Appliance Setup

1. Launch an EC2 instance using the DLP On Demand AMI. The image can be found in Private Images.

   

2. Set the Instance Type to c5ad.8xlarge or c5ad.16xlarge.

   

3. Define your desired Storage and use gp3.

4. No SSH key-pair is required at the moment, setup the networking and firewall security groups as appropriate and other configurations can remain at the default setting. We recommend that the appliance is not accessible publicly.

5. Select proceed with no key-pair and launch the instance.

1. Go to Compute Engine – VM Instances and then click Create Instance

   

2. In Machine Configuration, provide a name for the instance and in General Purpose, select N2.

   

3. In the Machine Type, select n2-standard-32 or n2-standard-64

   

4. In OS and Storage, select Change under Operating System and Storage and filter the Image. Select the appropriate DLP On Demand appliance image. For Size (GB), enter 300 GB.

5. Setup the networking and firewall security groups as appropriate and other configurations can remain at the default setting, then click Create.

1. Download the VHD from the presigned URL

2. Untar the VHD using the below command

   tar -xvf {downloaded_vhd_tar_file} -C {path to untar the artifacts}

3. Create a Storage Account under Resource Group.

4. Create a Container under the Storage Account.

5. On the Storage Account page, open the side-menu Security + Networking and click on Shared access signature.

6. Enable all permissions, set the Start Time as 24h before the current time and End Time as 24h after current time (1 day offset for Start Time and End Time)

7. Click on Generate SAS and connection string and copy the SAS token value.

8. If you don’t have azcopy, install it.

   Warning
   To upload the file to Azure Blob Storage, use AzCopy. Uploading large files via the Azure Portal is unreliable and may result in file corruption

9. Run the command below to upload the .vhd artifact to the Azure Blob Storage:

   azcopy copy "{local_path}.vhd" "https://{account_name}.blob.core.windows.net/{container_name}/{vhd_name}.vhd?{SAS_TOKEN}" --blob-type PageBlob

10. Once the VHD is uploaded,navigate to the Images in Azure:

    

11. Choose your subscription to create the image.

    OS Type: Linux

    Choose your VHD from the storage blob

    Account Type: Premium SSD

    Encryption: Platform managed

    

    

12. Click on Review + create to create the image.

13. Create the instance out of the image.

    

14. Choose the respective subscription and resource group. Provide the VM name. The Image will be auto populated and choose the other parameters.

    

    

    

15. Select a minimum of 351 GB disk Premium SSD.

    

16. Choose your Networking settings and create the VM.

As stated previously, the VM may show deployment failures, but this is expected behavior.

If you are using vCenter Server, the process is similar and generally done via the vSphere Client:

1. Start Deployment:
   • Right-click a host, cluster, or datacenter in the inventory and select Deploy OVF Template.
2. Select Template:
   • Select Local file and then Upload files to choose your local .ova file.
   • Click Next.
3. Select Name and Folder:
   • Enter a Virtual machine name and select the deployment location (a folder in the vCenter inventory).
   • Click Next.
4. Select Compute Resource:
   • Select the host, cluster, or resource pool where the VM will run.
   • Click Next.
5. Review Details:
   • Review the template details and accept any license agreements.
   • Click Next.
6. Select Storage:
   • Select the datastore and the virtual disk format (e.g., Thin Provision).
   • Click Next.
7. Select Networks:
   • Map the source networks in the OVA to the destination network ports in your vSphere environment.
   • Click Next.
8. Customize Template (if applicable):
   • If the OVA allows for customization, you’ll see a Customize Template screen where you can set initial configuration (e.g., network settings, passwords).
   • Click Next.
9. Ready to Complete:
   • Review the final summary. Check the box to Power on after deployment if desired.
   • Click Finish.

1. Download the appliance image from the Setup DLP on Demand window from your tenant

2. Search for and open Hyper-V Manager from the Start menu.

3. Access the Import Wizard:

   • In the left pane, click the name of your Hyper-V host (your computer).
   • In the Actions pane (on the right), click Import Virtual Machine.

   

4. Locate the VM Folder:

   Click Next on the “Before You Begin” screen.

   

   In the Locate Folder step, click Browse and navigate to the folder that contains the exported VM files (the VM’s configuration file, usually in a subfolder called Virtual Machines). You must select the top-level folder of the exported VM, not a subfolder.

   Click Select Folder, then Next.

   

5. Select the Virtual Machine:

   The wizard should now display the virtual machine found in that folder. Select the correct VM from the list and click Next.

   

6. Choose Import Type: Select one of the following import options:

   Register the virtual machine in-place (use the existing unique ID): Use this if the VM files are already in the location where you want them to run and you are not importing a copy.

   

7. Review and Finish:

   Review the summary of your choices and click Finish to start the import process.

   Once complete, the VM will appear in the list of virtual machines in the Hyper-V Manager console.

   

8. Edit the Network Adapter Setting before starting the instance.

9. Right-click the VM name and select Settings….

10. In the left pane, under the Hardware section, click on Network Adapter (or the specific name if you renamed it). Select the network switch which is used to connect in the respective environment.

    

    

11. Start the VM: There are a few options to start it:

    • Action Pane: Select the VM, and in the Actions pane (on the right), click Start.
    • Right-Click Menu: Right-click the VM name and select Start.

    

1. Download the Appliance Image

   Download the appliance image from the Setup DLP on Demand window from your tenant.

2. Create Template Directory and Extract Initial Tarball

   Create a directory to hold the VM disk image and extract the initial tarball. The tar includes checksum files also so next step will untar the main artifacts

   mkdir dlp-vm-template
tar -xvf dlp-appliance.tar
ls # List files to confirm the nested tar.gz file is present

3. Extract the QCOW2 Disk Image

   The .qcow2 file is the actual virtual disk image. Extract it into the template directory. Note: The file name in your command (netskope-dlp-on-demand-kvm-qcow2-133.0.7.qcow2.tar.gz) suggests a nested .tar.gz archive, so the extraction command is:

   tar -xzvf netskope-dlp-on-demand-kvm-qcow2-133.0.7.qcow2.tar.gz -C /home/ubuntu/dlp-vm-template/

4. Deploy the Appliance using virt-install

   This command creates the VM definition (dlp-appliance-test) and imports the prepared disk image.

   • --import: Tells virt-install to use the existing disk image instead of performing a fresh installation.
   • --disk: Specifies the path to the .qcow2 image and its size.
   • --network default: Connects the VM to the default libvirt NAT network.

   sudo virt-install --name dlp-appliance-test --ram 65536 --vcpus 32 --os-variant ubuntu24.04 --disk path=/home/ubuntu/dlp-vm-template/netskope-dlp-on-demand-kvm-qcow2-133.0.7.qcow2,size=452 --import --network default --check path_in_use=off

   IMPORTANT: When virt-install runs, it often connects the console. Give CTRL+C to exit the console view. The installation/first boot process will continue in the background. Wait a few moments for the appliance to fully boot.

5. Verify the VM Status

   Check the status of the deployed VM. It should show as running.

   sudo virsh list --all

   

6. Check the Default Network Status

   Confirm the default network (typically a NAT bridge on virbr0) is active.

   sudo virsh net-list

7. Find the Appliance’s IP Address

   Since the appliance is on the default virtual network, use virsh to query the DHCP leases to find the IP address assigned to the new VM.

   sudo virsh net-dhcp-leases default

8. Connect to the Appliance via SSH

   Use the IP address retrieved in the previous step to connect to your running KVM appliance.

   sudo ssh {username}@{IP}