vASN AWS Deployment Guide

1. Architecture & Deployment Models

The vASN/ASN deployment supports multiple source and destination combinations. Choose the deployment model that matches your environment.

1.1 Deployment Models

Model	Source	Destination	Connectivity
Cloud-to-Cloud	vasn_tap on EC2	vASN in AWS	VPC internal (private IPs)
Cloud-to-OnPrem	vasn_tap on EC2	ASN on-premises	VPN / Direct Connect
VPC Traffic Mirroring	AWS VPC Traffic Mirroring	vASN in AWS	Mirror session to vASN ENI or NLB

1.2 Model A - Cloud-to-Cloud (vasn_tap → vASN)

The default hub-and-spoke model within your AWS VPC. Source agents (vasn_tap) run on workload EC2 instances, capture packets, and encapsulate them via VXLAN or GRE to a central vASN collector instance.

• Source (vasn_tap): Lightweight agent on workload EC2 instances. Captures via AF_PACKET or eBPF.

• Transport: VXLAN (UDP 4789) or GRE (Protocol 47) over VPC internal network.

• Collector (vASN): Dedicated EC2 from Aviz AMI. Terminates tunnels and processes data.

Figure 1: Hub & Spoke Architecture — vasn_tap agents forwarding to central vASN

1.3 Model B - Cloud-to-OnPrem (vasn_tap → ASN)

Source agents (vasn_tap) on EC2 instances forward captured traffic to an on-premises ASN appliance. The ASN must be reachable from the AWS VPC via AWS Site-to-Site VPN or AWS Direct Connect.

• Site-to-Site VPN: Encrypted IPsec tunnel over internet.

• Direct Connect: Dedicated private connection to AWS.

• remote_ip: Points to ASN’s reachable IP (not a VPC IP).

• MTU: May be lower due to VPN overhead — plan accordingly.

Figure 2: Cloud-to-On-Premises Deployment Model

1.4 Model C - VPC Traffic Mirroring (→ vASN)

Instead of installing vasn_tap, you can use AWS VPC Traffic Mirroring to copy network traffic from ENIs directly to a vASN instance. This is agentless — no software installation on workload instances.

How It Works

1. Create a Mirror Target pointing to the vASN instance’s ENI (or an NLB in front of it).

2. Create Mirror Filters to select which traffic to capture (by protocol, port, CIDR).

3. Create Mirror Sessions linking source ENIs to the target with the filter applied.

Figure 3: VPC Traffic Mirroring to vASN

Considerations

• Traffic is encapsulated in VXLAN (UDP 4789) by AWS automatically.

• Supported on Nitro-based instances only.

• Mirror session limit per ENI and per account — check AWS quotas.

• No agent install required on source instances.

2. Phase A - Deploy vASN

The vASN is the central node. It must be deployed first and reachable by all tap agents.

2.1 AMI Selection

Search the AWS Marketplace for Aviz vASN. Select the latest version and subscribe.

Throughput Tier	Instance Types	vCPU	RAM
Up to 1 Gbps	c5.xlarge / c5n.xlarge	4	8 GB
Up to 5 Gbps	c5.2xlarge / c5n.2xlarge	8	16 GB
Up to 10 Gbps	c5n.4xlarge	16	42 GB
Up to 25 Gbps	c5n.9xlarge	36	96 GB

2.2 Launch the Instance

1. Select the Aviz vASN AMI.

2. Choose instance type per throughput tier.

3. Place the instance in the same VPC/subnet as your workload instances (Model A) or in a subnet reachable via VPN (Model B).

4. Attach at least 2 ENIs (one for management, one+ for data ingestion).

2.3 Security Group Rules

Direction	Protocol	Port / Type	Purpose
Inbound	UDP	4789	VXLAN tunnel from vasn_tap or VPC mirror
Inbound	IP Protocol 47	N/A (GRE)	GRE tunnel from vasn_tap
Inbound	TCP	22	SSH management
Inbound	TCP	443	FlowVision UI / REST API
Outbound	All	All	Default — allow all outbound

2.4 Disable Source/Dest Check

Crucial for the vASN to receive tunnelled traffic:

# Via CLI

aws ec2 modify-instance-attribute --instance-id i-0abcd1234efgh5678 --no-source-dest-check

2.5 Verify vASN Service

ssh -i your-key.pem ec2-user@<vASN-IP>
sudo systemctl status vasn

2.6 Confirm ENI Attachment

ip link show

# Verify data ENI (e.g. eth1) is UP

2.7 FlowVision for vASN Orchestration

vASN can be configured and managed from Aviz Flow Vision application. Refer FV guide for more details.

3. Phase B - Deploy vasn_tap (Source)

The vasn_tap agent is installed on each workload EC2 instance you want to monitor.

3.1 Prerequisites

Requirement	Detail
OS	Ubuntu 20.04+, Ubuntu 22.04, Amazon Linux 2023, RHEL 9
Kernel (AF_PACKET)	≥ 3.2
Kernel (eBPF)	≥ 5.10 with BTF (/sys/kernel/btf/vmlinux)
Privileges	Root (or CAP_NET_RAW, CAP_NET_ADMIN)
Dependencies	None — prebuilt package is statically linked

3.2 Transfer & Install

# Obtain the vasn_tap-v2.4.tar.gz from Aviz Support

scp -i your-key.pem vasn_tap-v2.4.tar.gz ec2-user@<IP>:/tmp/

# SSH into the source instance

ssh -i your-key.pem ec2-user@<IP>

# Extract and install

tar -xzf /tmp/vasn_tap-v2.4.tar.gz
cd vasn_tap-v2.4
sudo ./install.sh

The installer places:

• vasn_tap binary → /usr/local/bin/

• Config → /etc/vasn_tap/config.yaml

• vasn_tapctl control script in PATH

• systemd service unit (not auto-started)

4. Phase C - Configuration

Edit the config on each source instance. The remote_ip must be the IP of your vASN instance (cloud-to-cloud) or ASN appliance (cloud-to-on-prem).

4.1 VXLAN Tunnel (Recommended)

# /etc/vasn_tap/config.yaml

runtime:
  input_iface: eth0
  output_iface: eth0
  mode: afpacket
  stats: true
filter:
  default_action: allow
rules:
  match: "tcp port 443"
  action: allow
tunnel:
  type: vxlan
  remote_ip: 10.0.1.50  # vASN private IP
  vni: 100
  dstport: 4789

4.2 GRE Tunnel

tunnel:
  type: gre
  remote_ip: 10.0.1.50
  key: 42

4.3 eBPF Capture Mode

runtime:
  mode: ebpf
  input_iface: eth0
  output_iface: eth0

4.4 Truncation

runtime:
  truncate:
    enabled: true
    length: 128   # 64–9000 bytes

4.5 Configuration Reference

Section	Key	Required	Description
runtime	input_iface	Yes	Input interface name (e.g. eth0)
runtime	output_iface	When tunnel	Output interface to reach vASN/ASN
runtime	mode	Yes	afpacket or ebpf
runtime	workers	No	Worker count (AF_PACKET only; 0 = auto)
runtime	stats	No	Enable file-based stats (default: true)
filter	default_action	Yes	allow or drop
filter	rules	Yes	Rule list (max 128). First match wins.
tunnel	type	When tunnel	vxlan or gre
tunnel	remote_ip	When tunnel	vASN or ASN IP address
tunnel	vni / dstport	VXLAN	VNI and UDP port (default 4789)
tunnel	key	GRE (opt)	Optional GRE key

5. Phase D - Validation & Handshake

5.1 Validate Configuration

sudo vasn_tapctl validate

5.2 Dry Run (Optional)

# Full init without capturing

sudo vasn_tapctl dry-run

Do not run dry-run while the service is active. Stop first with vasn_tapctl stop.

5.3 Start the Service

sudo vasn_tapctl start
sudo vasn_tapctl status

5.4 Verify Traffic Flow

# Watch live counters

sudo vasn_tapctl counters --watch

Confirm TX packet counts are incrementing. If they remain at zero, see Troubleshooting.

6. AWS-Specific Constraints

MTU Management

AWS VPC supports MTU up to 9001 (Jumbo Frames). VXLAN adds 50 bytes overhead. Ensure your interface MTU accommodates the encapsulated size. Set source interface MTU to ≤ 8951 when using VXLAN with jumbo frames.

Source/Dest Check

Must be disabled on the vASN instance. AWS enables this by default, which drops traffic not addressed to the instance’s own IP.

Security Groups

Both source and destination SGs must allow the tunnel protocol (UDP 4789 for VXLAN, IP Protocol 47 for GRE).

Multi-AZ

vasn_tap → vASN traffic across AZs incurs inter-AZ data transfer costs. For high-volume deployments, consider one vASN per AZ.

7. Operations

7.1 Service Management

sudo vasn_tapctl start
sudo vasn_tapctl stop
sudo vasn_tapctl restart
sudo vasn_tapctl status

7.2 Statistics

# One-shot counters

sudo vasn_tapctl counters

# Live-updating counters

sudo vasn_tapctl counters --watch

7.3 Upgrade

sudo vasn_tapctl stop

# Replace the binary

sudo cp vasn_tap_new /usr/local/bin/vasn_tap
sudo vasn_tapctl start

# Version info

vasn_tapctl version

7.4 Logs

sudo vasn_tapctl logs
journalctl -u vasn_tap -f

8. Troubleshooting

Issue	Resolution
Tunnel init fails / ARP failed	Ensure output_iface can reach remote_ip. Ping the vASN/ASN IP to populate ARP cache, then restart.
TX always 0	Check output_iface is set. Verify filter default_action is ‘allow’. Check Security Group allows tunnel protocol.
Permission denied	Run with sudo. vasn_tap requires root for raw sockets.
Config change not applied	Restart the service: sudo vasn_tapctl restart. Config is read only at startup.
Interface not found	Verify names with ‘ip link show’. Use exact name in config.
eBPF: BTF not found	Use mode: afpacket, or upgrade kernel to ≥ 5.10 with BTF.
Shared library errors	Contact Aviz — the prebuilt package should have no library dependencies.
On-prem ASN unreachable	Verify VPN/Direct Connect is active. Check route tables. Test with ping or traceroute.
VPC Mirror traffic not arriving	Confirm mirror session is active. Check vASN SG allows UDP 4789. Ensure source is Nitro-based.

9. Support

If traffic is not reaching vASN, contact Aviz Support:

1. Run: sudo vasn_tapctl show-tech -o /tmp/aviz_bundle.txt on the source instance.

2. Run: journalctl -u vasn > /tmp/vasn_logs.txt

3. Send both files to [e-mail]

# Generate tech support bundle

sudo vasn_tapctl show-tech -o /tmp/aviz_bundle.txt

# Or print to stdout

sudo vasn_tapctl show-tech

Automated Deployment with Terraform: All deployment steps can be automated using Terraform. Contact Aviz Support at [e-mail] for pre-validated Terraform scripts.