Deploy and install the Trellix DLP Network Prevent appliance in AWS using the .iso file

This task assists you to create the Trellix DLP Network Prevent AMI by importing the Trellix DLP Network Prevent .iso file, which can be integrated with cloud web or email gateways. Download the appliance installer zip file from the download portal. To create an instance of the appliance, run the Python script provided in the zip file and follow the instructions provided here.

Note
Creating a cluster of Trellix DLP Network Prevent appliances is not supported on the AWS platform.
DLP Capture is not supported on the AWS platform.

Prerequisites

Install Python 3 on your local system from where you plan to perform the deployment and installation.
Install AWS SDK for Python (Boto3), Boto3 makes it easy to integrate Python application, library, or script with AWS services. For more information, see Boto3 Quick Start.
You can alternatively run setup_env.sh to setup the virtual environment with the necessary libraries if your environment is not ready for deployment.
Install and configure AWS CLI and verify if the working environment functions properly.
Assign AWS IAM role with the rights to import, this also allows you to access the S3 bucket and EC2 instance. The profile is defined in .aws/config.
Deploy and install ePO - On-prem on an instance of Windows server deployed on AWS. For information about installing ePO - On-prem, see the Trellix ePolicy Orchestrator - On-prem Installation Guide.

Task

Download the AWS installer zip file from the Trellix download site.
The zip file contains iso file, aws-import-snapshot.py and setup_env.sh scripts.
To import the .iso to AMI, run this command in the CLI interface. Make sure to use only the iso provided with the AWS installer zip file.
./aws-import-snapshot.py --iso <path to iso file> --s3 <s3_bucket to use> --role <IAM role to use> --profile <AWS CLI profile to use>
Where,
- --iso - specify the ISO path to import the appliance package
- --s3 - specify the S3 bucket to use
- --role - role that has access to S3 and EC2 resources
- --profile - profile from AWS CLI config used to connect to AWS
This loads the .iso file into the S3 bucket and creates an instance of the appliance. After the instance is created, you can find Trellix DLP Network Prevent AMI in the Amazon Machine Images page.
Click AMIs to browse the Amazon Machine Images page.
Select the image and click Launch instance from AMI. The Launch an instance page opens. This page allows you to create an instance of appliance that runs in the AWS Cloud.
1. In Name and tags, provide a host name for the Trellix DLP Network Prevent appliance.
2. In Application and OS Images (Amazon Machine Image), select Trellix DLP Network Prevent AMI.
3. In Instance type, select the required specification. Trellix recommends a minimum of 32 GB RAM/8 CPU and 64 GB/8 CPU for an appliance with EDM configuration. Only with a minimum of these specifications you can Connect from the AWS console.
4. Select the Key pair value or create a new key pair. Access to the appliance is based on SSH key based authentication. Use this key pair to login into the appliance.
5. Select the required Security group or create a new Security group.
6. Trellix DLP Network Prevent requires two networking interfaces. One of the interface is used for redirecting the traffic and the other is used for Out-of-band management. By default, AWS provides one network interface. To create the second network interface, use one of these methods:
  1. In Network Settings, click Edit.
  2. Select the default Virtual Private Cloud (VPC) and then select a subnet. Selecting a subnet allows you to create the second network interface.
  3. Select the existing security group or create a security group.
  4. Disable the Auto-assign public IP option.
  5. Click Advanced Network Configuration and click Add network interface.
    Enter the network details in the Network interface 2 section.
  OR
  Create an interface as described in https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#eni-basics.
Click Launch Instance. After the successful creation of the instance, you can see a message with the instance ID.
The appliance comes up with SSH enabled, which is configured with the key pair.
The authorized SSH key for the "admin" account is updated with the key pair provided during instance creation and the default password is set to instance id.
To configure the network settings, login to the appliance using the SSH (Secure Shell) login and enter the required details:
ssh -i <key_pair> admin@<ip_address>
The MASH menu provides you options to update the network setup and Trellix ePO registration details.
1. Enter the details for the initial network setup:
  1. Select Appliance network information and enter the values for Host name, Domain name, Default gateway, IP address, and Network mask.
    Click OK.
  2. Select DNS configuration and enter the values for Primary DNS Server and Secondary DNS Server.
    Click OK.
  3. Select Management Interface Configuration enter the values for IP address and Network Mask.
    Click OK.
2. Register the appliance with Trellix-ePO SaaS. Select EPO - SasS Registration and enter the values for Registration details, Webproxy server, and server port.
Log on to ePO - SaaS.
You can find the appliance in the System Tree. If needed, move the entry to the correct location in the hierarchy.