Create an Image for Linux Persistent and Non-Persistent Environments
Applies To: WatchGuard Advanced EPDR, WatchGuard EPDR, WatchGuard EDR, WatchGuard EPP, WatchGuard EDR Core
Before You Begin
Virtual environments are complex and varied. This topic describes step-by-step instructions to install WatchGuard Endpoint Security in persistent and non-persistent Virtual Desktop Infrastructure (VDI) environments. Virtual computers or instances require that you follow a specific procedure to make sure that the images or templates used in virtual environments are up-to-date, optimized, and do not have a previously-assigned machine ID. This makes sure that when the virtual computer starts, it is uniquely registered in the Endpoint Security management UI.
In some unique environments, you might have to follow the recommendations provided by the virtualization vendor to adapt these general instructions to your needs.
This installation procedure requires that you prepare a template (for persistent environments) or a gold image (for non-persistent environments) to deploy later to virtual computers on the network. It is important to follow this procedure closely to make sure that:
- The engine and signature file (knowledge) update.
- Resource and bandwidth consumption is optimized in non-persistent environments.
- Virtual instances are uniquely identified.
Prerequisites
- In persistent environments, computers must have fixed MAC addresses.
- The computer used to generate the template or gold image must have an Internet connection.
-
You must be able to download one of these tools:
-
Endpoint Agent Tool for Linux NO DEPS (without dependencies)
And, the tool must be run as root.
Compatible Systems
Generally, this procedure works for these types of virtual machines:
- VMware Workstation
- VMware Server
- VMware ESX
- VMware ESXi
- Citrix XenDesktop
- XenApp
- XenServer
- Microsoft Virtual Desktop
- Microsoft Virtual Servers
Install the Protection in Persistent Environments
Caution: It is important that you carefully follow each step in this procedure. After you complete the procedure, you must verify that all cloned devices display in the Endpoint Security management UI. Devices cloned incorrectly can affect the visibility of monitored actions, impact the reliability of the Advanced Protection, and compromise the security of your network. If you see only a single device in the management UI, you must repeat the process, rebuild the gold image, and deploy it again to the affected endpoints as soon as possible.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Install or update the operating system with the user applications.
- From the management UI, create a Virtual Machines group for new settings profiles.
- For the Virtual Machines group:
- On the Settings tab, select Per-Computer Settings and create a settings profile for future image updates.
- Make sure automatic updates of the protection engine are enabled.
- Assign these settings to the Virtual Machines group.
- Select Settings > Workstations and Servers. Create a settings profile for future image updates.
- In the General > Updates section, make sure the Automatic Knowledge Updates toggle for signature files is enabled.
- Assign these settings to the Virtual Machines group.
- Install the Endpoint Agent and protection software on the Virtual Machines group.
- On the Computers tab, select the Virtual Machines group.
- To download the installer, click Add Computers.
- Install the Endpoint Agent on the template device. The protection software is automatically installed, configured, and updated. After installation is complete, the computer appears on the list of protected computers in the management UI, with a green icon. The protection software and knowledge (signature files) are up to date.
-
Download the Endpoint Agent Tool for Linux or the Endpoint Agent Tool for Linux NO DEPS and extract it to the template device.
- Open the EndpointAgentTool folder and open the file for your operating system.
-
Run this command to restart counters and detections and to update settings and server tasks:
sudo ./EndpointAgentTool -d -c -cmd
-
If the computer is protected with anti-tamper protection, include the password after the atp parameter:
sudo ./EndpointAgentTool -pei -atp:antitamperpassword
Note: For the NO DEPS tool, you must copy the EndpointAgentTool file to /usr/local/management-agent/bin/.
- Important: Disable the Endpoint Agent service so that the service does not start automatically before the name of the virtual instance changes.
Caution: This step is critical to make sure that each virtual machine is uniquely identified in the management UI.
- Open the virtual environment management tool and generate the template. For more information, refer to your vendor documentation.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
After you create the template, you can modify the type of WatchGuard Agent service startup with scripts or other tools.
Install the Protection in Non-Persistent VDI Environments
The procedure to manage non-persistent VDI environments includes three phases.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
Before you generate a gold image, you must prepare the computer you will create the image from.
- Install or update the operating system with the user applications.
- From the management UI, create one group to host the gold image (Gold or Template Image Group), and another group to host the virtual machines (Virtual Machines Group).
- For the Gold or Template Image group:
- On the Settings tab, select Per-Computer Settings and create a settings profile for future image updates.
- Make sure to enable automatic updates of the protection software.
- Select the automatic restart option to make sure the computer updates.
- Assign these settings to the Gold or Template Image group.
- Select Settings > Workstations and Servers and create a settings profile for future image updates.
- In the General > Updates section, make sure automatic knowledge updates (signature files) are enabled.
- Assign these settings to the Gold or Template Image group.
- For the Virtual Machines group:
- Create a per-computer settings profile that has updates disabled, and assign it to the Virtual Machines group.
- Create a workstations and servers settings profile and, in the Security section, disable automatic knowledge updates.
- Assign the settings profile to the Virtual Machines group.
- Install the Endpoint Agent and protection software on the Virtual Machines group to generate the gold image.
- On the Computers tab, select the Virtual Machines group and click Add Computers to download the installer.
- Install the Endpoint Agent on the computer used to create the gold image. The protection software is automatically installed and configured. After the installation is complete, the computer appears in the list of protected computers in the management UI.
- Download the Endpoint Agent Tool for Linux or Endpoint Agent Tool for linux NO DEPS and extract it on the computer with the gold image.
Virtual instances are based on the updated gold image. To optimize the VDI server resources and reduce bandwidth usage, disable updates.
- Open the EndpointAgentTool folder.
Note: If it is the NO DEPS version, you must copy the EndpointAgentTool file to /usr/local/management-agent/bin/. - Run this command to send counters and detections, and to update settings and tasks on the server:
sudo ./EndpointAgentTool -d -c -cmd - Important: If the computer is protected with anti-tamper protection, include the password after the atp parameter:
sudo ./EndpointAgentTool -pei -gi -atp:antitamperpassword
Caution: This step is critical to make sure that each virtual computer is uniquely identified in the management UI.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
After you create the template, you can modify the type of WatchGuard Agent service startup with scripts or other tools.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
You must update the Endpoint Agent, the protection software, and signatures files in the gold image frequently (at least once a month). These updates are essential to make sure that there is maximum protection against new attack techniques developed by hackers.
To update the gold image:
- Start the computer where the gold image is installed.
- Open Windows Services and make sure that the Endpoint Agent Type of Start is Automatic and the Service Status is Running.
- From the management UI, move the computer with the gold image to the Gold or Template Image group so that it receives the appropriate settings with automatic updates of the engine and knowledge.
-
Download the Endpoint Agent Tool for Linux or Endpoint Agent Tool for linux NO DEPS and extract it to the computer with the gold image.
-
Open the EndpointAgentTool folder.
Note: If it is the NO DEPS version, you must copy the EndpointAgentTool file to /usr/local/management-agent/bin/. -
Run this command to update the Endpoint Agent and protection software if new versions are available:
sudo ./EndpointAgentTool -su -
Run this command to update protection signatures:
sudo ./EndpointAgentTool -ku -
Run this command to send counters and detections, and to update settings and tasks on the server.
sudo ./EndpointAgentTool -d -c -cmd -
If the computer is protected with anti-tamper protection, include the password after the atp parameter:
/usr/local/management-agent/bin/EndpointAgentTool -pei -gi -atp:antitamperpassword -
Important: Disable the Endpoint Agent service so it does not restart automatically before the name of the virtual instance changes.
Caution: This step is critical to make sure that each virtual instance is uniquely identified in the Endpoint Security management UI.
Verify Computers in the Management UI
To make sure that you have followed the procedure correctly, make sure that the computers display in the Endpoint Security management UI.
Caution: If you see a single device, you must remove the device from the Computers list and start the procedure from scratch, that is, rebuild the gold image and deploy it again to the affected endpoints.
Persistent Computers
To verify persistent computers, from the management UI:
- Select Computers.
- Confirm that the cloned devices display in the list.
Non-Persistent Computers
WatchGuard Endpoint Security uses the FQDN (Fully Qualified Domain Name) to identify computers with IDs that have been deleted with the Endpoint Agent Tool and that are marked as gold image.
To verify non-persistent VDI computers, from the management UI:
- Select Settings.
- From the left pane, select Computer Maintenance.
- In the VDI Environments section, click Show non-persistent computers.
The computers list displays with the non-persistent computers. - Confirm that the devices are in the list.
License Management
After you delete the agent ID and disable the Is a Gold Image option, when a new computer starts, the system calculates its machine ID and determines whether the computer is a new computer or an existing one, based on the selected environment.
Non-Persistent Environments
If the maximum number of computers that are active simultaneously for non-persistent images is set, the server manages licenses automatically, provided there are available licenses and the number of concurrent machines is not exceeded.
Persistent Environments
If there are multiple computers that you no longer use, delete them from the database to free up licenses just as you would do with physical computers. You can delete all computers, or select an individual computer to delete.