QoreStor 7.0.1 - Azure Deployment Guide

Option	Description
Virtual network	Select a network from the drop-down. If you do not have a network established, or you want to use a different network than what appears in the drop-down list, click Create new. For more information about creating a network, see Microsoft Azure documentation.
Subnet	Select a subnet from the drop-down list. Optionally, to configure your subnet options, click Manage subnet configuration. For more information about managing subnet configurations, see Microsoft Azure documentation.
Public IP	Optionally, select a public IP for your virtual machine. If you do not have a public IP, or you want to use a different IP than what appears in the drop-down list, click Create new. For more information about creating an IP, see Microsoft Azure documentation.
NIC network security group	Select Advanced.
Configure network security group	Select a network security group from the drop-down list. If you do not have an existing Network Security Group, or you want to use dedicated Network Security Group than what appears in the drop-down list, click Create new. For more information about creating a Network Security group, see Microsoft Azure documentation.
Accelerated networking	Quest recommends selecting this option.
Place this virtual machine behind an existing load balancing solution?	Quest does not recommend selecting this option.

Click Next: Management.

On the Management tab, ensure that all options are disabled or not selected.

	NOTE: The default for the Boot diagnostics option is Disable, but this setting is not required.

Click Next: Advanced.

On the Advanced tab, select Enable user data.

Under User data, enter the following commands:

cloud-container: <user named container>

connection-string: <connection string to the customer storage account>

NOTE: You can find the connection string for your Azure Storage account in the Azure UI under Access Keys.

Click Next: Tags.

On the Tags tab, add any required tags.

Click Review + Create.

On the Review + create tab, verify that your selections are correct, and then enter the following information:

Table 3: Contact details

Option	Description
Name	Enter the name of the point of contact for the Azure account.
Preferred e-mail address	Enter the email address for the point of contact.
Preferred phone number	Enter the phone number for the point of contact.

Click Create.

After the deployment is complete, click Go to resource.

Accessing and configuring the virtual machine

NOTE: If you recently created the virtual machine, it is recommended that you wait 3 or 4 minutes before you begin this procedure.

To access and configure the virtual machine

By default, the instance does not have the DNS name configured. To configure the DNS name, find the DNS name field in the Networking section, and then click Configure.

Figure 1: QoreStorVM page in Azure

By default, Azure provides the <region>.cloudapp.azure.com domain. Edit the options for the name based on your Public IP configuration, and then click Save.

Open a SSH session to the Public IP or DNS name.

In the SSH session, provide the credentials from the Deploying the image section of this guide.

After you log in, verify the filesystem is operational for I/O using the system -show command.

Figure 2: Filesystem list confirming operations

Graphical user interface, text Description automatically generated

If the system is in Manual Intervention mode, use the following command to update the Azure Blob Storage account connection string:

object_direct --update_sentinel --cloud_container <containername> --cloud_provider AZURE

NOTE: The system prompts you for the connection string in secret.

To access the QoreStor UI, use the public IP assigned in the section “Creating Virtual Machine”. The URL for accessing QoreStor UI would be https://<public_ip_of_virutal_machine>:5233.

Port usage

QoreStor uses certain ports for the services mentioned in the following table. The table also mentions the recommended network group settings (NSG) in Azure for each of the ports. Please refer to the next section for instructions on how to change the default/recommended NSG settings.

Table 4: Port functions and settings

Component / Function	Ports used	Protocol	Details	Default Network Security Group setting in Azure
SSH	22	TCP	SSH uses port 22. We recommend keeping this port open to enable secure connections within and from outside the QS	22: ENABLE
UI	80 5233	HTTP TCP	80 is HTTP port and newer QoreStor releases no longer use it. Quest does not recommend exposing this port to a public network. QS uses 5233 for HTTPS connections (and not 443). Since this connection is secure, the port remains open in default NSG settings for all incoming traffic.	80: DISABLE 5233: ENABLE
Object (S3)	9000	TCP	Object Tier uses port 9000 for namespace as well as data transfer. QoreStor uses Minio front-end for object client interface. Currently, QoreStor does not support Secure Connect with Minio, but QoreStor uses port 9000 for both HTTP and HTTPS protocols. By default, NSG disables port 9000. However, if customer wants to use Object Tier, the port needs to be enabled in NSG.	9000: DISABLE
RDA-NDMP	12000-12127	ANY	These ports are used for RDA based NDMP. By default, they are disabled in NSG. Each NDMP needs 2 ports (internal port used by NDMP and OST servers + filer port to transfer data). In general, only 5 are used at any time. So, if customers intend to use NDMP over RDA, 5*2=10 ports are typically enough. Customers need to enable the ports using a range specification in NSG settings. We recommend 12000-12009.	12000-12127: DISABLE
Secure Connect	9443	ANY	Port used by secure connect. Secure connect is enabled by default and we recommend keeping this port open in NSG settings.	9443: ENABLE

Configuring Azure Network Security Group settings

The settings for enabling or disabling the Network Security Group (NSG) settings are available in Azure using the following instructions.

To configure Azure Network Security Group settings

In Azure console, find “Services” and click on “Network security groups”.

Click the NSG name you want to modify. This is the same NSG that is deployed with the Azure Marketplace image of QoreStor.

NOTE: Any modification to this NSG will change the default settlings recommended by QoreStor.

After you click the NSG name, a settings page like the one in the following image shows where you can modify the network settings.

Figure 3: Overview of network settings in Azure

When opening an additional port, to add inbound rules for that specific port, click Inbound security rules on the left side, and then click the Add tab on the top side of the page.

The following dialog opens.

Figure 4: Inbound security rules table and dialog in Azure

On this dialog, you can add rules that open other ports. For example, if Object Tier is enabled, then the corresponding port – 9000 per the table in earlier section – needs to be open. In that case, complete the following options:

Table 5: Add inbound security rule options

Option	Description
Source	Select an IP or an Azure NSG. If the port can be used from any external interface, select Any.
Source port ranges	Select a port range on the specified source. To select any range, select *.
Destination	Leave as the default selection, Any.
Service	Leave as the default selection, Custom.
Destination port ranges	(Required) Enter 9000 for this port.
Protocol	Select TCP.
Action	Select Allow.
Priority	Select an appropriate priority. The rules execute by priority, with the lowest number representing the highest priority. When selecting priorities, leave spaces between the numbers so that you can insert new priorities later.
Name	Enter an appropriate name for this rule; for example, ObjectServer_9000, which highlights the port number and the functionality. Add a description as needed.