installation Prerequisites

To support LoadMaster in Azure Government, the following are required:

• An active subscription of Microsoft Azure Virtual Machines
• A client computer running Windows 7 or newer
• Internet Explorer 9 or newer, or any modern browser
• A minimum of 2GB RAM on the cloud environment

• If you want to enable 10 Gb throughput for a LoadMaster virtual machine (VM) in Azure, you must select an Azure VM instance type that supports the 10 Gb Mellanox driver. Refer to the Sizes for Linux virtual machines in Azure page for further details.

It is not possible to bond interfaces on Azure LoadMasters.

3 Creating a LoadMaster in Azure Government VM

Please ensure that the prerequisites documented in the earlier section are met.

3.1 Licensing Options

There are four main licensing options when deploying a LoadMaster in Azure Government:

• Hourly consumption
• Bring Your Own License (BYOL)
• Free version
• License Agreement - Service Provided License Agreement (SPLA)/Metered

To use the BYOL option, follow the steps below:

1. Deploy the BYOL - Trial and perpetual license version of the Virtual LoadMaster (follow the steps in the section below to do this).

2. Contact a Kemp representative to get a license.

3. Update the license on your LoadMaster to apply the license change (System Configuration > System Administration > Update License).

4. Kemp recommends rebooting after updating the license.

3.2 Creating a LoadMaster in Azure Government VM

This section provides step-by-step instructions on how to deploy a Kemp Virtual LoadMaster.

The steps in this document reflect the steps in the Azure Marketplace (https://portal.azure.us).

To deploy a new LoadMaster using ARM, follow the steps below:

1. From the Azure Management Portal dashboard, click Create a resource.

2. Enter Kemp in the search bar and press Enter on your keyboard.

3. Select LoadMaster Load Balancer ADC Content Switch.

4. From the drop-down menu, select the desired LoadMaster type and click Create.

5. Under Project details, complete the following fields:.

a) Select the Azure Subscription.

b) Select an existing or create a new Resource group to deploy the LoadMaster into.

6. Under Instance details, complete the following fields:

a) Enter a Virtual machine name for the LoadMaster.

b) Select an Azure Region.

c) Optionally select Availability options if you are deploying a High Availability (HA) pair.

d) Confirm that the desired LoadMaster type is selected in the Image drop-down list.

e) Enable or disable Azure Spot instance.

f) Select the desired Size for the virtual machine.

LoadMaster	Recommended vCPU	Recommended RAM
VLM-500	2 vCPU	4 GiB
VLM-3000	4 vCPU	8 GiB
VLM-MAX	User defined *	User defined *

* VLM-MAX vCPU and RAM allocation can be assigned based on your requirements due to the uncapped performance available.

If you want to enable 10 Gb throughput for a LoadMaster virtual machine (VM) in Azure, you must select an Azure VM instance type that supports the 10 Gb Mellanox driver. For more information, refer to the Enable a 10 Gb Interface (Optional) section.

7. Under Administrator account, complete the following fields:

a) Select the Authentication type (SSH public key or Password).

Kemp recommends using a password, but either way will work fine.

b) Enter a Username.

This username is not used by the LoadMaster for Azure. The default username to access the LoadMaster is bal.

c) Enter a Password for the bal account and confirm the password.

This password is used to access the LoadMaster Web User Interface (WUI).

d) SSH public key source: You can either create a new key pair, use an existing key stored in Azure, or use an existing public key.

It is recommended to store SSH keys in a secure location.

8. Click Next: Disks.

9. Leave the defaults for Disk options and Data disks.

10. Click Next: Networking.

11. Under Network interface, complete the following fields:

a) Select an existing or create a new Virtual network.

b) Select an existing or create a new Subnet.

c) Select an existing or create a new Public IP.

d) Keep the default setting for NIC network security group.

The security group should contain rules for port 8443 (management), 22 (SSH), and any other ports that are needed by the back-end. Do not block port 6973.

e) If the VM size selected supported Accelerated networking, select On.

If you want to enable 10 Gb throughput for a LoadMaster VM in Azure, you must select an Azure VM instance type that supports the 10 Gb Mellanox driver. For more information, refer to the Enable a 10 Gb Interface (Optional) section.

f) If you are deploying a HA pair of LoadMasters, you can select an existing load balancer.

12. Click Next: Management.

13. You can optionally make any necessary changes to the Monitoring, Identity, and Auto-Shutdown sections or leave them as default.

14. Click Next: Advanced.

15. You can optionally make any necessary updates to the Extensions and Custom data sections or leave them as default.

16. You can optionally make any necessary updates to the Tags section or leave the defaults.

17. Click Next: Review + create.

18. You can optionally click Download a template for automation to download an ARM template.

19. Click Create.

If you chose to create a new SSH key pair, you are now prompted to store the private key for the public key you created. Azure does not store the private key. After the SSH key is created, you will not be able to download the private key.

The creation of a VM may take a few minutes or more depending on the Azure portal's responsiveness and other factors. Ensure that the VM is created without any errors. Resolve any errors if needed.

When creating connected VMs, ensure to select the same Virtual network as the LoadMaster.

3.2.1 Enable a 10 Gb Interface (Optional)

Follow one of the two procedures below depending on whether you are adding a single network interface or multiple network interfaces to the LoadMaster.

To enable 10 Gb throughput for a LoadMaster virtual machine (VM) in Azure, you must select an Azure VM instance type that supports the 10 Gb Mellanox driver. Accelerated Networking is supported on most general purpose and compute-optimized instance sizes with two or more vCPUs. These supported series are: D/DSv2 and F/Fs. On instances that support hyperthreading, Accelerated Networking is supported on VM instances with four or more vCPUs. Supported series are: D/Dsv3, E/Esv3, Fsv2, Lsv2, Ms/Mms and Ms/Mmsv2. Refer to the Sizes for Linux virtual machines in Azure page for further details.

Add a Single Interface to the LoadMaster

To enable 10 Gb interfaces on the LoadMaster, perform the following steps:

1. Deploy the LoadMaster.

For the purposes of this document, the Standard DSv2 machine size is used.

When you instantiate a 10 Gb interface, it appears as two interfaces in the LoadMaster Web User Interface (WUI). The two interfaces are related and have the same MAC address. Only the first interface has an IP address. If you want to modify the interface, you must do this on the interface that has the IP address listed.

2. License the LoadMaster.

3. Verify that the Mellanox driver has instantiated correctly by performing the following steps:

a) If the LoadMaster was deployed with a single interface, two interfaces are displayed under System Configuration > Interfaces on the LoadMaster WUI. If only one interface is displayed this means that the Mellanox driver has not instantiated.

b) To instantiate the Mellanox driver, you must shut down the LoadMaster. Navigate to: System Configuration > System Administration > System Reboot and click Shutdown. You must also stop the LoadMaster from the Azure WUI by clicking Stop.

c) To start the LoadMaster on the Azure WUI, click Start.

d) When the LoadMaster boots up, navigate to: System Configuration > Interfaces on the LoadMaster WUI and verify that two interfaces (eth0 and eth1) are displayed under System Configuration > Interfaces.

e) You can also verify that two interfaces are active by checking performing an Ifconfig. To perform an Ifconfig, navigate to System Configuration > Logging Options > System Log Files and click Debug Options. On the Debug Options screen, click Ifconfig. This displays two interfaces with the same hardware address.

Add Multiple Interfaces to the LoadMaster

The Azure WUI does not allow interfaces with accelerated networking to be added. You must add the interface by using the Azure command line interface (CLI) or by using PowerShell.

You must run the command with the LoadMaster in a powered off state.

1. Create the interface using the Azure CLI similarly to the example below:

PS C:\Users\test> az network nic create --resource-group testdoc --name myNic2 --vnet-name myVnet --subnet subnet2 --accelerated-networking true --public-ip-address myPublicIp2 --network-security-group myNetworkSecurityGroup --location eastus

2. When the interface is created, you can add this interface to the LoadMaster when it is in a powered off state. Navigate to the Networking tab of the LoadMaster on the Azure WUI.

3. Click Attach network interface.

4. When the attachment is complete, both interfaces appear on the Azure WUI.

5. Restart the LoadMaster.

6. Verify that the interfaces are displayed under System Configuration > Interfaces on the LoadMaster WUI. The LoadMaster WUI should now display four interfaces.

You can also verify that four interfaces are active by checking performing an Ifconfig. To perform an Ifconfig, navigate to System Configuration > Logging Options > System Log Files and click Debug Options. On the Debug Options screen, click Ifconfig.

Unlike the single interface case where eth0 and eth1 are related, for multiple interfaces, eth0 and eth2 and eth1 and eth3 are related (with the same MAC address). eth0 and eth1 have the IP addresses, the other interfaces without the IP addresses are related by the HWaddr (the MAC address).

3.3 Licensing and Initial Configuration

The following procedure outlines how to set up LoadMaster in Azure Government by ensuring appropriate licensing and basic configuration before you can create a Virtual Service and publish the required workloads:

1. Using a supported web browser, navigate to https://<DNSName>:8443.

Substitute <DNSName> with the DNS name you created in previous section.

2. Take the appropriate steps to acknowledge notification about the self-signed certificate to proceed.

3. You are presented with the End User License Agreement (EULA). You must accept the EULA to proceed further. Click Agree to accept the EULA.

4. You are prompted to enter your Kemp ID and password for licensing. If you do not have a Kemp ID, click the link to create one. Click License Now.

5. When licensing a BYOL LoadMaster, a list of available licenses is provided and/or a temporary trial license. Select the desired license and click Continue.

When licensing a trial, you are presented with a VLM-MAX Enterprise Plus subscription.

6. The LoadMaster requires you to log in before you can proceed any further. The password used to log in will vary depending on whether you choose to use Password authentication or SSH Public Key authentication when creating the VM in the Licensing Options section:

a) Password: Provide the username bal and the password which was set in the Licensing Options section. Click Continue.

b) SSH Public Key: Provide the default username bal and password 1fourall to proceed. You are required to change the default password soon after. Click Continue.

7. You are then presented with the main menu and home screen of the LoadMaster.

8. Before using the LoadMaster, it must be licensed. For instructions on how to license the LoadMaster, refer to the LoadMaster Licensing Feature Description.

9. After licensing, you are given the opportunity to enable Kemp Analytics. With this feature, LoadMaster collects and sends usage data to Kemp for analysis. This data is strictly about product usage, enabled capabilities, and statistics. No sensitive user data, or traffic of any kind is either collected or communicated. To enable this feature, click Enable Kemp Analytics. To proceed without enabling this feature, click Don't Enable Kemp Analytics. For more information, visit https://kemp.ax/KempAnalytics.

Before you can create Virtual Services, you should create VMs that you are load balancing through LoadMaster in Azure Government. Ensure that your Network Security Group (NSG) is set up correctly depending on which services you are load balancing. For instructions on how to create Virtual Services, refer to the Virtual Services and Templates Feature Description.

References

While the instructions above provide a basic overview of how to deploy and configure LoadMaster for Azure, it is not designed to be a comprehensive guide to configure every possible workload. This section identifies some of many guides published on our resources section of our website. Unless otherwise specified, the following documents can be found at http://kemptechnologies.com/documentation.

Kemp LoadMaster, Product Overview

Web User Interface (WUI), Configuration Guide

CLI, Interface Description

RESTful API, Interface Description

Virtual Services and Templates, Feature Description

SubVSs, Feature Description

SSL Accelerated Services, Feature Description

Port Following, Feature Description

Content Rules, Feature Description

ESP, Feature Description

Quickstart Guide

LoadMaster HA for Azure, Installation Guide

Licensing, Feature Description

You can find more documentation here: http://kemptechnologies.com/documentation

You can engage in community discussions on forums at: https://support.kemptechnologies.com/hc/en-us/community/topics

Last Updated Date

This document was last updated on 03 March 2022.