This guide is only for V2 assemblers being deployed with a virtual machine in Microsoft Azure. The V1 assembler is no longer supported as of June 30, 2024.

Each assembler you create must be deployed via a virtual machine, and then you can add your technology as a security device in Workbench to complete the full integration. For more information about the Expel Assembler or how it works, see the About the Expel Assembler guide.

Prerequisites

You must have completed all of the steps in Add a New Assembler for each assembler you wish to deploy.
- For the Firewall Configuration portion, please ensure your Network Security Group is in a Resource Group, and that you store the Storage Account, Image, and Virtual Machine you configure in this guide in that same Resource Group.
- Be sure you have extracted the Fedora CoreOS image file you downloaded. You will need to upload the.vhd file, not the compressed .xz file in a later step.

Quick Start

Download the Ignition File
Upload the Virtual Hard Disk (VHD) to Azure
Create a virtual machine from the VHD
Verify a “Connected” Status in Workbench

Step 1: Download the Ignition File

The Ignition file enables the virtual machine to read a configuration file and to provision the Fedora CoreOS system based on the contents of that file. You will use this file when you configure the virtual machine in Azure.

Log in to Workbench.
In the side menu, navigate to Organization Settings > Assemblers.
Find the assembler you created, leave the file format as JSON, and select Download the CoreOS Ignition File. This action will download a JSON file that you will need in the next section. You may choose a different file format if you like, but the JSON format is recommended for this type of assembler.

Repeat this process for any additional assemblers. Important: you must keep track of the files, and which came from which assembler, because each assembler has its own unique ignition file.

Step 2: Upload the Virtual Hard Disk (VHD) to Azure

In this step we create a place to store the CoreOS image in Microsoft Azure.

Note: If you prefer using the Azure CLI, see Microsoft article Upload a VHD to Azure or copy a managed disk to another region - Azure CLI. Or, follow these steps to upload the VHD through the Azure Portal:

Log in to https://portal.azure.com/.
Select Storage Accounts.
Select Create.
Select the appropriate Subscription and the Resource Group that your Network Security Group resides in.
Select a region. (This should be the same region as your Resource group.)
For Performance and Redundancy, leave set to defaults.
Select Review.
Scroll down and select Create.
After the deployment completes, select Go to resource.
Under the Properties section, select Blob service.
Select Container to create a new storage container.
Give the new container a name and select Create.
The new container is added to the list. Select the Container name.
Select Upload and choose the choose the Fedora CoreOS image file you downloaded when completing the Add a New Assembler documentation.
- Note: Be sure you have extracted the file and are uploading the .vhd file, not the compressed .xz file.
Once the upload completes, a new blob appears in the list with the name of your VHD file. Note that this upload may take a while as it is a large file.

Step 3: Create a virtual machine from the VHD

In this step we will configure our image, VM, provide the contents of our ignition file, and deploy the VM.

In Azure, type "Images" into the main search bar to quickly navigate to the Images service.
Select Create.
Configure the following:
1. Subscription / Resource Group - ensure these match what you selected for your Storage Account.
2. Name - enter a name for your image.
3. Region - select same region as your previous resources.
4. Zone Resiliency - leave unchecked.
5. OS type - Linux.
6. VM Generation - Gen 1.
7. Storage blob - browse to the Storage Account, Container, and select the image file you uploaded. Click Select.
8. Account type - your choice. This is the storage location of the image, not your VM itself, so Standard HDD performance is acceptable.
9. Host caching - leave as Read/write.
10. Key management - leave set to default.
11. Data disk - no action needed.
Select Review + Create.
After the image validates, select Create.
After the deployment completes, select Go to resource.
Select Create VM.
Configure the Basics section as follows:
1. Subscription / Resource Group - these should default to your previously selected options.
2. Virtual machine name - enter a name for your VM.
3. Region - this defaults to the region you previously selected.
4. Availability options - No infrastructure redundancy required.
5. Image - if it is not preselected, choose the image you created earlier.
6. Size - select a VM with at least 2 virtual CPUs, 8GB RAM, and 20 GB disk space.
7. Authentication type - SSH public key.
8. Username / SSH public key source / Key pair name - leave at defaults.
  - Note: Azure requires you to have an SSH key, but SSH is disabled by default on all Expel assemblers. If you require SSH access to this VM in the future, please contact support.
9. Public inbound ports - None.
10. License type - Other (the assembler is CentOS-based, which doesn't require a license).
Select Next : Disks
Configure the Disks section as follows:
1. OS disk size - select an option of at least 20 GiB.
2. OS disk type - select an SSD option of your choice.
3. Leave the rest of the options at the default values.
Select Next : Networking
Virtual network / Subnet / Public IP - Verify the network settings that Azure populates here are appropriate for your environment.
NIC network security group - Advanced.
Configure network security group appears. Select the network security group you created when you edited your firewall settings.

Note: If you haven't already updated your firewall configuration you can do it now by selecting Create new and adding the Outbound connections provided in Add a New Assembler.

Select Next : Management.
Select Next : Monitoring.
Select Next : Advanced.
Under User data, select Enable user data and paste the contents of your Ignition file into the text box that appears.
Select Next : Tags.
Select Next : Review + Create.
Review your configuration and select Create.
A Generate new key pair screen appears. Select Download private key and create resource. Delete the .pem file that downloads as SSH is disabled for assemblers by default and you won't need this file. If you require SSH access to this VM in the future, please contact support.
Wait for the VM to deploy successfully.

Step 4: Verify a “Connected” Status in Workbench

It can take 10 to 15 minutes for the assembler’s status to update in Workbench.

Log in to Workbench.
In the side menu, navigate to Organization Settings > Assemblers (or, refresh the page if you never logged out).
Find your newly created assembler(s) and verify that the status has changed from “Not Yet Connected” to “Connected.”
- If the status has not updated yet, make sure you have waited at least 15 minutes, then refresh the page and check again.

Troubleshooting

If your assembler is still not showing as “Connected” after 15 minutes:

Make sure your have the proper firewall configurations to allow our outbound ports as specified in Add a New Assembler.
Make sure your chosen machine’s size meets the required minimums (2 virtual CPUs, 8 GB RAM, and 20 GB disk space).
For additional troubleshooting, access the Serial Console of your VM in Azure and check for errors.

If all firewall and machine size settings are correct and you are still unable to connect the assembler, contact support for help.

Deploy the Assembler in Microsoft Azure