```
\# Extract and install
```shellscript
tar -xzf /tmp/vasn_tap-v2.4.tar.gz
cd vasn_tap-v2.4
sudo ./install.sh
```
The installer places:
* ```shellscript
vasn_tap binary → /usr/local/bin/
```
* ```shellscript
Config → /etc/vasn_tap/config.yaml
```
* ```shellscript
vasn_tapctl control script in PATH
```
* ```shellscript
systemd service unit (not auto-started)
```
### 4. Phase C - Configuration
Edit the config on each source instance. The remote\_ip must be the IP of your vASN instance (cloud-to-cloud) or ASN appliance (cloud-to-on-prem).
#### 4.1 VXLAN Tunnel (Recommended)
\# /etc/vasn\_tap/config.yaml
runtime:
input_iface: eth0
output_iface: eth0
mode: afpacket
stats: true
filter:
default_action: allow
rules:
match: "tcp port 443"
action: allow
tunnel:
type: vxlan
remote_ip: 10.0.1.50 # vASN private IP
vni: 100
dstport: 4789
#### 4.2 GRE Tunnel
```shellscript
tunnel:
type: gre
remote_ip: 10.0.1.50
key: 42
```
#### 4.3 eBPF Capture Mode
```shellscript
runtime:
mode: ebpf
input_iface: eth0
output_iface: eth0
```
#### 4.4 Truncation
```shellscript
runtime:
truncate:
enabled: true
length: 128 # 64–9000 bytes
```
#### 4.5 Configuration Reference
| Section | Key | Required | Description |
| ------- | --------------- | ----------- | ---------------------------------------- |
| runtime | input\_iface | Yes | Input interface name (e.g. eth0) |
| runtime | output\_iface | When tunnel | Output interface to reach vASN/ASN |
| runtime | mode | Yes | afpacket or ebpf |
| runtime | workers | No | Worker count (AF\_PACKET only; 0 = auto) |
| runtime | stats | No | Enable file-based stats (default: true) |
| filter | default\_action | Yes | allow or drop |
| filter | rules | Yes | Rule list (max 128). First match wins. |
| tunnel | type | When tunnel | vxlan or gre |
| tunnel | remote\_ip | When tunnel | vASN or ASN IP address |
| tunnel | vni / dstport | VXLAN | VNI and UDP port (default 4789) |
| tunnel | key | GRE (opt) | Optional GRE key |
### 5. Phase D - Validation & Handshake
#### 5.1 Validate Configuration
```shellscript
sudo vasn_tapctl validate
```
#### 5.2 Dry Run (Optional)
\# Full init without capturing
```shellscript
sudo vasn_tapctl dry-run
```
| Do not run dry-run while the service is active. Stop first with vasn\_tapctl stop. |
| ---------------------------------------------------------------------------------- |
#### 5.3 Start the Service
```shellscript
sudo vasn_tapctl start
sudo vasn_tapctl status
```
#### 5.4 Verify Traffic Flow
\# Watch live counters
```shellscript
sudo vasn_tapctl counters --watch
```
Confirm TX packet counts are incrementing. If they remain at zero, see Troubleshooting.
### 6. AWS-Specific Constraints
**MTU Management**
AWS VPC supports MTU up to 9001 (Jumbo Frames). VXLAN adds 50 bytes overhead. Ensure your interface MTU accommodates the encapsulated size. Set source interface MTU to ≤ 8951 when using VXLAN with jumbo frames.
**Source/Dest Check**
Must be disabled on the vASN instance. AWS enables this by default, which drops traffic not addressed to the instance’s own IP.
**Security Groups**
Both source and destination SGs must allow the tunnel protocol (UDP 4789 for VXLAN, IP Protocol 47 for GRE).
**Multi-AZ**
vasn\_tap → vASN traffic across AZs incurs inter-AZ data transfer costs. For high-volume deployments, consider one vASN per AZ.
### 7. Operations
#### 7.1 Service Management
```shellscript
sudo vasn_tapctl start
sudo vasn_tapctl stop
sudo vasn_tapctl restart
sudo vasn_tapctl status
```
#### 7.2 Statistics
\# One-shot counters
```shellscript
sudo vasn_tapctl counters
```
\# Live-updating counters
```shellscript
sudo vasn_tapctl counters --watch
```
#### 7.3 Upgrade
```shellscript
sudo vasn_tapctl stop
```
\# Replace the binary
```shellscript
sudo cp vasn_tap_new /usr/local/bin/vasn_tap
sudo vasn_tapctl start
```
\# Version info
```shellscript
vasn_tapctl version
```
#### 7.4 Logs
```shellscript
sudo vasn_tapctl logs
journalctl -u vasn_tap -f
```
### 8. Troubleshooting
| Issue | Resolution |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Tunnel init fails / ARP failed | Ensure output\_iface can reach remote\_ip. Ping the vASN/ASN IP to populate ARP cache, then restart. |
| TX always 0 | Check output\_iface is set. Verify filter default\_action is ‘allow’. Check Security Group allows tunnel protocol. |
| Permission denied | Run with sudo. vasn\_tap requires root for raw sockets. |
| Config change not applied | Restart the service: sudo vasn\_tapctl restart. Config is read only at startup. |
| Interface not found | Verify names with ‘ip link show’. Use exact name in config. |
| eBPF: BTF not found | Use mode: afpacket, or upgrade kernel to ≥ 5.10 with BTF. |
| Shared library errors | Contact Aviz — the prebuilt package should have no library dependencies. |
| On-prem ASN unreachable | Verify VPN/Direct Connect is active. Check route tables. Test with ping or traceroute. |
| VPC Mirror traffic not arriving | Confirm mirror session is active. Check vASN SG allows UDP 4789. Ensure source is Nitro-based. |
### 9. Support
If traffic is not reaching vASN, contact Aviz Support:
1. Run: sudo vasn\_tapctl show-tech -o /tmp/aviz\_bundle.txt on the source instance.
2. Run: journalctl -u vasn > /tmp/vasn\_logs.txt
3. Send both files to
\# Generate tech support bundle
```shellscript
sudo vasn_tapctl show-tech -o /tmp/aviz_bundle.txt
```
\# Or print to stdout
```shellscript
sudo vasn_tapctl show-tech
```
> Automated Deployment with Terraform: All deployment steps can be automated using Terraform. Contact Aviz Support at for pre-validated Terraform scripts.