Deploy a G3 Appliance on Azure

The sections below describe how to deploy an Imprivata G3 (third generation) virtual appliance on Microsoft Azure infrastructure services through the Azure Marketplace.

NOTE:

Imprivata recommends that you deploy G4 (fourth generation) appliances on Azure rather than G3 appliances, if possible. For instructions see Deploy G4 Appliances on Azure. You cannot have G4 and G3 appliances on the same enterprise, so if needed, consider migrating your enterprise to G4.

The release introduction history and supported migration path history of G3 appliances and enterprises on Azure is:

  • Imprivata OneSign 23.2 and later releases support enterprise migrations from G3 on Azure or on premises to G4 on Azure. For the procedure for all migrations to a G4 enterprise, see "Migrating to a G4 Enterprise" in the Imprivata Upgrade Portal.

  • OneSign 23.2 and later also support the migration of a hybrid G3 enterprise to a hybrid G4 enterprise. A hybrid G3 enterprise has some appliances on premises and some appliances on Azure, and usually supports a Disaster Recovery configuration. A hybrid G3 enterprise can be migrated to a hybrid G4 enterprise with G4 appliances on premises and on Azure.

  • (OneSign 7.12 was the last major OneSign release in the #.# naming format. Thereafter, OneSign major release numbers are in format YY.#, where YY specifies the last two digits of the year and # specifies the number of the major release of that year.)

  • OneSign 7.10 supports either G3 or G4 appliances on Azure, but not both G3 and G4 appliances in the same enterprise.

  • OneSign 7.4 through 7.10 support G3 appliances on Azure.

NOTE:

You establish a G3 or G4 enterprise on Azure using different private products in the Azure Marketplace, so be sure to select the private product for the enterprise that you want. Both G3 and G4 products were moved in the Azure Marketplace from their previous location in "Private offers" to a new location in a "Private product" category.

This documentation was written applying the following assumptions:

  • You are familiar with Microsoft Azure Portal and Marketplace use and terminology.

  • You are familiar with Microsoft Azure IaaS (Infrastructure as a Service) services.

  • You have an active Azure tenant and subscription.

    NOTE:

    The Imprivata appliance on Azure is available as a private product in the Azure Marketplace. Microsoft blocks access to private products for Azure subscriptions owned by Azure Cloud Solutions Providers (CSPs). Therefore, customers using a CSP subscription must get their own Azure pay as you go tenant and subscription to access and use the Imprivata appliance on Azure.

  • You adopt Microsoft's networking best practices.

  • You are actively engaging with Imprivata service engineers (or other appropriate Imprivata personnel or partners) to ensure deployed resources are successfully connected to existing infrastructure.

Before deploying an appliance on Azure, familiarize yourself with information associated with Microsoft Azure and the Imprivata G3 appliance. Review the following documentation:

You can deploy Imprivata appliances into a variety of Azure hub-and-spoke network topologies. Your Azure network topology may depend on how much of your organization's infrastructure has been migrated from being solely on-premises to being a hybrid mix of on-premises and in-cloud. Four common Azure network topologies into which you can deploy appliances are:

  • Deploy appliances into one spoke virtual network in a single region. The Microsoft Active Directory (AD) is on premises.

  • Deploy appliances into one spoke virtual network in a single region. The AD is in the hub virtual network in Azure.

  • Deploy appliances into more than one spoke virtual network in different regions for enhanced local service, geographic redundancy, or due to latency or volume. The AD is in the hub virtual network.

  • Deploy appliances into the hub virtual network to provide shared services to multiple spoke networks. The AD is in the hub virtual network.

For more information on the hub-and-spoke architecture, see Azure documentation on Hub-and-Spoke.

An Active Directory Domain Controller can be located on-premises or on Azure IaaS. If a Domain Controller is located on-premises, then before deploying an appliance on Azure, consider the following information:

  • An Active Directory Domain Controller should be deployed into the Shared Services subnet in the hub virtual network. This reduces network traffic from the Azure data center to your on-premises network and associated network latency and data egress costs.

  • The appliances are deployed as a spoke off of this central hub network and will depend on the gateway solution for any communication to on-premises resources.

  • The appliance deployment should be targeted to the same geographic region as the hub virtual network to reduce inter-regional latency and data egress costs.

Imprivata G3 appliances deployed on Azure are based on the same software stack as Imprivata on-premises G3 appliances. The appliance is deployed on an Azure F4 virtual machine (VM) having four vCPUs, 8 GB RAM, and 250 GB of storage. The Azure VM manages swap space in an external resource disk.

Imprivata supports automated deployment of only one or two G3 appliances per site on Azure. For redundancy, deploy two appliances. For a Proof of Concept deployment, deploy only one appliance, and if needed you can deploy one additional appliance for testing by using the G3 appliance private product again.

To add a second set of one or two G3 appliances on Azure, you must do the deployment process again and must deploy that second set into a different Azure resource group. Note that you cannot move the second set into the resource group of the first set.

NOTE:

For specific questions about enterprise configuration or additional guidance, contact Imprivata Services or Support.

The number of appliances appropriate for an enterprise depends on numerous factors, including user counts, authentication methods, network topology, site configuration, and failover requirements.

  • In general, using the fewest appliances necessary to meet these requirements is optimal.

  • Only add appliances for redundancy or disaster recovery.

  • Include audit appliances in the active mix of appliances servicing authentication requests.

  • Approximately 11,000 to 14,000 user sessions can be supported per appliance, based on workflows.

When you deploy an appliance to Microsoft Azure, the Azure DHCP service assigns a networking configuration to the appliance.

CAUTION:

Do not change the networking configuration for the appliance (except as specified in the Note below if it applies). If you change network configuration values for the appliance, it may affect your ability to contact and control the virtual machine upon which the appliance runs.

Azure DHCP sets the following networking configuration values for the appliance that you should not change:

  • Host name

  • Domain name

  • IP address

  • Subnet mask

  • Default gateway

  • DNS servers

  • NTP servers

NOTE:

If your Azure subscription uses a “Custom DNS,” meaning it uses your existing DNS infrastructure instead of the Azure DNS, then you must replace the domain name for the appliance after deployment and initialization and during configuration with a setup wizard, as mentioned in Appliance Initialization and Setup.

Gather the required data, consider the additional issues, and perform the tasks described in sections below to locate the Imprivata G3 appliance solution in the Azure Marketplace and perform a deployment.

Collect and record the following Azure and G3 appliance resource data to use in the steps in Deploying the G3 Appliance Solution from the Azure Marketplace:

  • Your Azure subscription ID.

  • An Azure resource group where the Imprivata appliance resources will live. You can use an existing resource group only if it is empty, such that no Azure resources are defined in it. Otherwise, you must create a resource group during the deployment.

  • The Azure region (effectively the Azure Data Center) to which the appliance(s) will be deployed, such as East US, Central US, North Central US, or West Coast US. Appliance region placement is important because it impacts the performance of access to the Imprivata Appliance Console. Please follow Microsoft's recommendations regarding region selection in regard to proximity to your end users and latencies.

  • Decide whether you will create one or two appliances. Most customers deploy two appliances for redundancy. For a Proof of Concept (POC) deployment, deploy one appliance. (You can also add an appliance later to a virtual network and subnet in which an existing appliance resides, but the new appliance must be in a different Azure resource group.)

  • A virtual machine (VM) name for the VM that will host the appliance. The name can be a maximum of 28 characters long. The default value is imp-vm, which you can change. The deployment process appends a zero (0) to the VM name or a one (1) to a second VM name. Consider creating a naming convention for your VM names. The VM name is applied as a prefix to the other resources deployed, for example, the NIC, private IP address, Network Services Group (NSG), and so on.

  • An admin username and password with which one or two VMs will be configured. The same admin username and password is used for two VMs if you deploy two appliances.

  • The virtual network for the appliance(s), if you want to use an existing virtual network instead of accepting the supplied default value.

  • The subnet for the appliance(s) on that virtual network, if you want to use an existing subnet instead of accepting the supplied default value.

Consider these additional issues before you begin deploying the appliance:

  • Establish required predefined resources for backups and archiving, such as file shares and file transfer systems (FTS).

  • Assess Disaster Recovery (DR) region requirements and related network connectivity.

  • An Azure availability set is automatically created for the appliance during the deployment. The availability set effectively splits a hosting virtual machine across server racks for increased reliability. If you plan to deploy two appliances, a different availability set is created for each appliance.

  • Consider deploying your appliance(s) in an Azure availability zone in the Azure region where you will deploy the appliances.

  • You can apply a network security group for an appliance on the hosting virtual machine NIC or subgroup.

To locate and deploy the Imprivata G3 appliance solution from the Azure Marketplace:

  1. In the Azure Portal, search for and select Marketplace.

  2. Select View Private Products.

  3. Select the Imprivata OneSign/ConfirmID Solution (Preview).

    NOTE:

    If you do not see this product, either contact your Imprivata representative or enter your contact information in the Contact Me for Product window and submit that request so that Imprivata can contact you. Imprivata must make the private product visible to you before you can proceed.

    Do not select the Imprivata G4 product.

    When you can view the product and you select it, a page displays describing the solution.

  4. Select Create. The Create Imprivata OneSign/ConfirmID Solution page opens.

  5. On the Basics tab, under Project details, specify or select values for these fields:

    1. Subscription: Select your Azure subscription type, such as Pay-As-You-Go.

    2. Resource group: Either specify an existing, empty resource group that has no Azure resources defined in it, or select Create new and in the pop-up, specify a new resource group.

  6. On the Basics tab, under Instance details, specify or select values for these fields:

    1. Region: Select the Azure region for your appliances, which is often the region in which you are located.

    2. Virtual Machine name: Either leave the default value imp-vm unchanged or optionally change it. The name can have at most 28 characters.

    3. Choose the amount of appliances you want to create: Select to deploy one or two appliances.

    4. Username: Specify an admin username for the VM. This username and its password are required by Azure, but you will not use them after specifying them here.

    5. Password: Specify a password. Password requirements are displayed in a pop-up as you enter or complete the password.

    6. Confirm password: Specify the password again.

    7. Select Next: Virtual Machine Settings.

  7. On the Virtual Machine Settings tab, specify or select values for these fields:

    1. Virtual machine size: Leave the default value unchanged. Only the default size is supported.

    2. Diagnostic storage account: Leave the default value unchanged.

    3. Public IP address for the VM: Select value None.

      CAUTION:

      You should not use a public IP address for an appliance for security reasons. Anyone, including malicious users, who can discover that IP address can use it to access the appliance.

    4. DNS prefix for the public IP address: This field becomes disabled when you specify None for the Public IP address.

  8. On the Virtual Machine Settings tab, under Configure virtual networks, specify or select values for these fields: 

    1. Virtual network: Specify an existing virtual network or accept the supplied default value.

    2. Subnet: Specify an existing subnet or accept the supplied default value.

  9. Click Next: Review + create. Azure reviews the configuration.

  10. If the validation passes, review your selections and then click Create to deploy the solution.

    If the validation fails, view any error messages, resolve any issues, and click Create again.

    The deployment starts and may take 5 to 10 minutes to complete.

As deployment progresses, the system displays status information. You can also confirm that deployment is in progress by clicking on the notification (bell) icon in the upper right corner of the Azure window. You can also select Resource groups in the Azure left frame and see your new Resource Group listed.

When the deployment is done, you can view the results in any of these ways:

  • Click on the notification icon in the Azure window to view the Deployment Succeeded notification.

  • From the Notifications drop-down, you can select Go to resource group and see your deployment with one or two virtual machines, network interfaces (NICs), and disks, plus a network security group, a virtual network, a storage account, and an availability set.

  • From that Resource Group display, you can select the virtual network to see your network settings and IP addresses.

  • In the Resource Group left frame, you can select Diagram to see a diagram view of the network with a subnet, one or two NICs and virtual machines, and a shared network security group.

  • In that network diagram, you can select the network security group to see inbound and outbound ports with allow/deny settings and so on.

After deployment, the appliance powers up automatically and initialization scripts run in the background and do not display progress. The time to complete is approximately 15 minutes.

After that time, in a web browser, enter https://<appliance_IP_address>:81 to complete the setup using the appliance configuration wizard.

If your Azure subscription uses a “Custom DNS,” meaning it uses your existing DNS infrastructure instead of the Azure DNS, then you must replace the domain name for the appliance during configuration with the wizard. In this case Azure DHCP supplies fake domain name reddog.microsoft.com during deployment and you must replace it with your existing domain name. You do this using the Imprivata Appliance Console during the networking step of the configuration setup.

If you deployed two appliances, repeat the processes in this section for the second appliance.

To access the Imprivata appliance functions menu:

  1. In the Azure Portal, on the Virtual Machines window, in the Support + Troubleshooting section, access the Serial Console.

  2. Open the console for the virtual machine hosting the Imprivata appliance.

  3. At the system prompt, enter menu and press Enter. The Imprivata appliance functions menu opens.

The menu options are:

  • Configure Network — Lets you change the default gateway for the appliance. Do not change this value for an appliance on Azure (see the Caution and Note in Network Services Configuration.)

  • Reset SSL — Clears all SSL information.

  • Reset Administrator password for Imprivata Appliance Console — Resets the Administrator password to admin. You cannot reset the Super Administrator password.

  • Modify Password for this menu — Lets you set or clear the password for this menu.

  • Restage — Resets the appliance to factory settings. Contact Imprivata Customer Support for assistance with restaging an appliance.

  • Restart — Restarts the appliance. It is best to restart the appliance by using the Imprivata Appliance Console System page > Operations tab > Reboot/shutdown options > Reboot this appliance, unless the Imprivata Appliance Console is unreachable.

  • Shutdown — Shuts down the appliance. The virtual machine is still deployed on the Azure host.

  • Quit

NOTE:

Imprivata OneSign 23.2 and later releases support enterprise migrations from G3 on premises or on Azure to G4 on Azure, and from a hybrid G3 enterprise to a hybrid G4 enterprise. For the procedure for all migrations to a G4 enterprise, see "Migrating to a G4 Enterprise" in the Imprivata Upgrade Portal.

For an existing Imprivata enterprise that has one or two Imprivata G3 appliances on premises, you can replace one or both of those appliances with Imprivata G3 appliances on Microsoft Azure. To do this, follow the procedure below, which is written using the assumption that you are replacing two existing G3 appliances.

Alternatively, you can add one or two G3 appliances on Azure to your existing on-premises G3 appliances, to create a hybrid on-premises and Azure G3 enterprise. If your on-premises G3 enterprise has more than two appliances and you want to extend it with one or two Azure appliances, you must ensure that your Azure appliances have sufficient CPU counts to support the service levels needed if appliances fail over.

Replacing Your License if You Replace Your On-Premises G3 Appliances

If you want to replace your G3 appliances on premises with G3 appliances on Azure, ask your Imprivata account team to issue a zero dollar replacement order. Imprivata Operations then provides you a temporary license with four serial numbers: two from your current on-premises production appliances, and two replacement serial numbers for your new G3 appliances on Azure. You, or Imprivata Professional Services if you have contracted for them to do this, then perform the procedure below to:

  1. Create your new G3 appliances on Azure.

  2. Add those appliances to your existing G3 enterprise.

  3. Redirect your endpoints to your new Azure appliances.

  4. Remove and then permanently delete your on-premises appliances from your enterprise.

Imprivata Operations then makes permanent the replacement appliance serial numbers by issuing to you a new license that includes only the new serial numbers. Your previous on-premises appliance serial numbers are omitted from that license.

Procedure to Replace G3 Appliances on Premises with G3 Appliances on Azure, or to Create a Hybrid G3 Enterprise

To replace your G3 appliances on premises with G3 appliances on Azure, complete all of the steps in the procedure below. Alternatively, to create a hybrid on-premises and Azure G3 enterprise, stop following the procedure at the end of step 7. The complete procedure through step 11 is written using the assumption that you are replacing two existing on-premises G3 appliances. One step in the procedure includes a 24-hour waiting period, so include that period in your work plan.

Before starting the procedure, read the full section Deploy a G3 Appliance on Azure to prepare for the appliance deployments on Azure.

Here is the procedure:

  1. Deploy two G3 appliances on Azure at the same time by following the procedure in Deploying the G3 Appliance Solution from the Azure Marketplace.

    Note these tips:

    • You will likely need to specify a different subnet for the Azure appliances than are used for the on-premises appliances.

    • Do not complete the setup yet of each Azure appliance using the appliance configuration setup wizard.

  2. Authorize the first Azure appliance by following the procedure in Step 1: Authorize the New Appliance, which appears in online help topic Adding an Appliance to the Enterprise. (You only do Step 1 in that topic.)

    Note these tips:

    • Use an on-premises appliance that is also an audit server to authorize the Azure appliances.

    • Specify the existing site that includes the two physical appliances.

    • Make note of the Azure appliance's serial number and connection password as you specify them.

    • Specify that each of the new appliances will be audit servers.

    • Do not change the optional field values (networking configuration). They were set by the Azure DHCP service during appliance deployment, and the authorization process may overwrite some of those values with values populated from the authorizing appliance.

  3. Authorize the second Azure appliance by repeating step 2.

  4. Run the appliance configuration setup wizard for the first Azure appliance, by following the instructions in Appliance Initialization and Setup.

    Note these tips:

    • You may need to replace the domain name for the appliance, as explained in the linked section.

    • An appliance's serial number and connection password that you use in the setup wizard must match the values you used earlier when authorizing the appliance. Otherwise, the new appliance will get an authorization failed message when trying to join the enterprise in the wizard process.

  5. Monitor the database replication process for the first appliance to ensure it has synced up with the enterprise.

    In the Imprivata Admin Console, select the gear icon > Sites. The status for the site containing the new appliance should be displayed as Up. After adding a new appliance, site status can be in a warning state until the new appliance has time to automatically sync up its database.

  6. Run the appliance configuration setup wizard for the second Azure appliance by repeating step 4 for the second Azure appliance.

    When you are done with this step, you have a hybrid, four-appliance G3 enterprise, with two on-premises G3 appliances and two G3 appliances on Azure.

  7. Wait for at least 24 hours for all Imprivata endpoint agents to recognize the new appliance topology. The time needed depends on the size of your environment.

     

    To keep your hybrid enterprise, stop following this procedure here.

    To replace your on-premises G3 appliances with your new Azure G3 appliances, complete these additional steps:

  8. Update all endpoints to point all Imprivata endpoint agents to the Azure appliances.

    Methods to redirect your endpoints to the Azure appliances vary by endpoint type. A representative example is provided here for Windows endpoints:

    Update the IPTXPrimServer registry key in the Windows endpoints to be redirected. Typical methods to do this include using a Microsoft Windows Group Policy Object (GPO) or a software distribution tool such as Microsoft Endpoint Manager (formerly called Microsoft System Center Configuration Manager, SCCM) or Ivanti Unified Endpoint Manager (formerly called LANDESK).

    The registry key is located at:

    HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent

    Change only the DNS hostname part of the URL for the Azure appliance to be used. For example, if the existing registry key value is:

    https://ova1.myhealth.edu/sso/servlet/messagerouter

    then change that value to something like this:

    https://new-ova1.myhealth.edu/sso/servlet/messagerouter

  9. Remove the on-premises appliances from the enterprise using the instructions in Removing or Deleting an Appliance from the Enterprise.

    When you are done with this step, you have a two appliance G3 enterprise on Azure.

  10. Confirm that users can log in using the Imprivata endpoint agents pointed to the new appliances.

  11. Permanently delete the on-premises appliances from the enterprise using the instructions in Removing or Deleting an Appliance from the Enterprise.