Onboard IDC servers without public network access to Security Center through a proxy cluster, 无法访问公网的IDC服务器通过Proxy集群接入云安全中心 - Security Center

If your IDC servers can access the public network, you can install the Security Center agent directly. For servers without public network access, you must set up a proxy cluster first. This topic describes how to use a proxy cluster to onboard IDC servers to Security Center.

Use cases

If your IDC servers can access the public network, you can install the Security Center agent directly without setting up a proxy cluster. For more information, see Install agent.

If your IDC servers cannot access the public network, you must set up a proxy cluster before installing the Security Center agent. The following diagram illustrates this architecture.

Procedure

Follow these steps to onboard IDC servers to Security Center using a proxy cluster:

Set up a proxy cluster in your data center to enable communication between your IDC servers and the public network.
Modify the hosts file or configure local DNS to establish a connection between the proxy cluster and your IDC servers.
Install the Security Center agent on your IDC servers to enable protection from Security Center.

Step 1: Set up a reverse proxy cluster

The Security Center agent uses jsrv.aegis.aliyun.com and update.aegis.aliyun.com to connect to the persistent connection and HTTP proxy servers, respectively. The two proxies must run on different servers, so you need at least two servers for the proxy cluster.

1. Prerequisites

Note

The number of proxy servers depends on the scale of your IDC deployment. For large-scale deployments, use multiple proxy servers for load balancing and high availability.

Prepare at least one server for the persistent connection proxy. Ensure that GCC and zlib-devel are installed on it.
Prepare at least one server for the HTTP proxy.
Download an NGINX version that supports reverse proxy. Click here to download a compatible NGINX version.

2. Configure the persistent connection proxy server

TCP persistent connections use a Layer 4 proxy. After you download NGINX, run the following commands to compile and install it. Include the --with-stream parameter in the configure command.
```
tar -xvf nginx-1.9.0.tar.gz
cd nginx-1.9.0
sudo ./configure --without-http_rewrite_module --with-stream
sudo make
sudo make install
```

Go to the directory that contains the NGINX configuration file and modify the nginx.conf file based on the following sample code:

#user  nobody;
worker_processes  auto;

error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    use     epoll;
    worker_connections  60000;
}


stream {
        server {
            listen 80;
            proxy_timeout 20m;
            proxy_connect_timeout 60s;
            proxy_pass app;
        }

        upstream app {
           server jsrv.aegis.aliyun.com:80;
        }
}

After you modify the configuration file, restart NGINX.

3. Configure the HTTP proxy server

HTTP traffic is also proxied at Layer 4. After you download NGINX, run the following commands to compile and install it. Include the --with-stream parameter in the configure command.
```
tar -xvf nginx-1.9.0.tar.gz
cd nginx-1.9.0
sudo ./configure --without-http_rewrite_module --with-stream
sudo make
sudo make install
```

Go to the directory that contains the NGINX configuration file and modify the nginx.conf file based on the following sample code:

#user  nobody;
worker_processes  auto;

error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    use     epoll;
    worker_connections  60000;
}


stream {
        upstream updatessl {
            server update.aegis.aliyun.com:443;
        }
        server {
            listen 443;
            proxy_connect_timeout 60s;
            proxy_pass updatessl;
        }
        upstream updatehttp {
            server update.aegis.aliyun.com:80;
        }
        server {
            listen 80;
            proxy_connect_timeout 60s;
            proxy_pass updatehttp;
        }
  }

After you modify the configuration file, restart NGINX.

Step 2: Connect the proxy cluster and IDC servers

Connect the proxy cluster to your IDC servers using one of the following methods.

Modify the hosts file on IDC servers

Modify the hosts file on your IDC servers to route Security Center domain name requests to the proxy cluster. Add the following records to the hosts file. Replace xx.xx.xx.xx with the proxy cluster address accessible from your IDC servers.

Important

Bind domain names that contain jsrv to the persistent connection proxy server address. Bind domain names that contain alicdn and update to the HTTP proxy server address.

xx.xx.xx.xx jsrv.aegis.aliyun.com
xx.xx.xx.xx jsrv2.aegis.aliyun.com
xx.xx.xx.xx jsrv3.aegis.aliyun.com
xx.xx.xx.xx jsrv4.aegis.aliyun.com
xx.xx.xx.xx jsrv5.aegis.aliyun.com
xx.xx.xx.xx aegis.alicdn.com
xx.xx.xx.xx update.aegis.aliyun.com
xx.xx.xx.xx update2.aegis.aliyun.com
xx.xx.xx.xx update3.aegis.aliyun.com
xx.xx.xx.xx update4.aegis.aliyun.com
xx.xx.xx.xx update5.aegis.aliyun.com

Modify the local DNS

Modify your local DNS to resolve the jsrv.aegis.aliyun.com and update.aegis.aliyun.com domain names to your proxy cluster's address.

Step 3: Install the Security Center agent

Security Center protects your IDC servers only after the agent is installed. Install the agent on your IDC servers by using an installer (for Windows) or a script command (for Linux). For more information, see Install agent.

Security Center:Onboard IDC servers through a proxy cluster