PowerShell deployment to Google Cloud Platform

PowerShell commands are used to deploy Unified Access Gateway 2103 or later to Compute Engine within Google Cloud Platform.

Procedure

1. Prepare the client machine
2. Prepare the Google Cloud Platform environment
3. Upload the Unified Access Gateway Image to Google Cloud Platform
4. Prepare an .ini file for deploying to Google Cloud Platform
5. Deploy to Compute Engine

Step 1: Prepare the client machine for PowerShell deployment

Install the Google Cloud utilities on Client machine.

1. Install gsutil. For instructions about installing the gsutil tool on Windows and Ubuntu, see Installing gsutil as part of the Google Cloud CLI on Google Cloud Documentation.

2. For Windows machine, run the following PowerShell command with administrative rights.

   Install-Package 7Zip4PowerShell
   

Recommended Operating Systems for running the PowerShell deployment script

The following table lists the operating systems from which PowerShell based Unified Access Gateway deployment to Google Cloud Platform can be executed. This does not refer to the operating system of the Unified Access Gateway appliance itself.

Step 2: Prepare the Google Cloud Platform environment

Use a Google Cloud project. This project must be configured with VPC networks, the corresponding subnet networks, and firewall rules. For more information, see Google Cloud Documentation.

Prerequisites

• Ensure that you are aware of the Google Cloud Platform concepts.
• Ensure that you have the necessary permissions to create or modify resources such as images, VPC network, subnet, firewall rules, and so on, in the Google Cloud project.
• Compute Engine API must be enabled.

Procedure

1. Use a Google Cloud project.

   Option	Action
   New project	In the Google Cloud Console, navigate to the Project Selector page. Create a Google Cloud project.
   Existing project	If a project is already available and active, you can use the existing project.

2. Create a Virtual Private Cloud (VPC) network for each NIC.

   Each NIC on the Unified Access Gateway uses a unique VPC network and a subnet within that network.

   If you choose not to create a VPC network, only a single NIC Unified Access Gateway can be deployed. The Unified Access Gateway appliance, when deployed in the Compute Engine uses the default VPC network available in the Google Cloud Platform.

   For example, in the following image, two VPC networks, uag-front-vpc and uag-back-vpc, are created in the Google Cloud Console. These VPC networks have uag-front-network and uag-back-network as subnets respectively. A Unified Access Gateway two NIC appliance can be deployed to use these two subnets for front-end Internet facing and a separate subnet network for back-end connections.

   

   Note: You can also configure Unified Access Gateway with shared VPC networks. In such case, Unified Access Gateway instances deployed on the service project are attached to the shared VPC networks created and managed on the host project. Each network interface (NIC) on Unified Access Gateway can be configured independently to use either shared VPC network or local VPC network. For more information, see Configuring Shared VPC on Google Cloud documentation.

3. Make a note of the subnet name created.

   The subnet name within a VPC network is used in the .ini file while deploying Unified Access Gateway by using PowerShell.

4. To allow TCP and UDP port access to Unified Access Gateway appliances in the Internet accessible VPC, create the required number of firewall entries.

   Important: SSH remote access to Unified Access Gateway on TCP port 22 from the Internet must be carefully restricted on the firewall. If SSH access is needed, the firewall rule must allow this access from a specific source IP address only or from a jump box virtual machine in the cloud from which access can be controlled.

   For example, in the following Google Cloud Console image, a firewall rule named uag-horizon-protocols is created in the internet facing VPC network uag-front-vpc. This firewall rule applies to all the instances connected to uag-front-vpc network and allows inbound TCP and UDP traffic on specified ports from the public internet.

   

Step 3: Upload the Unified Access Gateway Image to Google Cloud Platform

To deploy a Unified Access Gateway instance to the Compute Engine, you must upload a Unified Access Gateway appliance disk image to the Google Cloud Platform.

1. From the Omnissa Customer Connect, go to Unified Access Gateway (UAG) for vSphere, AWS and Google Cloud file and click DOWNLOAD NOW.
   A zip file euc-unified-access-gateway-x.x.x.xxxxxxxxx.ova is downloaded on your local machine.

2. Open a PowerShell command window and run the following command to extract the .vmdk file from the previously downloaded .ova file.

   • ova-filename is the .ova image file, which is downloaded from Customer Connect.
   • target-location is the location to which the .vmdk file is extracted.

   Windows	Ubuntu
   expand-7zip ova-filename target-location For example, euc-unified-access-gateway-22.12.0.0-42741890_OVF10.ova is the downloaded file, where 22-12 is the version number and 42741890 is the build number. To extract the .vmdk file to C:\temp, run the following command: expand-7zip C:\temp\euc-unified-access-gateway-22.12.0.0-42741890_OVF10.ova C:\temp\	tar -xvf ova-filename For example, tar -xvf euc-unified-access-gateway-22.12.0.0-42741890_OVF10.ova

3. Set the following variables.

   • $gcImageFile is the filename of the .vmdk file extracted in step 2.
   • $gcImageFolder is the folder path of the .vmdk file. For example:

   
   $gcImageFolder="C:\temp"
   $gcImageFile="euc-unified-access-gateway-22.12.0.0-42741890-system.vmdk"
   $gcBucket="uag-appliance-images"
   $gcImageName=$gcImageFile.Replace("-system.vmdk","").Replace(".", "-")
   gcloud auth login
   gcloud config set project "my-project"
   
   

4. Create a Google Cloud storage bucket.

   Note: You can also deploy Unified Access Gateway with compute image hosted on another Google Cloud project. In such case, specify the compute image name ($gcImageName) and the hosting Project ID during Unified Access Gateway deployment.

   Run this command to create storage bucket in the same project.

   gsutil mb -l us-east1 gs://$gcBucket
   

   Run this command to create storage bucket in a differnt project.

   gsutil mb -l us-east1 gs://$gcBucket -p my-image-hosting-project
   

5. Upload the .vmdk image to the Google Cloud storage bucket by using the following command:

   gsutil cp $gcImageFolder\$gcImageFile gs://$gcBucket
   

6. Create the appliance image in the Compute Engine from the uploaded .vmdk.

   Run this command to import image in the same project.

   gcloud compute images import $gcImageName --source-file gs://$gcBucket/$gcImageFile --data-disk
   

   Run this command to import image in a different project.

   gcloud compute images import $gcImageName --source-file gs://$gcBucket/$gcImageFile --data-disk --project my-image-hosting-project
   

   Note: When you import a compute image, you can specify the subnet to be used for the temporary VMs created by the import tool. Use the flag --subnet as shown in the following example.

   gcloud compute images import $gcImageName --source-file gs://$gcBucket/$gcImageFile --data-disk --subnet default
   

   For more information about these commands, see Google Cloud SDK documentation.

   Considering the example mentioned in the previous steps, the appliance image created in the Compute Engine is euc-unified-access-gateway-22-12-0-0-42741890 where 22-12 is the version number and 42741890 is the build number.

Step 4: Prepare an .ini file for deploying to Google Cloud Platform

The Compute Engine PowerShell deployment script for Unified Access Gateway reads all configuration settings from a .ini configuration file. This section describes the .ini file format and shows examples of the settings that can be used for the deployment.

Most sections of the .ini file are identical to the standard .ini settings for Unified Access Gateway as supported for all the other hypervisor deployments. For more information about the .ini file, see the Using PowerShell to Deploy the Unified Access Gateway Appliance section.

1. Configure the required settings in the [General] section. See PowerShell deployment parameters.

   Note: For Google Cloud Platform deployments, the following settings in the [General] section are not used:

   • diskMode
   • ds
   • folder
   • netInternet
   • netManagementNetwork
   • netmask0, netmask1, netmask2
   • netBackendNetwork
   • source
   • target
   • ip0, defaultGateway, netmask0, ipmode0
   • v6ip0, v6ipprefix0, v6DefaultGateway

2. In the .ini file, add a new group, [GoogleCloud] and the necessary settings specific to Google Cloud Platform.

The following table lists the settings (Value Name) that are required for the Google Cloud Platform deployment.

sharedVpcForSubnet0=true
sharedVpcForSubnet1=false
sharedVpcForSubnet2=false

Example 1: INI File Definition for deploying Unified Access Gateway to Google Cloud Platform

[General]
name=uag1
deploymentOption=onenic
sshEnabled=true

[GoogleCloud]
projectId=my-project
imageName=euc-unified-access-gateway-22-12-0-0-42741890
zone=us-central1-a
subnet0=uag-front-network

[Horizon]
proxyDestinationUrl=https://myhorizon.example.com

Example 2: INI File Definition for deploying Unified Access Gateway to Google Cloud Platform

[General]
name=uag2
deploymentOption=twonic
sshEnabled=true
routes1=10.20.0.0/16 10.2.0.1

[GoogleCloud]
projectId=my-project
imageName=euc-unified-access-gateway-22-12-0-0-42741890
imageProjectId=my-image-hosting-project
zone=us-central1-a
vpcHostProjectId=my-sharedvpc-host-project
subnet0=uag-front-network
sharedVpcForSubnet0=true
subnet1=uag-back-network
sharedVpcForSubnet1=false

[Horizon]
proxyDestinationUrl=https://myhorizon.example.com

Step 5: Deploy to Compute Engine

You can deploy Unified Access Gateway to Compute Engine by using the uagdeploygce.ps1 PowerShell command. This command takes all configuration settings from an .ini file and deploys an instance of Unified Access Gateway.

If any existing instance in the Compute Engine has the same name as specified in the General section of the .ini file, the PowerShell script removes the existing instance during deployment and creates a new Unified Access Gateway instance with the same name. This replacement helps while upgrading a Unified Access Gateway appliance or to redeploy the appliance with updated settings.

1. From the Omnissa Customer Connect, go to Unified Access Gateway (UAG) PowerShell Scripts file and click DOWNLOAD NOW.
   A zip file uagdeploy-xx.xx.x.x-xxxxxxxx is downloaded on your local machine.

2. Extract the files from the zip file. Ensure that the following PowerShell scripts are available on your machine.
   uagdeploygce.ps1 and uagdeploy.psm1 on your Windows machine.

3. Start a PowerShell command window and change the directory to the folder that contains the downloaded scripts.

4. To deploy Unified Access Gateway to the Compute Engine, perform the following:

   1. If you are upgrading to a later version of Unified Access Gateway, edit the .ini file to update the imageName setting to the new image name which is uploaded to the Compute Engine in one of the previous tasks.

      All other configuration parameters in the .ini file must remain the same.

   2. Run the following command depending on whether you choose the interactive or non-interactive mode:

      For more information about the root user and admin password requirements, see Password requirements.

      Mode	Command
      Interactive	.\uagdeploygce.ps1 <ini-filename>.ini <ini-filename> is the name of the .ini file prepared in the earlier tasks. For example: .\uagdeploygce.ps1 uag1.ini uag1.ini is the filename used in the earlier tasks.
      Non-Interactive	.\uagdeploygce.ps1 <ini-filename> <root-pwd> <admin-pwd> <ceip-yes-no> .\uagdeploygce.ps1 <ini-filename> <secret> <admin-pwd> yes <ini-filename> is the name of the .ini file prepared in the earlier tasks. If passwords are specified on the command line as shown in the command, use the Clear-History PowerShell command after deploying the Unified Access Gateway.

      If you run the uagdeploygce.ps1 command again, the previous Unified Access Gateway instance and associated resources are deleted and replaced with a new instance having the same name. The new .ini file must have all the required configuration parameters so that the Unified Access Gateway appliance is ready for production on first boot.

What to do next

After Unified Access Gateway is deployed to Compute Engine and all settings are applied, the metadata used to apply the Unified Access Gateway appliance's configuration settings in Google Cloud must be removed. To remove the metadata, use the following commands as shown in the example:

$uagName=uag1
$zone=us-central1-a
$projectId=my-project
gcloud compute instances remove-metadata $uagName --zone=$zone --project $projectId --keys "user-data"