Installing Axonius Tunnel

Axonius Tunnel enables establishment of a link between an internal network and the Axonius-hosted (SaaS) instance.

The Axonius-hosted (SaaS) instance resides in the cloud and is not part of your organization's internal network. Axonius securely fetches data from the organization's data sources, known as adapters. To connect adapters that are only accessible by an internal network, you must configure and install an Axonius Tunnel on a server that has access to those sources.

To establish the link between the Axonius-hosted (SaaS) instance and an internal network, you need to:

1. Provision a server to be used as the Tunnel server
2. Install Docker Engine on the Tunnel server
3. Add a new Tunnel Connection
4. Install the Tunnel installation package
5. Configure and connect adapters to use an Axonius Tunnel

1. Provision a server to be used as the Tunnel server:

Provision a server that meets the following network requirements either by a direct connection or by HTTPS proxy:

• Access to the internet via TCP port 443 from the Tunnel server.
• Access to the sources of the adapters that will be connected using this tunnel.
• The folder/opt/axonius must be writeable.

The server hardware requirements are:

• An Intel x86 based architecture processor
• At least 1 GB of free disk space
• At least 1 GB of RAM dedicated to the tunnel container

2. Install Docker Engine on the Tunnel server

Install any Linux distribution that supports Docker on the provisioned server (the Tunnel server).

1. Install the Docker Engine software on the Tunnel server.
2. Verify Docker is running: sudo systemctl enable docker; sudo systemctl start docker

3. Add a new Tunnel Connection

To add a new tunnel connection:

1. On the Tunnels page, click Add Tunnel.
   

2. The New Tunnel Connection drawer appears.
   

3. Specify the following Tunnel settings:

   • Tunnel name (optional, default: Tunnel_x) - Specify an indicative name for the Tunnel connection or use the system default. The Tunnel name can always be changed.
   • Tunnel status notification (optional, default: empty) - Specify a list of email addresses to be notified when the Axonius Tunnel disconnects.
     • If supplied, when an Axonius Tunnel disconnects, an email is sent to the supplied list of recipients.
     • If not supplied, when an Axonius Tunnel disconnects, no email is sent.
   • Proxy settings (optional, default: empty) - To configure a proxy service to be used by the Axonius Tunnel, select the Use Proxy checkbox. Once enabled, configure the Proxy address and Proxy port fields. Proxy user name and Proxy password are optional fields for proxy services.

4. Click the Create and Download button.

   • A Tunnel record is added to the table.
   • The Tunnel installation package is downloaded.

4. Install the Tunnel installation package

1. Copy the Tunnel installation package to the Tunnel server.
2. Execute the Tunnel installation package as the “root” user. For example:

chmod +x axonius_tunnel_launcher_T-1.sh

./axonius_tunnel_launcher_T-1.sh

When the installation package has finished successfully, it shows the following message: “The Axonius Tunnel has been successfully installed.”

After the installation finishes, refresh the Tunnels page and track the Tunnel record status on the Connection Status field.

5. Configure and connect adapters to use an Axonius Tunnel

1. Open the Adapters page. Click the icon on the left navigation panel.
2. Search for and click the relevant adapter. The Adapter Connections page opens displaying the list of configured connections.
3. Add a new connection. click Add Connection. The Adapter Connection Configuration dialog opens.
4. Populate the required information.
5. Select the requested Tunnel Connection on the Tunnel Name field. Click Save.
6. To save your changes and to establish a connection to the adapter connection using the configured credentials, click Save and Fetch.

Tunnel Installation Best Practices

In order to ensure the principle of least privilege it is necessary to install the Tunnel in a secure location within your network. This should ideally be a DMZ or protected network where traffic in and out of the subnet can be strictly controlled. The default policy for traffic originating from your Axonius Tunnel should be blocked. The ports and protocols required for the operation of an Axonius Tunnel are listed on the table below, and only these connections should be permitted through your firewall. Replace * with your Axonius Hosted ID:

For more details about configuring adapter connections, see:

• Adapters Page
• Adapter Advanced Settings
• Adapters List