Deploy Trellix Wise™ for Private Cloud in an offline environment

The Trellix Offline Portal (OLP) is a purchased entitlement (Offline SKU) that provides access to software resources required for offline or air-gapped deployments.

If you are using ENET credentials, Offline APIs are available at https://portal.fenet.trellix.com/. Use the APIs for onboarding automation. The API link is provided as part of the onboarding process.

Use this procedure when the Trellix Wise appliance cannot connect directly to Trellix services. You need an Internet-connected workstation to obtain the required packages and transfer them to the appliance.

Prerequisites

Before you begin, make sure that you have:

• Completed the Trellix Wise appliance deployment on a supported cloud environment or hypervisor.

• The activation code provided during onboarding.

• The license keys for the exact model of the appliance.

• An appliance IP address that is reachable from the network where you run SSH.

• SSH access to the appliance with the admin account.

• Access to the [Trellix Offline Licensing Portal (OLP)] and the required entitlement.

• An Internet-connected workstation for downloading and building the required packages.

• The oci-downloader tool and the Obtain OCI registry credentials required to access the Trellix OCI registry.

Request access to OLP

1. Open a Thrive case in the Thrive portal for Trellix OLP access.

2. Provide the usernames, email addresses, appliance ID or serial number, and account name.

3. After access is provisioned, sign in to Trellix OLP.

Sign in to OLP

1. Go to FENET portal.

2. Sign in using your Okta credentials.

Offline Portal resources

Tre​llix OLP provides the following resources:

For Trellix Platform OS (TPOS)-based products such as Trellix Wise™ for Private Cloud, Trellix OLP provides TPOS image updates with .ensig metadata, the RKE2 core, and oci-downloader under Tools. Use oci-downloader to build the workload and its security content.

Release status badges

The Release status badges indicate the status of the resources available for download in the OLP portal.

Download OLP resources

Prerequisites

Locate your onboarding email, select the provided OVA link, and download the OVA image file before proceeding.

1. Go to  FENET portal.

2. Sign in and authenticate using your Okta credentials.

3. In the Product updates page, select Trellix Wise™ for Private Cloud from the Product drop-down menu.

4. Select the required version from the Release drop-down menu.

5. In the RKE2 TPOS tile, select Explore.

6. Download the compatible version of the RKE2 TPOS file.

7. Go back to the Product updates page. In the TOOLS tile, select Explore.

8. Download the compatible version of the oci downloader tool.

9. Run the oci downloader tool to download the Trellix Wise™ for Private Cloud application and the corresponding security content.

Activate and license the appliance

If you did not enter the activation code while configuring the VM, you can enter in this step.

1. Enter the activation code:

   <hostname> (config) # license activation code <activation-code>

2. Install each license key:

   <hostname> (config) # license install <license-key>

   Repeat the command for each license key in your subscription.

3. Save the configuration:

   <hostname> (config) # write memory

4. Verify the installed licenses:

   <hostname> (config) # show licenses

Important: Use the license keys issued for the exact model of the appliance. A license key for a different model can install but remain inactive.

Install the RKE2 core package and the catalog file

1. Enable the remote file transfer on the appliance:

<hostname> (config) # ssh server services file-transfer scp enable

2.  Transfer the RKE2 core package to the appliance:

scp <core-package> admin@<appliance-ip>:/data/fenet/updates/

3.  Transfer the catalog file to the appliance:

scp <catalog> admin@<appliance-ip>:/data/fenet/updates/

2.  Check the RKE2 core package:

<hostname> (config) # fenet cluster check core

3.  Fetch and verify the RKE2 core package:

<hostname> (config) # fenet cluster fetch core

4.  Install the RKE2 core package:

<hostname> (config) # fenet cluster install core

5.  Verify the installation:

<hostname> (config) # show fenet cluster update status

6. Verify that the container cluster is running:

<hostname> (config) # show cluster health

Note: The appliance verifies the package before installing it. Install the RKE2 core package before deploying Trellix Wise for Private Cloud.

Build the Trellix Wise™ for Private Cloud package

Build the Trellix Wise™ for Private Cloud  and security content packages on an internet-connected workstation using oci-downloader.

You do not need to download the security content separately from OLP. Use oci-downloader to obtain the Trellix Wise for Private Cloud package and the corresponding security content package. For details, see Download OLP resources.

Obtain OCI registry credentials

OCI credentials can be obtained from the IAM Client Credentials page or from the IAM Appliance and Server registration page

1. To obtain client secret from the IAM Client Credentials page:

   1. Log in to Trellix IAM using the credentials provided in your onboarding email.

   2. Select the Avatar in the upper-right corner and select Client Credentials.

   3. Select Add.

   4. Enter a description and in the Email Chain drop-down menu, select the registered email.

   5. Select the required Wise Security Content scope.

   6. Select Create.

   7. You can view the Client ID and Client Secret in the Client Credential Management page.

2. To obtain client token from the IAM Appliance and Server registration page:

   1. Log in to Trellix IAM using the credentials provided in your onboarding email.

   2. Select the Avatar in the upper-right corner and select Appliance and Server registration.

   3. Select Add.

   4. From the Client Type drop-down menu, select Trellix Wise for Private Cloud.

   5. Enter the number of clients.

6. Select Save.

7. In the Appliance and Server registration page, expand Servers and expand Trellix Wise™ for Private Cloud to view the generated token.

1. Create the OCI credentials file:        

   • If you generated client ID and clientent secret run the below command:

   # ~/oci-download bundle/oci-auth.conf /oci-auth.conf
   
   oci_registry=<trellix-oci-registry>
   
   oci_username=<client-id>
   
   oci_password=<client-secret>
   
   oci_scope=<iam-scope>        # only with --iam

   Do not pass OCI credentials on the command line.

   • If you generated client ID and clientent secret run the below command:

   ./oci-download bundle wise --package sc --registration-token - < token.txt

   Note: Make sure you have the generated token in .txt format.

2. Build the Trellix Wise™ for Private Cloud package and security content package:          

   oci-download bundle <product>[:<version>] --config
   ~/.trellix/oci-auth.conf \
   
   [--iam] [--since <previous-bundle>] [-o <file>]

Run the command again to resume an interrupted package creation.

3. Verify each package before transferring it to the appliance:

oci-download inspect <bundle> --trust-pubkey
<published-public-key.pem>

This verifies the package signature, digests, and version without modifying the package.

Transfer the packages

Transfer the Trellix Wise for Private Cloud and security content packages to the appliance:

scp <wise>-<version>.tar.zst
<security-content-product>-<version>.tar.zst \
    
    admin@<appliance-ip>:/data/fenet/updates/

The packages are staged in /data/fenet/updates/.

Install Trellix Wise™ for Private Cloud

1. Install the Trellix Wise™ for Private Cloud package:

<hostname> (config) # fenet cluster install workload

2. Verify the installation:

<hostname> (config) # show fenet cluster update status

The appliance verifies the signed package and checks that the package is compatible with the installed RKE2 core. If the package is not compatible, the installation stops and displays a message to install a newer core package.

Apply security content

Apply the security content package that you transferred to the appliance:

<hostname> (config) # fenet security-content apply-update

Verify the security content:

<hostname> (config) # show fenet security-content status

The security content package is obtained with oci-downloader as part of the offline package-building workflow and is applied separately after the Trellix Wise for Private Cloud package is installed.

Verify the deployment

Verify the workload installation and container cluster:

<hostname> (config) # show fenet cluster update status

<hostname> (config) # show cluster health

Verify the security content:

<hostname> (config) # show fenet security-content status

If the Trellix Wise for Private Cloud deployment does not start, run the following command again:

<hostname> (config) # fenet cluster install workload

If the deployment still does not start, contact Trellix Support.