Configure Bastion Orchestrator

Ensure you have two Orchestrators ready to be set up as a Bastion pair and you have set the session.options.enableBastionOrchestrator system property to True in both the Orchestrators. By default, this system property is set to False.
Ensure you have at least one Operator Superuser created in the Production Orchestrator.

Only an Operator Superuser can perform Bastion Orchestrator configuration. The Bastion Orchestrator configuration involves configuring two Orchestrators as a Bastion pair.

Note: In this document, the term "Bastion Orchestrator" is used interchangeably with the term "Public Orchestrator", and the term "Production Orchestrator" is used interchangeably with the term "Private Orchestrator".

To create a Bastion pair using two Orchestrators, configure one Orchestrator as Public (Bastion) and another as Private (Production) by performing the following steps:

Configure one of the two Orchestrators as a Public Orchestrator.
1. In a web browser, launch the Orchestrator application that needs to be configured as a Public Orchestrator, and login as an Operator user.
2. Select the Orchestrator tab.
  The Bastion Orchestrator Configuration page appears.
  
  Figure 1. Bastion Orchestrator Configuration
3. Under Orchestrator Role, select Public Orchestrator for the Bastion Role and enter the following configuration details:
  - Private Orchestrator Address- The IP address of the Production Orchestrator.
  - Private Orchestrator UUID- A Universal Unique Identifier value that is specified in the vco.uuid System Property of the Production Orchestrator.
  - Private Orchestrator Source IP- The NATed Source IP address of the Production Orchestrator.
4. Select Make Public to make the Orchestrator as a Public Orchestrator.
  
  Figure 2. Public Orchestrator
5. Select Reconfigure if you want to make any changes to the configuration details.
6. Select Log Out if you want to log out of the Public Orchestrator.
Configure the second Orchestrator as a Private Orchestrator.
1. In a web browser, launch the Orchestrator application that needs to be configured as a Private Orchestrator, and login as an Operator user.
2. In the Orchestrator UI, select Orchestrator.
  The Bastion Orchestrator Configuration page appears.
3. Under Orchestrator Role, select Private Orchestrator for the Bastion Role and enter the following configuration details:
  Figure 3. Bastion Orchestrator Configuration
  - Public Orchestrator Address- The IP address of the Public (Bastion) Orchestrator.
  - Public Orchestrator UUID- A Universal Unique Identifier value that is specified in the vco.uuid System Property of the Public Orchestrator.
  - Operator Superuser- From the drop-down list, select an Operator Super user to be staged along with this Bastion configuration. Once the Bastion connection is established between the Public and Private Orchestrators, only the Operator Super user who is staged in this step will gain emergency access to the Public Orchestrator.
    Note: VeloCloud SD-WAN allows you to stage only one Operator Super user to the Public Orchestrator during the Bastion configuration, however; for troubleshooting purposes, you can stage multiple Operator users to Public Orchestrator after the Bastion is configured. To stage Operator users post-Bastion configuration, navigate to Administration > User Management > Users > Select a User > More > Stage to Bastion in the Production Orchestrator.
    
    Figure 4. User Management
4. Select TEST CONNECTIVITY to test the connection between Public and Private Orchestrators.
5. Select Make Private.
6. The connection between Public and Private Orchestrators is tested and if the connection is successful, the Bastion pairing is established between the two Orchestrators.
  
  Note: Unpairing of Public Orchestrator from the Production Orchestrator ( Return to Standalone Mode operation) is not supported in the 4.3.0 release.
  
  Figure 5. Private Orchestrator
The Bastion Orchestrator configuration is complete, and both the Public and Private Orchestrators are configured as a Bastion pair. In the Bastion setup, only the configured Operator Super user can then access the Public Orchestrator in read-only mode.

You can stage an Enterprise customer and Edges to Bastion Orchestrator. For steps, see Stage an Edge to Bastion Orchestrator.

VeloCloud SD-WAN 6.0 - Configuration Guide - Configure Bastion Orchestrator Print

Configure Bastion Orchestrator