Skip to content

Prerequisites

Virtualization environment

The appliance is provided in OVA format for VMware and as a complete virtual appliance (VHDX) for Hyper-V — see importing the virtual appliance.

The product performs no virtualization of its own, so nested virtualization does not need to be enabled on the virtual machine.

CPU

A CPU with 4 cores will cover most use cases.

RAM

Warning!

The values below are indicative only: many variables affect RAM consumption, starting with the product features actually used.

RAM consumption depends on the number of simultaneous sessions and on the types of applications used:

  • Between 1 and 5 simultaneous users: 2 GB of RAM minimum, 4 GB recommended.
  • Between 5 and 20 simultaneous users: 4 GB of RAM minimum.
  • For 20 or more simultaneous users: 8 GB of RAM.

Note that an agentless RDP or VNC application can consume up to 400 MB per application launched. Where such applications are used extensively, monitor RAM usage in order to size it accordingly.

Disk

The appliance ships already partitioned: there is nothing to lay out. What grows over time is the recording storage, in the following directories:

  • /var/log/: system logs.
  • /var/lib/ipdiva/carerecord/recording/: archives currently being recorded (temporary storage).
  • /var/lib/ipdiva/carerecord/archives/: graphic archives.
  • /var/ipdiva/care/sshrecord/: non-graphic (SSH) archives.

Size the space allocated to /var according to your own usage: graphic archives consume 1 to 2 MB per minute of recording, SSH archives less than 100 KB per minute. Beyond that, archive storage can be outsourced.

Network

The Edge Gateway needs one IP address. It is usually placed in the LAN, in VLANs that let it reach the target resources.

Flows towards your platform

Destination Destination port Comments
<tenant>.cyberelements.io TCP 443 Pairing and web communications with your platform.
SSL Router of your platform TCP 443 TLSv1.3 tunnel carrying the product's communications. The address is shown in the administration console once the Edge Gateway has been declared.

Outbound flows

Destination Destination port Comments
Debian repositories TCP 80 Required to keep the system up to date. The appliances use ftp.fr.debian.org and security.debian.org.
DNS server UDP 53 Required for name resolution. Optional if a DNS server is available on the LAN.
NTP time server UDP 123 Optional if the clock is synchronized against a LAN server. By default the Debian pools are used.
SMS provider TCP 443 (Optional) Connection to the APIs of the supported SMS providers.

Flows towards your resources

Destination Destination port Comments
DNS server UDP 53 Name resolution.
LDAP or AD servers TCP 389 or 636 Connection to an LDAP or Active Directory directory.
AD servers TCP 139 and 445 AD account password rotation, only when rotation over LDAPS is not possible.
RDP servers TCP/UDP 3389 Connection to RDP servers (standard port).
SSH servers TCP 22 Connection to SSH servers (standard port).
VNC servers TCP 5900 Connection to VNC servers (standard port).
Web servers TCP 80 or 443 Connection to web servers.
Citrix Storefront servers TCP 443 Connection to Citrix Storefront servers.
Citrix application servers TCP 1494 Launching an application or a desktop with the ICA client.
File servers TCP 139 and 445 Connection to file servers.
Database server TCP 1433, 5432 or a custom port Required to outsource the vault database to the LAN.
RDP servers TCP 139 and 445 Deployment of the recording agent from the administration console.

Some flows go the other way, towards the Edge Gateway:

Source Destination port Comments
Client workstation TCP 3389, or the port defined by the administrator Direct RDP or SSH access.
RDP servers TCP 8443 Upload of session recordings by the recording agent.
Administrator workstation TCP 22 SSH connection to the Edge Gateway.

Certificates

Pairing by token provisions the certificates the Edge Gateway needs, including the one used by the recording service: there is nothing to prepare in the standard case.

A certificate is only required if the recording service has to be configured manually. It must then comply with the following constraints:

The recording service certificate must comply with the following constraints for its attributes:

  • The certificate's validity period must not exceed 1095 days (3 years).
  • The hash function used for the signature must be part of the SHA-2 family; we recommend SHA-512.
  • The certificate and the certificates of its certification authorities must have a private key of at least 2048 bits with RSA, DSA, and DH encryption; for elliptic curve keys (ECC), they must be at least 224 bits. We recommend a size of 4096 bits for RSA and an ECDSA secp384r1 curve size of 384 bits.
  • The value of the Common Name attribute must be the FQDN name or at least the name of the Edge Gateway machine.
  • The Key Usage attribute must have the values critical, digitalSignature and keyEncipherment.
  • The Extended Key Usage attribute must have the value serverAuth.

Accepted certificate format: P12.