BlastShield Documentation

1. Request the Orchestrator BSI invitation file and the administrator BSI invitation file from BlastWave. This are used for registering the BlastShield network and for registering the administrator user.

2. The Orchestrator will use UDP port 12345 for communications. Please forward UDP Port 12345 inbound on the firewall to the Orchestrator.

3. Install a BlastShield Client on the administrator workstation. You can download the Client from here.

4. Download the Orchestrator firmware. You can download the Orchestrator firmware here.

5. Make sure you have a suitable hardware platform on which to install the Orchestrator.

In this step you will be downloading the BlastShield™ Orchestrator Software Installer. Using the Invitation (.bsi) file you received from BlastWave, you will prepare a USB installer to install the software on your x86 platform and bind it to the BlastShield™ Network. Below are the steps to prepare the installation media.

1. Download the firmware if you have not already done. You can download the Orchestrator firmware here

2. Unzip the Installer Package (Do NOT run the Installer file).

3. Write the Installer image to a USB drive using any available image writer

   Note: there are several free utilities available for writing images to USB drives. We recommend the balenaEtcher software, but you can use any utility.

4. Once you have written the image to the USB, copy the Orchestrator BSI invitation file into the root folder of this image on the USB.

5. Create a file and name it authorized_keys

   1. This file should contain a SSH public key in one-line OpenSSH format which will be used by the administrator to apply the license to the Orchestrator immediately after installation.

   2. Add the SSH public key to the authorized_keys file and copy this file to the root folder of the USB.

In this step you will be booting the x86 platform from the USB image created in the previous step.

Connect your x86 platform as shown here and then follow the steps below.

1. Making sure the x86 server is connected as shown above, power it on and exit the boot sequence using the break key that applies to your hardware, then select the boot setup menu. Ensure the USB boot media is connected.

2. Re-boot your server from the USB image, once the image boots you will begin the setup process.

3. Select the uplink (network) interface for the Gateway from the displayed list (note that the Orchestrator will not use any endpoint interfaces).

4. Set the IP address, Default Gateway and DNS server IP address. Please note that for an airgapped Orchestrator, the DNS IP address must be configured to the same address as the Orchestrator IP address (for a non-airgapped Orchestrator deployment you should provision the DNS to your network's preferred DNS server, please refer to the non-airgapped x86 installation for more details).

5. Wait for the network interface to come up.

6. Select the invitation (.bsi) file.

7. Select the target device (hard drive).

8. Confirm that all data will be erased and the image will be installed on the server.

9. When the installation is complete you will be prompted to remove the USB media. at this point, and the server will re-boot.

   1. Remove the USB.

   2. Click on OK

   3. The VM will gracefully restart.

10. Once the Orchestrator has started, you will see the local maintenance interface displayed on the console. The local IP address of the Orchestrator is displayed. You will use this address to SSH to the Orchestrator in the next step.

11. Forward UDP Port 12345 inbound on the firewall to the Orchestrator.

1. SSH as admin into the new Orchestrator. Authentication is done by your SSH public key which was added during the VM setup.

2. Copy the content of license_req.json which is generated in the home directory of the admin user. 

   $ cat license_req.json

3. Return this content to BlastWave. BlastWave will reply with a license key.

4. Whilst still connected to the Orchestrator by SSH, run the apply-license command and hit enter.

   $ apply-license

5. You will see the following prompt:

   License:

6. At this prompt, paste the license key information to the command line and hit enter to start the Orchestrator.

   License:{"license": "..."}

Any device running the BlastShield™ Client must have it's DNS set to the IP address of the Orchestrator.

1. In a Windows desktop OS, you can change the DNS settings in the network interface properties > TCP/IPV4 settings.

   On macOS the DNS can be changed in the network System Settings

2. For networks which use an on-premise Microsoft DNS or an AD server for DNS, then a conditional forwarder can be added with the Orchestrator IP address as shown for the domain blastshield.app. In the example images below, 192.168.247.1 is the IP of the Orchestrator.

Here you will use the administrator BSI invitation file which you received from BlastWave to register and connect to the Orchestrator as the administrator user.

1. Ensure your registered FIDO 2 Key is plugged into your computer.

2. Launch the BlastShield™ Client App and click on FIDO2 Key.

3. Enter the security PIN for your FIDO 2 Key.

4. Select Add new - this is when you will register this key to the network.

5. Locate and select the administrator invitation file (.bsi) for this key.

6. Enter a name for this network (Note: this can be any name of your choosing).

7. You will be prompted to touch both metal sides of your FIDO 2 key to create new credentials.

8. Next, you will be prompted to touch the key again to sign in to the network.

9. At this point you have registered your FIDO2 key to the network, and are signed in to the BlastShield™ network.

1. On the BlastShield™ Client, click on the Launch Orchestrator button.

2. Interact with your FIDO2 key when prompted.

3. The Orchestrator administration UI will open in your default web browser. At this stage the UI web server will be using a self-signed certificate for HTTPS, so you should acknowledge the browser security warning.