You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/databox-online/azure-stack-edge-pro-2-deploy-activate.md
+17-17Lines changed: 17 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ author: alkohli
7
7
ms.service: databox
8
8
ms.subservice: edge
9
9
ms.topic: tutorial
10
-
ms.date: 02/11/2022
10
+
ms.date: 03/03/2022
11
11
ms.author: alkohli
12
12
# Customer intent: As an IT admin, I need to understand how to activate Azure Stack Edge Pro 2 so I can use it to transfer data to Azure.
13
13
---
@@ -29,9 +29,9 @@ Before you configure and set up your Azure Stack Edge Pro 2, make sure that:
29
29
30
30
* For your physical device:
31
31
32
-
- You've installed the physical device as detailed in [Install Azure Stack Edge Pro](azure-stack-edge-pro-2-deploy-install.md).
32
+
- You've installed the physical device as detailed in [Install Azure Stack Edge Pro 2](azure-stack-edge-pro-2-deploy-install.md).
33
33
- You've configured the network and compute network settings as detailed in [Configure network, compute network, web proxy](azure-stack-edge-pro-2-deploy-configure-network-compute-web-proxy.md)
34
-
- You have uploaded your own or generated the device certificates on your device if you changed the device name or the DNS domain via the **Device** page. If you haven't done this step, you will see an error during the device activation and the activation will be blocked. For more information, go to [Configure certificates](azure-stack-edge-pro-2-deploy-configure-certificates.md).
34
+
- You've uploaded your own or generated the device certificates on your device if you changed the device name or the DNS domain via the **Device** page. If you haven't done this step, you'll see an error during the device activation and the activation will be blocked. For more information, go to [Configure certificates](azure-stack-edge-pro-2-deploy-configure-certificates.md).
35
35
36
36
* You have the activation key from the Azure Stack Edge service that you created to manage the Azure Stack Edge Pro 2 device. For more information, go to [Prepare to deploy Azure Stack Edge Pro 2](azure-stack-edge-pro-2-deploy-prep.md).
37
37
@@ -41,24 +41,23 @@ Before you configure and set up your Azure Stack Edge Pro 2, make sure that:
41
41
1. In the local web UI of the device, go to **Get started** page.
42
42
2. On the **Activation** tile, select **Activate**.
43
43
44
-
44
+
45
45
46
46
3. In the **Activate** pane, enter the **Activation key** that you got in [Get the activation key for Azure Stack Edge Pro](azure-stack-edge-gpu-deploy-prep.md#get-the-activation-key).
47
47
48
-
4. Select **Apply**.
48
+
4. Select **Activate**.
49
49
50
-
50
+
51
51
52
52
53
-
5. First the device is activated. You are then prompted to download the key file.
53
+
5. First the device is activated. You're then prompted to download the key file.
54
54
55
-
55
+
56
56
57
57
Select **Download and continue** and save the *device-serial-no.json* file in a safe location outside of the device. **This key file contains the recovery keys for the OS disk and data disks on your device**. These keys may be needed to facilitate a future system recovery.
58
58
59
59
Here are the contents of the *json* file:
60
60
61
-
62
61
```json
63
62
{
64
63
"Id": "<Device ID>",
@@ -67,23 +66,24 @@ Before you configure and set up your Azure Stack Edge Pro 2, make sure that:
67
66
"hcsdata": "<BitLocker key for data disk>"
68
67
},
69
68
"SystemVolumeBitLockerRecoveryKey": "<BitLocker key for system volume>",
69
+
"SEDEncryptionExternalKey": "<Encryption-at-rest key for encrypted disks>",
70
70
"ServiceEncryptionKey": "<Azure service encryption key>"
71
71
}
72
-
```
73
-
72
+
```
74
73
75
74
The following table explains the various keys:
76
75
77
76
|Field |Description |
78
77
|---------|---------|
79
78
|`Id` | This is the ID for the device. |
80
-
|`DataVolumeBitLockerExternalKeys`|These are the BitLockers keys for the data disks and are used to recover the local data on your device.|
79
+
|`DataVolumeBitLockerExternalKeys`|These are the BitLocker keys for the data disks and are used to recover the local data on your device.|
81
80
|`SystemVolumeBitLockerRecoveryKey`| This is the BitLocker key for the system volume. This key helps with the recovery of the system configuration and system data for your device. |
82
-
|`ServiceEncryptionKey`| This key protects the data flowing through the Azure service. This key ensures that a compromise of the Azure service will not result in a compromise of stored information. |
81
+
|`SEDEncryptionExternalKey`| This user provided or system generated key is used to protect the self-encrypting data drives that have a built-in encryption. |
82
+
|`ServiceEncryptionKey`| This key protects the data flowing through the Azure service. This key ensures that a compromise of the Azure service won't result in a compromise of stored information. |
83
83
84
84
6. Go to the **Overview** page. The device state should show as **Activated**.
85
85
86
-
<!---->
86
+
87
87
88
88
The device activation is complete. You can now add shares on your device.
89
89
@@ -93,7 +93,7 @@ If you encounter any issues during activation, go to [Troubleshoot activation an
93
93
94
94
## Deploy workloads
95
95
96
-
After you have activated the device, the next step is to deploy workloads.
96
+
After you've activated the device, the next step is to deploy workloads.
97
97
98
98
- To deploy VM workloads, see [What are VMs on Azure Stack Edge?](azure-stack-edge-gpu-virtual-machine-overview.md) and the associated VM deployment documentation.
99
99
- To deploy network functions as managed applications:
@@ -117,7 +117,7 @@ In this tutorial, you learned about:
117
117
> * Prerequisites
118
118
> * Activate the physical device
119
119
120
-
To learn how to transfer data with your Azure Stack Edge device, see:
120
+
To learn how to deploy workloads on your Azure Stack Edge device, see:
121
121
122
122
> [!div class="nextstepaction"]
123
-
> [Transfer data with Azure Stack Edge](./azure-stack-edge-gpu-deploy-add-shares.md)
123
+
> [Configure compute to deploy IoT Edge and Kubernetes workloads on Azure Stack Edge](./azure-stack-edge-gpu-deploy-configure-compute.md)
Copy file name to clipboardExpand all lines: articles/databox-online/azure-stack-edge-pro-2-deploy-configure-certificates.md
+41-15Lines changed: 41 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ author: alkohli
7
7
ms.service: databox
8
8
ms.subservice: edge
9
9
ms.topic: tutorial
10
-
ms.date: 02/09/2022
10
+
ms.date: 03/02/2022
11
11
ms.author: alkohli
12
12
# Customer intent: As an IT admin, I need to understand how to configure certificates for Azure Stack Edge Pro 2 so I can use it to establish a trust relationship between the device and the clients accessing the device.
13
13
---
@@ -23,6 +23,7 @@ In this tutorial, you learn about:
23
23
>
24
24
> * Prerequisites
25
25
> * Configure certificates for the physical device
26
+
> * Configure encryption-at-rest
26
27
27
28
## Prerequisites
28
29
@@ -41,13 +42,15 @@ Before you configure and set up your Azure Stack Edge Pro 2 device, make sure th
41
42
42
43
1. Open the **Certificates** page in the local web UI of your device. This page will display the certificates available on your device. The device is shipped with self-signed certificates, also referred to as the device certificates. You can also bring your own certificates.
43
44
44
-
1.If you didn't change the device name or DNS domain when you [configured device settings earlier](azure-stack-edge-gpu-deploy-set-up-device-update-time.md#configure-device-settings), and you don't want to use your own certificates, you don't need any configuration on this page. You just need to verify that the status of all the certificates shows as valid on this page.
45
+
1.*Follow this step only if you didn't change the device name or DNS domain when you [configured device settings earlier](azure-stack-edge-gpu-deploy-set-up-device-update-time.md#configure-device-settings), and you don't want to use your own certificates.*
45
46
46
-
47
+
You don't need to perform any configuration on this page. You just need to verify that the status of all the certificates shows as valid on this page.
47
48
48
-
You're ready to [Activate your device](azure-stack-edge-gpu-deploy-activate.md) with the existing device certificates.
49
+
49
50
50
-
1. Follow these steps only if you've changed the device name or the DNS domain for your device. In these instances, the status of your device certificates will be **Not valid**. That's because the device name and DNS domain in the certificates' `subject name` and `subject alternative` settings are out of date.
51
+
You're ready to configure [Encryption-at-rest](#configure-encryption-at-rest) with the existing device certificates.
52
+
53
+
1.*Follow the remaining steps only if you've changed the device name or the DNS domain for your device.* In these instances, the status of your device certificates will be **Not valid**. That's because the device name and DNS domain in the certificates' `subject name` and `subject alternative` settings are out of date.
51
54
52
55
You can select a certificate to view status details.
53
56
@@ -62,13 +65,12 @@ Before you configure and set up your Azure Stack Edge Pro 2 device, make sure th
62
65
- You can choose to bring some of your own certificates and generate some device certificates. The **Generate all the device certificates** option only regenerates the device certificates.
63
66
64
67
65
-
66
-
3. When you have a full set of valid certificates for your device, the device is ready for activation. Select **< Back to Get started** to proceed to the next deployment step, [Activate your device](azure-stack-edge-gpu-deploy-activate.md).
68
+
1. When you have a full set of valid certificates for your device, select **< Back to Get started**. You can now proceed to configure [Encryption-at-rest](#configure-encryption-at-rest).
67
69
68
70
<!---->
69
71
70
72
71
-
## Generate device certificates
73
+
###Generate device certificates
72
74
73
75
Follow these steps to generate device certificates.
74
76
@@ -129,7 +131,7 @@ If using Azure Storage Explorer, you'll need to install certificates on your cli
129
131
> - You can decide to have a mix of device generated certificates and bring your own certificates as long as other certificate requirements are met. For more information, go to [Certificate requirements](azure-stack-edge-gpu-certificate-requirements.md).
130
132
131
133
132
-
## Bring your own certificates
134
+
###Bring your own certificates
133
135
134
136
You can bring your own certificates.
135
137
@@ -142,25 +144,25 @@ Follow these steps to upload your own certificates including the signing chain.
142
144
143
145
1. To upload certificate, on the **Certificate** page, select **+ Add certificate**.
144
146
145
-
147
+
146
148
147
149
2. You can skip this step if you included all certificates in the certificate path when you [exported certificates in .pfx format](azure-stack-edge-gpu-prepare-certificates-device-upload.md#export-certificates-as-pfx-format-with-private-key). If you didn't include all certificates in your export, upload the signing chain, and then select **Validate & add**. You need to do this before you upload your other certificates.
148
150
149
151
In some cases, you may want to bring a signing chain alone for other purposes - for example, to connect to your update server for Windows Server Update Services (WSUS).
150
152
151
-
153
+
152
154
153
155
3. Upload other certificates. For example, you can upload the Azure Resource Manager and Blob storage endpoint certificates.
154
156
155
-
157
+
156
158
157
159
You can also upload the local web UI certificate. After you upload this certificate, you'll be required to start your browser and clear the cache. You'll then need to connect to the device local web UI.
158
160
159
-
161
+
160
162
161
163
You can also upload the node certificate.
162
164
163
-
165
+
164
166
165
167
At any time, you can select a certificate and view the details to ensure that these match with the certificate that you uploaded.
166
168
@@ -174,7 +176,30 @@ Follow these steps to upload your own certificates including the signing chain.
174
176
> Except for Azure public cloud, signing chain certificates are needed to be brought in before activation for all cloud configurations (Azure Government or Azure Stack).
175
177
176
178
177
-
Your device is now ready to be activated. Select **< Back to Get started**.
179
+
## Configure encryption-at-rest
180
+
181
+
1. On the **Security** tile, select **Configure** for encryption-at-rest.
182
+
183
+
> [!NOTE]
184
+
> This is a required setting and until this is successfully configured, you can't activate the device.
185
+
186
+
At the factory, once the devices are imaged, the volume level BitLocker encryption is enabled. After you receive the device, you need to configure the encryption-at-rest. The storage pool and volumes are recreated and you can provide BitLocker keys to enable encryption-at-rest and thus create a second layer of encryption for your data-at-rest.
187
+
188
+
1. In the **Encryption-at-rest** pane, provide a 32 character long Base-64 encoded key. This is a one-time configuration and this key is used to protect the actual encryption key. You can choose to automatically generate this key.
189
+
190
+
191
+
192
+
You can also enter your own Base-64 encoded ASE-256 bit encryption key.
193
+
194
+
195
+
196
+
The key is saved in a key file on the **Cloud details** page after the device is activated.
197
+
198
+
1. Select **Apply**. This operation takes several minutes and the status of operation is displayed.
199
+
200
+
201
+
202
+
1. After the status shows as **Completed**, your device is now ready to be activated. Select **< Back to Get started**.
178
203
179
204
180
205
## Next steps
@@ -185,6 +210,7 @@ In this tutorial, you learn about:
185
210
>
186
211
> * Prerequisites
187
212
> * Configure certificates for the physical device
213
+
> * Configure encryption-at-rest
188
214
189
215
To learn how to activate your Azure Stack Edge Pro GPU device, see:
0 commit comments