As part of your migration journey to Azure, you discover your servers for assessment and migration.
This tutorial shows you how to discover Amazon Web Services (AWS) instances with the Azure Migrate: Discovery and Assessment tool using a lightweight Azure Migrate appliance. You deploy the appliance as a physical server to continuously discover machine and performance metadata.
In this blog, you learn how to:
Set up an Azure account.
Prepare AWS instances for discovery.
Create a project.
Set up the Azure Migrate appliance.
Start continuous discovery.
Prerequisites
Before you start this tutorial, check you have these prerequisites in place.
Requirement | Details |
Appliance | You need an EC2 VM to run the Azure Migrate appliance. The machine should have: - Windows Server 2016 installed. Running the appliance on a machine with Windows Server 2019 isn't supported. - 16 GB RAM, 8 vCPUs, around 80 GB of disk storage, and an external virtual switch. - A static or dynamic IP address with internet access, either directly or through a proxy. |
Windows instances | Allow inbound connections on WinRM port 5985 (HTTP) for discovery of Windows servers. |
Linux instances | Allow inbound connections on port 22 (TCP) for the discovery of Linux servers. The instances should use bash as the default shell otherwise discovery will fail. |
Prepare an Azure user account
To create a project and register the Azure Migrate appliance, you need an account with:
Contributor or Owner permissions on an Azure subscription.
Permissions to register Azure Active Directory apps.
If you just created a free Azure account, you're the owner of your subscription. If you're not the subscription owner, work with the owner to assign the permissions as follows:
1. In the Azure portal, search for "subscriptions", and under Services, select Subscriptions.
2. In the Subscriptions page, select the subscription you want to create a project.
3. Select Access Control (IAM).
4. Select Add > Add role assignment to open the Add role assignment page.
5. Assign the following role. For detailed steps, see Assign Azure roles using the Azure portal.
Setting | Value |
Role | Contributor or Owner |
Assign access to | User |
Members | azmigrateuser |
6. To register the appliance, your Azure account needs permission to register Azure Active Directory apps.
7. In the Azure portal, navigate to Azure Active Directory > Users > User Settings.
8. In User settings, verify that Azure AD users can register applications (set to Yes by default).
9. In case the 'App registrations' settings are set to 'No', request the tenant/global admin to assign the required permission. Alternatively, the tenant/global admin can assign the Application Developer role to an account to allow the registration of the Azure Active Directory App.
Prepare AWS instances
Set up an account that the appliance can use to access AWS instances.
For Windows servers, set up a local user account on all the Windows servers that you want to include in the discovery. Add the user account to the following groups: - Remote Management Users - Performance Monitor Users - Performance Log users.
You need a root account on the Linux servers that you want to discover. For an alternative, refer to the instructions in the support matrix.
Azure Migrate uses password authentication to discover AWS instances. AWS instances don't support password authentication by default. Before you can discover an instance, you need to enable password authentication.
o For Windows servers, allow WinRM port 5985 (HTTP). This allows remote WMI calls.
o For Linux servers:
1. Sign in to each Linux machine.
2. Open the sshd_config file: vi /etc/ssh/sshd_config
3. In the file, locate the PasswordAuthentication line and change the value to yes.
4. Save the file and close it. Restart the ssh service.
o If you are using a root user to discover your Linux servers, ensure root sign-in is allowed on the servers.
1. Sign in to each Linux machine
2. Open the sshd_config file: vi /etc/ssh/sshd_config
3. In the file, locate the PermitRootLogin line and change the value to yes.
4. Save the file and close it. Restart the ssh service.
Set up a project
Set up a new project.
1. In the Azure portal > All services, search for Azure Migrate.
2. Under Services, select Azure Migrate.
3. In Overview, select Create project.
4. In Create project, select your Azure subscription and resource group. Create a resource group if you don't have one.
5. In Project Details, specify the project name and the geography in which you want to create the project. Review supported geographies for public and government clouds.
6. Select Create.
7. Wait a few minutes for the project to deploy. The Azure Migrate: Discovery and assessment tool is added by default to the new project.
Set up the appliance
The Azure Migrate appliance is a lightweight appliance used by Azure Migrate: Discovery and assessment to do the following:
Discover on-premises servers.
Send metadata and performance data for discovered servers to Azure Migrate: Discovery and assessment.
To set up the appliance
1. Provide an appliance name and generate a project key in the portal.
2. Download a zipped file with the Azure Migrate installer script from the Azure portal.
3. Extract the contents from the zipped file. Launch the PowerShell console with administrative privileges.
4. Execute the PowerShell script to launch the appliance web application.
5. Configure the appliance for the first time and register it with the project using the project key.
1. Generate the project key
1. In Migration goals > Servers, databases and web apps > Azure Migrate: Discovery and assessment, select Discover.
2. In Discover servers > Are your servers virtualized?, select Physical or other (AWS, GCP, Xen, etc.).
3. In 1:Generate project key, provide a name for the Azure Migrate appliance that you will set up for the discovery of physical or virtual servers. The name should be alphanumeric with 14 characters or fewer.
4. Select the Generate key to start the creation of the required Azure resources. Do not close the Discover Servers page when creating resources.
5. After the successful creation of the Azure resources, a project key is generated.
6. Copy the key, as you will need it to complete the registration of the appliance during its configuration.
2. Download the installer script
In 2: Download Azure Migrate appliance, select Download.
Verify security
Check that the zipped file is secure before you deploy it.
1. On the machine to which you downloaded the file, open an administrator command window.
2. Run the following command to generate the hash for the zipped file:
o C:\>CertUtil -HashFile <file_location> [Hashing Algorithm]
o Example usage for the public cloud: C:\>CertUtil -HashFile C:\Users\administrator\Desktop\AzureMigrateInstaller-Server-Public.zip SHA256
o Example usage for government cloud: C:\>CertUtil -HashFile C:\Users\administrator\Desktop\AzureMigrateInstaller-Server-USGov.zip SHA256
3. Verify the latest appliance versions and hash values:
o For the public cloud:
Scenario | Download* | Hash value |
Physical (85 MB) | 277C53620DB299F57E3AC5A65569E9720F06190A245476810B36BF651C8B795B |
3.Run the Azure Migrate installer script
The installer script does the following:
Installs agents and a web application for physical server discovery and assessment.
Install Windows roles, including Windows Activation Service, IIS, and PowerShell ISE.
Download and install an IIS rewritable module.
Updates a registry key (HKLM) with persistent setting details for Azure Migrate.
Creates the following files under the path:
o Config Files: %Programdata%\Microsoft Azure\Config
o Log Files: %Programdata%\Microsoft Azure\Logs
Run the script as follows:
1. Extract the zipped file to a folder on the server that will host the appliance. Make sure you don't run the script on a machine on an existing Azure Migrate appliance.
2. Launch PowerShell on the above server with administrative (elevated) privilege.
3. Change the PowerShell directory to the folder where the contents have been extracted from the downloaded zipped file.
4. Run the script named AzureMigrateInstaller.ps1 by running the following command:
o For the public cloud:
PS C:\Users\administrator\Desktop\AzureMigrateInstaller-Server-Public> . \AzureMigrateInstaller.ps1
If you come across any issues, you can access the script logs at C:\ProgramData\Microsoft Azure\Logs\AzureMigrateScenarioInstaller_Timestamp.log for troubleshooting.
Verify appliance access to Azure
Make sure that the appliance can connect to Azure URLs for public clouds.
4. Configure the appliance
Set up the appliance for the first time.
1. Open a browser on any machine that can connect to the appliance, and open the URL of the appliance web app: https://appliance name or IP address: 44368.
Alternatively, you can open the app from the desktop by selecting the app shortcut.
2. Accept the license terms and read the third-party information.
Set up prerequisites and register the appliance
In the configuration manager, select Set up Prerequisites, and then complete these steps:
1. Connectivity: The appliance checks that the server has internet access. If the server uses a proxy:
o Select Setup proxy to specify the proxy address (in the form http://ProxyIPAddress or http://ProxyFQDN, where FQDN refers to a fully qualified domain name) and listening port.
o Enter credentials if the proxy needs authentication.
o If you have added proxy details or disabled the proxy or authentication, select Save to trigger connectivity and check connectivity again.
Only HTTP proxy is supported.
2. Time sync: Check that the time on the appliance is in sync with internet time for discovery to work properly.
3. Install updates and register appliance: To run auto-update and register the appliance, follow these steps:
a. For the appliance to run auto-update, paste the project key that you copied from the portal. If you don't have the key, go to Azure Migrate: Discovery and assessment > Overview > Manage existing appliances. Select the appliance name you provided when you generated the project key, and then copy the key that's shown.
b. The appliance will verify the key and start the auto-update service, which updates all the appliance services to their latest versions. When the auto-update has run, you can select View appliance services to see the status and versions of the services running on the appliance server.
c. To register the appliance, you need to select Login. In Continue with Azure Login, select Copy code & Login to copy the device code (you must have a device code to authenticate with Azure) and open an Azure Login prompt in a new browser tab. Make sure you've disabled the pop-up blocker in the browser to see the prompt.
d. In a new tab in your browser, paste the device code and sign in by using your Azure username and password. Signing in with a PIN isn't supported.
e. After you successfully sign in, return to the browser tab that displays the appliance configuration manager. If the Azure user account that you used to sign in has the required permissions for the Azure resources that were created during key generation, appliance registration starts.
After the appliance is successfully registered, to see the registration details, select View details.
You can rerun prerequisites at any time during appliance configuration to check whether the appliance meets all the prerequisites.
Start continuous discovery
Now, connect from the appliance to the physical servers to be discovered and start the discovery.
1. In Step 1, provide credentials for the discovery of Windows and Linux physical or virtual
servers and select Add credentials.
2. For the Windows server, select the source type as Windows Server, specify a friendly name for credentials, and add the username and password. Select Save.
3. If you are using password-based authentication for a Linux server, select the source type as Linux Server (Password-based), specify a friendly name for credentials, and add the username and password. Select Save.
4. If you are using SSH key-based authentication for a Linux server, you can select the source type as Linux Server (SSH key-based), specify a friendly name for credentials, add the username, browse, and select the SSH private key file. Select Save.
o Azure Migrate supports the SSH private key generated by the ssh-keygen command using RSA, DSA, ECDSA, and ed25519 algorithms.
o Currently, Azure Migrate does not support passphrase-based SSH keys. Use an SSH key without a passphrase.
o Currently, Azure Migrate does not support SSH private key files generated by PuTTY.
5. If you want to add multiple credentials at once, select Add More to save and add more credentials. Multiple credentials are supported for physical servers' discovery.
6. In Step 2: Provide physical or virtual server details, select Add discovery source to specify the server IP address/FQDN and the friendly name for credentials to connect to the server.
7. You can either add single item at a time or add multiple items in one go. There is also an option to provide server details through Import CSV.
o If you choose Add single item, you can choose the OS type, specify a friendly name for credentials, add server IP address/FQDN, and select Save.
o If you choose to Add multiple items, you can add multiple records at once by specifying the server IP address/FQDN with the friendly name for credentials in the text box. Verify** the added records and select Save.
o If you choose Import CSV (selected by default), you can download a CSV template file and populate the file with the server IP address/FQDN and friendly name for credentials. You then import the file into the appliance, verify the records in the file and select Save.
8. On selecting Save, the appliance will try validating the connection to the servers added and show the Validation status in the table against each server.
o If validation fails for a server, review the error by selecting Validation failed in the Status column of the table. Fix the issue and validate again.
o to remove a server, select Delete.
9. You can revalidate the connectivity to servers at any time before starting the discovery.
10. Before initiating discovery, you can choose to disable the slider so as not to perform software inventory and agentless dependency analysis on the added servers. You can change this option at any time.
Start discovery
Select Start Discovery to kick off the discovery of the successfully validated servers. After the discovery has been successfully initiated, you can check the discovery status against each server in the table.
How discovery works
It takes approximately 2 minutes to complete the discovery of 100 servers and their metadata to appear in the Azure portal.
Software inventory (discovery of installed applications) is automatically initiated when the discovery of servers is finished.
Software inventory identifies the SQL Server instances that are running on the servers. Using the information it collects, the appliance attempts to connect to the SQL Server instances through the Windows authentication credentials or the SQL Server authentication credentials that are provided on the appliance. Then, it gathers data on SQL Server databases and their properties. The SQL Server discovery is performed once every 24 hours.
Appliance can connect to only those SQL Server instances to which it has network line of sight, whereas software inventory by itself may not need network line of sight.
The time taken for the discovery of installed applications depends on the number of discovered servers. For 500 servers, it takes approximately one hour for the discovered inventory to appear in the Azure Migrate project in the portal.
During software inventory, the added server credentials are iterated against servers and validated for agentless dependency analysis. When the discovery of servers is finished, in the portal, you can enable agentless dependency analysis on the servers. Only the servers on which validation succeeds can be selected to enable agentless dependency analysis.
SQL Server instances and database data begin to appear in the portal within 24 hours after you start discovery.
By default, Azure Migrate uses the most secure way of connecting to SQL instances, which is that Azure Migrate encrypts communication between the Azure Migrate appliance and the source SQL Server instances by setting the TrustServerCertificate property to true. Additionally, the transport layer uses SSL to encrypt the channel and bypass the certificate chain to validate trust. Hence, the appliance server must be set up to trust the certificate's root authority. However, you can modify the connection settings by selecting Edit SQL Server connection properties on the appliance.
Verify servers in the Portal
After discovery, you can verify that the servers appear in the portal.
1. Open the Azure Migrate dashboard.
2. In Servers, databases and web apps > Azure Migrate: Discovery and assessment page, select the icon that displays the count for Discovered servers.
Comentários