Install Cloud Exchange on a Cloud Platform

Prerequisites

An AWS account.

Configure the EC2 Instance

1. Log in to your AWS account.
2. Open the EC2 service in your preferred region.

   

3. Click Launch Instance.
4. Enter name for this new instance and click Browse more AMIs.

   

5. Search for Netskope Cloud Exchange and click AWS Marketplace AMIs, and then select Netskope Cloud Exchange AMI.

   

6. Click Subscribe and launch.

   

7. Select the Instance Type according to your requirements.

   

8. Click Create new key pair and save the private key securely. This key will be required to access the machine.

   

9. Change the Network Settings and allow SSH traffic according to your organization policy. We recommend you change it to allow from your IP only. This applies the same for the HTTPS port as well.

   

10. Configure the storage per your requirements.

    

11. Click Launch Instance.
12. After the machine is started, follow these steps to configure CE.
13. Copy the Public IPv4 DNS and run the ssh command as follows. If you’re using Mac or Linux based operating system, you will need to change the pem file permissions to readonly.
    

    chmod 400 <private-key-path> ssh -i <private-key-path> cteadmin@public-ipv4-dns

14. Go to the Cloud Exchange directory:
    

    cd /opt/cloudexchange/cloudexchange/

15. Copy and edit the cloudexchange config file.
    

    cp cloudexchange.config.example cloudexchange.config
    vi cloudexchange.config

16. Configure the Cloud Exchange configuration file by setting the parameters according to your requirements.

17. Execute the setup script.

    sudo python3 ./setup

18. Launch Cloud Exchange.

    sudo ./start

19. Wait for few minutes for CE to be started.
20. Now open the IP public-ipv4-dns with the HTTPS protocol in a browser and start using CE.

Default User Login

By default, a single user is created with administrative capabilities with these credentials:

• Username: admin
• Password: admin

This user will have Administrator level access to the application. This user will have write access, and will be able to create new users as well.

On the first login, you will be required to change these credentials. After that, log in using your new credentials.

Security Guidelines

Restrict ssh access to specific IP addresses only.

Increase Size of Disk/Volume (Optional)

Following these steps will only increase the disk/volume size. After performing these steps, follow Extend a Linux file system after resizing a volume – Amazon Elastic Compute Cloud to increase the file system size.

1. Log in to AWS and open the EC2 instance for which you want to increase the size of the disk, and stop the machine if it’s running.
2. Click Storage and then open the volume by clicking Volume ID.
   
3. Select the volume and click Modify volume on the Actions menu.
   
4. Change Size (GB) to the new disk size you want click Modify.

   

5. Click Modify again on the confirmation popup.
   
6. Wait for 8-10 minutes, start the EC2 instance, and SSH into the VM.
7. Now follow Extend a Linux file system after resizing a volume – Amazon Elastic Compute Cloud.

Prerequisites

An Azure account with necessary rights to create virtual machines.

Configure the Azure Virtual Machine

1. Log in to Azure portal.
2. Search for Virtual Machine and open it.

   

3. Click Create and then Azure virtual machine.

   

4. Create a virtual machine. Select your Subscription and Resource group where you want to create the virtual machine.
5. Select the Size of the machine according to your requirements (medium or large).
6. Click See all images.

   

7. Search for and select Netskope Cloud Exchange in Marketplace, and click on Select then click on the Netskope Cloud Exchange v6.1.0 – x64 Gen 2 image published by Netskope.

   

8. Change the Size of the machine according to your requirement.

   

9. Configure an Administrator account. Select SSH public key as Authentication type.
10. Configure the following username and select Generate new key pair. Username: cteadmin.

    

11. Configure Inbound port rules with Allow selected ports, and allow HTTPS and SSH.

    

12. For Licensing, select License Type as Other.

    

13. Click Next > Disks and change the OS disk size per your requirements.

    

14. (Optional) Configure the Network per the remaining steps according to your organization policy.
15. Click Review + create.
16. Once validation is successful, click Create.
17. Wait for the Virtual Machine to be created (it will take around 2-5 minutes).
18. Once the Virtual Machine is started, SSH into machine with cteadmin username with private key.ssh -i <private-key-path> cteadmin@ip-address-of-vm
19. Go to the Cloud Exchange directory:

cd /opt/cloudexchange/cloudexchange/

20. Copy and edit the cloudexchange config file.

cp cloudexchange.config.example cloudexchange.config
vi cloudexchange.config

21. Configure the CloudExchange configuration file by setting the parameters according to your requirements.

22. Execute the setup script.

    sudo python3 ./setup

23. Launch Cloud Exchange.

    sudo ./start

24. Wait for 5-10 minutes and then access the Cloud Exchange using the IP address of VM.

Default User Login

By default, a single user is created with administrative capabilities with these credentials:

• Username: admin
• Password: admin

This user will have Administrator level access to the application. This user will have write access, and will be able to create new users as well.

On the first login, you will be required to change these credentials. After that, log in using your new credentials.

Security Guidelines

• Restrict ssh access to specific IP addresses from the Networking tab of the Virtual Machine.
• We recommend using SSH public key as the machine Authentication type.

Increase Disk Size (Optional)

If you’re using Mac or Linux-based operating system, you will need to change pem file permissions to readonly.

chmod 400 <private-key-path>

1. Log in to Azure portal and open the Virtual Machine.
2. Stop the virtual machine if it’s running, and wait until the status becomes Stopped (deallocated), and then click Disk on the left navigation menu.
3. Open OS disk.

   

4. Click Size + performance and enter Custom disk size (GB) with the new disk size, and then click Save. You cannot decrease the size of the disk once it’s increased.

   

5. Start the virtual machine.
6. To verify the disk change, run this command to verify the disk size change after doing SSH into the instance.

   df -h /

Cloud Exchange can be deployed on GCP in two ways:

• Configure Cloud Exchange in GCP compute instance.
• Create a GCP Image from an OVA file. Note that creating a GCP Image from an OVA file has limited support.

Configure Cloud Exchange in a GCP Compute Instance

1. Log in to your GCP account and go to Compute Engine. If you don’t see it on your main GCP dashboard, search for it.
2. Click on Create Instance.
   
3. Enter a new instance Name, and select a Region, Zone, and Machine configuration per your requirements.
   
4. Select a Machine type as per your profile requirements by clicking Custom (like 8 CPU and 16GB RAM for a medium profile).
   To help you decide on size, check out our Sizing the System section here.
   
5. From the left panel, select the OS and Storage section, then click Change.
   
   
6. In the Public Images section, choose Ubuntu as the Operating system and select Ubuntu 24.04 LTS Minimal as the Version. Specify the Boot disk type and Size (for example, 80 GB of free disk space for a medium profile) based on your requirements, then click Select.
   To help you decide on size, check out our Sizing the System section here.
   
7. From the left panel, navigate to the Networking section. Under Firewall, select Allow HTTPS traffic.
   
   
8. Scroll down to Network interfaces and click on the expand icon, then select a Network and Subnetwork based on your requirements.
   
9. Click Create.
   
10. SSH into your Instance. Click SSH.
    
    Now set up Cloud Exchange on your new GCP instance by following these instructions: Install Cloud Exchange on Ubuntu.

Default User Login

By default, a single user is created with administrative capabilities with these credentials:

• Username: admin
• Password: admin

This user will have Administrator level access to the application. This user will have write access, and will be able to create new users as well.

On the first login, you will be required to change these credentials. After that, log in using your new credentials.

Security Guidelines

Restrict ssh access to specific IP addresses from Networking tab of Virtual Machine

Create a GCP Image from a VHDX File

Prerequisites

• Download the Latest VHDX file from here and unzip it.
• VM Migration API allowed.
• Storage read on the bucket.

Upload File to the Bucket

1. Log in to your Google Cloud Console.

2. Go to Cloud Storage > Buckets. Select an existing bucket to upload the Cloud Exchange VHDX file, or create a new bucket.

3. Upload the unzipped .vhdx file inside the bucket. Make sure the bucket is in the region where you need to deploy Cloud Exchange. The upload might take several minutes. Wait for the upload to complete before moving forward.

   

4. On the Permissions tab click Grant Access.

   

5. In the new principal, enter the principal for VM Migration. Replace the project number with your current project number. You can find the project number under IAM & Admin > Settings.

   service-<PROJECT_NUMBER>@gcp-sa-vmmigration.iam.gserviceaccount.com

6. Select Storage Object Viewer for the Role and click Save.

   

   Import the VHDX as a UEFI image (skip OS adaptation)

   1. Search for and select Compute Engine. Select Migrate to Virtual Machine on the left panel and click Image Imports.

      

   2. Provide a name for the image.

   3. For Source Cloud Storage File, select the .vhdx file that you uploaded. Select the same region in which you have uploaded the file.

   4. Enable Skip OS adaptation. Keep Convert BIOS > UEFI disabled.

      

   5. Click Import. The OS Adaption skip check will ask for confirmation, so confirm and wait for the import status to be succeeded.

      

   Create a UEFI-compatible Image

   This VHDX image is built for UEFI boot. Mark the custom image as UEFI-compatible before creating the VM; otherwise, Google Cloud may attempt legacy BIOS boot and the instance may fail to start.

   1. Activate the Cloud Shell from the top right corner, and then authorize and run the following command. Replace <IMAGE_NAME> with the image name created in the previous step. You can also replace the UEFI image name (ce-610-uefi) with a custom name, and the region with your desired region (same as the region for the image import).

      gcloud config set project ns-cloud-exchange
      gcloud compute images create ce-610-uefi \
        --source-image=<IMAGE_NAME> \
        --guest-os-features=UEFI_COMPATIBLE \
        --storage-location=us-east1
      

      

   Allow SSH access

   1. Go to VPC network > Firewall and click Create Firewall Rule.

      

   2. Create a rule (allow-ssh) for allowing ssh access.

      • Network: Default (or the network used by the VM)
      • Direction of traffic: Ingress
      • Action on match: Allow
      • Targets: Specified target tags
      • Target tags: ce-ssh
      • Source filter: IPv4 ranges
      • Source IPv4 ranges: 35.235.240.0/20
      • Protocols and ports: Select Specified protocols and ports, then enter tcp:22

      

      Create a Cloud Exchange VM

      1. Go to Compute Engine > VM instances and click Create instance.

         

      2. Enter a new instance Name, and select a Region, Zone, and Machine configuration per your requirements.

         

      3. Select a Machine type as per your profile requirements by clicking Custom (like 8 CPU and 16GB RAM for a medium profile).
         To help you decide on size, check out our Sizing the System section here.

         

      4. On the left panel, select the OS and Storage section, and then click Change.

         

      5. Select the Custom images tab. Source your project. In the Image field, select the image created in the previous steps using the CLI commands (ce-601-uefi).

      6. Select Balanced persistent disk in the Boot Disk Type dropdown. Make sure to provide the size greater than 150 GB and click Select.

         

      7. On the left panel, go to the Networking section. Under Firewall, select Allow HTTPS traffic. To allow SSH traffic, add the tag created in the firewall rule.

         

      8. Scroll down to Network interfaces and click on the expand icon, and then select a Network and Subnetwork based on your requirements.

         

      9. Click Create. Wait until the VM Instance status to be ready.

         

      10. After the VM is ready, you can SSH into it using Google Cloud Shell.

          

      11. Copy the command to ssh using a terminal, or run in the shell. Use this username and password. Be sure to change the password with a more secure string.
          Username: cteadmin
          Password : Cl0ud3xc4ang3!

      12. Follow this link if you wish to assign a static IP for the Cloud Exchange instance: Configure static external IP addresses.

      13. Go to the Cloud Exchange directory.

          cd /opt/cloudexchange/cloudexchange/

      14. Copy and edit the Cloud Exchange config file.

          sudo cp cloudexchange.config.example cloudexchange.config
          sudo vi cloudexchange.config

      15. Configure the Cloud Exchange configuration file by setting the parameters according to your requirements.

          Notes for the Maintenance Password
          

          • This password is required only once during the initial setup and cannot be changed later.It is strongly recommended to set a secure password.

          • If no password is specified, a random 32-character password will be automatically generated.

          • Non‑ASCII characters (e.g., accented letters, other scripts, emoji) are not supported for the maintenance password in Cloud Exchange and can cause failures.

          • Please record and securely store the generated maintenance password, as it will be required when migrating Cloud Exchange to another machine.
          Notes for JWT SECRET
          

          • If not specified, a random 32-character key will be automatically generated.

          • Non‑ASCII characters (e.g., accented letters, other scripts, emoji) are not supported for the JWT SECRET in Cloud Exchange and can cause failures.

          • Record and securely store the generated JWT SECRET, as it will be required for the Cloud Exchange HA configuration.

      16. Execute the setup script.

          sudo python3 ./setup

      17. Launch Cloud Exchange.

          sudo ./start

      18. Wait for 5-10 minutes and then access the Cloud Exchange using the IP address of VM. (https://<ip>).

          For an HA installation of Cloud Exchange, follow the HA installation instructions.

          Default User Login

          By default, a single user is created with administrative capabilities with these credentials:

          • Username: admin
          • Password: admin

          This user will have Administrator level access to the application. This user will have write access, and will be able to create new users as well.

          On the first login, you will be required to change these credentials. After that, log in using your new credentials.