Footprint Internal Scanner - GCP Deployment

Prerequisites

• Have a running MSP Console instance that is reachable on HTTPS from the Internal Scanner that is to be deployed.

• Configure a FQDN for the MSP Console that can be resolved by the Internal Scanner.

• Allow access from the Scanner to the Console Machine over HTTPS, TCP/15671, TCP/15672, TCP/5671, TCP/5672

Note: Restricting traffic would should inaccurate Scan Results as not all ports would be reachable

Attention: Scanning over VPN or Firewall may produce overhead and performance issues. Make sure to configure scans to run outside business hours.

Deployment

1. Create a Storage Location

   1. Browse to GCP > Cloud Storage

   2. Click Create Bucket and follow the instructions

      1. Name your bucker. This requires a globally unique name. e.g: example_name_footprint_is-1

      2. Choose where to store your data. This depends on how many scanners you wish to deploy and how often. For this guide, we may pick a single Region: us-east1(South Carolina)

      3. Choose a default storage class for your data: Standard or Nearline (as you may not deploy scanners daily)

      4. Choose how to access objects: You may restrict data from being accessed from the Internet. The virtual disk itself has no company confidential information so this is purely optional. For the purpose of this guide, we will pick a Uniform without enforcement of public access prevention on this bucket. If you intend to store other information on the same bucket, please restrict access accordingly.

      5. Choose how to protect object data: None

      6. Click Create

2. Import virtual disks

   1. Import virtual disks by Transfer Data

      1. Click Transfer Data

      2. Click Transfer Data in

      3. Select URL list as the Source type and Google Cloud Storage as Destination Type

      4. In Choose a source tab insert https://update.codacloud.net/gcloud/is-vhd.txt

      5. In Choose a destination tab select the bucket / folder where you want to store the image

      6. In Choose when to run job keep the settings to run once and start now

      7. In Choose settings you can keep the same settings

      8. Click Create

   2. Import virtual disks by Upload Folder (Optional, only if Transfer Data didn’t work)

      1. Download source image and unzip the files locally. (VHD Full Image)

      2. Click Upload Files. Pick the image of choice (e.g.: IS-Full.vhd).

   3. Import virtual disks by CLI (Optional, only if Transfer Data or Upload Folder didn’t work)

      1. Download source images and unzip the files locally. (VHD Full Image)

      2. Install gcloud CLI

      3. Upload the image to bucket storage (Upload objects to bucket)

3. Create an image (Template for all Internal Scanners)

   1. Go to Create an Image page. Compute Engine > Storage > Images.

   2. Select Create Image and pick a Name

   3. Enable Compute Engine API

   4. Under Source, select Virtual disk (VMDK, VHD,..). Make sure to Enable Cloud Build API

   5. For image import to work, Cloud Build service account must be granted compute.admin and iam.serviceAccountUser roles. Press the Grant button.

   6. Browse to or manually input the storage location for the Cloud Storage file (defined in the previous chapter II).

   7. Select the operating system that is available on the imported disk. You can also make the following changes:

      1. You can choose to Install guest packages. Google recommends that you install the guest environment. For more information about the guest environment, see guest environment.

      2. Pick the Ubuntu 20.04 Environment. It may also be auto-detected. We are using the BYOL licensing option.

   8. (Optional) Specify additional properties for your image. For example, you can organize this image as part of an image family.

   9. Click Create to import the image.

4. Create the virtual machine

   1. Browse to GCP > Compute Engine > VM Instances

   2. Click Create Instance

   3. Give it a Name

   4. Pick Region and Zone

   5. Select a Machine family “General Purpose” and assign it to E2 Series (e-2-standard-2) or higher. Minimal hardware requirements are 2 vCPU, 8 GB RAM, and 80-100 GB disk

   6. Make sure to select Boot Disk and click Change in order to add the previously created image and at least 80-100 GB of disk. The image should be found in Custom Images

      

   7. Make sure to open Firewall port tcp/8080 from your Management Subnet for the Initial Setup of the Internal Scanner.

5. Setup the Internal Scanner

   1. Browse to the public IP of the droplet on port 8080 with protocol HTTP.(e.g.: http://<public_ip_address>:8080)

   2. Once connected make sure to pick a name for the scanner, and add the console URL/FQDN and token. You can find those in your Footprint Console in Agentless Scan Surface > Setup Scanners. The external IP (public_ip_address) is found in Network interfaces > External IP
      

      

   3. Once everything is setup the Internal Scanner should appear as Active in your Agentless Scan Surface > Deployed Scanners
      

      

   4. Start scanning