Deploy on AWS

Prerequisites

• An AWS account with access to Amazon EC2.

• Access to the Trellix Wise™ for Private Cloud AMI for the required Wise model. For details, see System requirements.

• The virtual machine image in the Private Products Listing in Marketplace—The Cloud Delivery Enablement Service enables you to obtain the virtual machine image from Trellix, which is delivered as a private product at My Marketplace > Private products page. For details, see the Trellix Knowledge base article, Cloud Image Delivery User Guide - KB000002886.

• The activation code provided during onboarding. The activation code is required to activate the appliance and enable licensing.

• An EC2 instance type that meets the resource requirements of the selected Wise model.

• An EC2 key pair for SSH access to the appliance.

• The required VPC, subnet, and security group configuration.

• Network information required for your environment, including the gateway, DNS, domain, and HTTP proxy, if applicable.

• Outbound connectivity to FENET and the Trellix OCI registry. If your environment uses an HTTP proxy for outbound connectivity, configure the proxy for the appliance.

• An EC2 instance type that meets the resource requirements of the selected Wise model.

  • The supported EC2 instances include:

    Deployment environment	Supported instance type
    AWS EC2	G7e.24xlarge or later
    AWS EC2	P5.4xlarge

Create the AWS instance

1. Sign in to the AWS Management Console.

2. In the AWS Region selector, select the Region where you want to deploy Trellix Wise™ for Private Cloud.

3. Go to EC2.

4. In the navigation pane, select AMIs.

5. Locate the Trellix Wise™ for Private Cloud AMI shared for your AWS account and the selected Wise model.

{
  "va_bootstrap": {
    "activation_code": "<activation-code>",
    "reset_admin_password": "<admin-password>"
  }
}

6. Select the AMI, and then select Launch an Instance in the upper-right corner.

7. In Instance type, select the instance type required for the selected Wise model.

8. Under Key pair, select an existing key pair or create a new key pair for SSH access.

9. In Network settings, configure the VPC, subnet, and security group.

10. Configure the security group to allow only the required access from your trusted network. The deployment guide identifies ports 22 and 443 as typical required ports. Do not expose the instance directly to the Internet.

11. The Configure Storage details are populated automatically based on the selected Wise model.

12. In Advanced details, enter the following User Data bootstrap configuration:
    JSON

    {
      "va_bootstrap": {
        "activation_code": "<activation-code>",
        "reset_admin_password": "<admin-password>"
      }
    }

    The activation_code parameter is required. The reset_admin_password parameter is optional

13. Review the instance configuration.

14. Select Launch instance.

15. Connect to the Wise instance through an SSH client.

16. At the login prompt, enter admin.

17. Use the ssh -i command to use the private key file to establish the SSH session. For example, /ssh -i /path/<my-key-pair>.pem admin@<instance>. When prompted, change the password using the username admin password <new password> command. You will be logged out. Log in again using the new password.

18. Accept the license agreement. The configuration jump-start wizard begins.

    Step	Response
    Hostname?	Enter the hostname for the appliance.
    Admin password ?	Enter a new administrator password, or press Enter to keep the current password.
    Enable remote access for 'admin' user?	Enter yes to enable the administrator to log in to the appliance remotely.
    Enable IPv4 for the management interface (ether1)?	Enter yes to enable the IPv4 protocol.
    Use DHCP on ether1 interface?	Enter no to manually configure your IP address and network settings.
    Use zeroconf on ether1 interface ?	Enter no to specify a static IP address and network mask.
    Primary IPv4 address and masklen ?	Enter the IPv4 address for the management interface and the network mask. (Example: 198.16.144.150)

    Default gateway?	Enter the gateway IP address for the management interface. (Example: 192.26.1.1)
    Primary DNS server?	Enter the primary DNS server IP address. (Example: 10.116.19.253)
    Enable IPv6 on management interface (ether1)?	Enter no to skip IPv6 configuration, or yes to enable the IPv6 protocol.
    Domain name?	Enter the domain for the management interface.
    Enable fenet service?	Enter yes to enable access to the Trellix Fenet/DTI network.
    Enable fenet license update service?	Enter yes to enable the licensing service to automatically download and install your licenses.
    Sync appliance time with fenet?	Enter yes to synchronize the appliance time with the Fenet server time to prevent license validation issues.
    Update licenses from fenet?	Enter yes to download and install your licenses.
    Enable Cluster?	Enter yes to enable clustering capabilities for the appliance.

Proceed to deploy Trellix Wise™ for Private Cloud using your preferred deployment mode. For details, see Select a deployment mode.