Web Application Firewall:Install the WAF agent

Installation environment requirements

Procedure

1. Log on to your on-premises server.

2. Contact WAF technical support in the required DingTalk group to obtain the latest version of vagent and download vagent to your on-premises server.

3. Install vagent.

   1. Run the following command to install vagent on your on-premises server:

      Before you run the command, replace xxxxxxx.xxxxx with the version number of vagent that you downloaded.

      sudo rpm -ivh t-yundun-vagent-xxxxxxx.xxxxx.rpm

   2. After the installation is complete, run the following command to view the version of vagent. Make sure that the latest version of vagent is installed.

      rpm -qa|grep vagent

4. Modify the configuration file of vagent.

   After you install vagent, you must modify the vagent configuration file based on the access mode of Hybrid Cloud WAF to enable communication between vagent and Alibaba Cloud WAF. To modify the vagent configuration file, perform the following steps:

   1. Run the following command to open the vagent configuration file:

      sudo vi /home/admin/vagent/conf/vagent.toml

   2. Press i to enter the insert mode, and modify or add the following information:

      domain="wafopenapi.cn-hangzhou.aliyuncs.com" // The endpoint of Hybrid Cloud WAF. For more information, see the "Valid values of the domain parameter" section of this topic. 
      access_key_id=************* // The AccessKey ID of your Alibaba Cloud account. 
      access_key_secret=*********** // The AccessKey secret of your Alibaba Cloud account. 

      Valid values of the domain parameter

      WAF region	Access mode of Hybrid Cloud WAF	Value of the domain parameter
      Chinese mainland	Internet: If you select this option, the WAF console allows access from the hybrid cloud cluster only over the Internet.	wafopenapi.cn-hangzhou.aliyuncs.com
      	Internal Network: If you select this option, the WAF console allows access from the hybrid cloud cluster only over an Express Connect circuit. You can select this option only if you deployed Express Connect. Note Only virtual private clouds (VPCs) that reside in the following regions are supported: China (Hangzhou), China (Shanghai), and China (Beijing). If your VPC resides in a different region in the Chinese mainland, contact your business manager or architect.	wafopenapi.vpc-proxy.aliyuncs.com
      Outside the Chinese mainland	Internet: If you select this option, the WAF console allows access from the hybrid cloud cluster only over the Internet.	wafopenapi.ap-southeast-1.aliyuncs.com
      	Internal Network: If you select this option, the WAF console allows access from the hybrid cloud cluster only over an Express Connect circuit. You can select this option only if you deployed Express Connect. Note If your VPC resides in a region outside the Chinese mainland, contact your business manager or architect.	wafopenapi-intl.vpc-proxy.aliyuncs.com

   3. Press the Esc key to exit the insert mode.

   4. Enter :wq and press the Enter key to save the configuration file and exit.

5. Start vagent.

   1. Run the following command to start vagent:

      sudo systemctl start vagent

   2. Run the following command to configure automatic startup for vagent:

      sudo systemctl enable vagent

      If the configuration is successful, the system displays the following information:

      Created symlink from /etc/systemd/system/multi-user.target.wants/vagent.service 
      to /usr/lib/systemd/system/vagent.service.

   Other related commands:

   • Stop vagent.

     sudo systemctl stop vagent

   • View the status of vagent.

     sudo systemctl status vagent

   If vagent fails to start, you can use one of the following methods to query the logs of vagent for troubleshooting:

   • Use the systemd tool. Run the following command:

     sudo journalctl -u vagent

   • Use the vagent log file. Run the following command:

     tail /home/admin/vagent/logs/vagent.log

6. Verify that vagent is installed.

   In a Linux operating system, run the following command to check whether vagent is installed:

   ps aux | grep AliYunDunWaf

   If the AliYunDunWaf process appears in the command output, vagent is installed on the on-premises server and is running.

   If the AliYunDunWaf process does not appear in the command output, check whether you correctly performed the installation steps and re-install and start vagent. If vagent still fails to be installed, contact WAF technical support.

What to do next

After you install vagent on your on-premises servers, you can add your on-premises servers to a protection cluster for Hybrid Cloud WAF as protection nodes. For more information, see Deploy a protection cluster for Hybrid Cloud WAF.