Deployment Guidelines
Landslide C100 Test System
The Landslide C100 Test System is deployed on Spirent Landslide C100 rackmounted server platforms. The Landslide Manager hosts the Test Administration Server (TAS) software, which serves the user interface through the LAN, acts as the data repository, and controls overall system operations. The Landslide Test Server hosts the Test Server software, which performs the test operations. The Landslides communicate with the Systems Under Test (SUTs) via an Ethernet LAN or a direct Ethernet connection. A single Landslide system supports from one (1) to thirty-two (32) Test Servers. Users connect to the Landslide test system and access the TAS from a Java Web Client.
Landslide C50-S4 / C50-S5 Test System
The Landslide C50-S4 / C50-S5 Test System provides an economical solution for customers who require the complete functionality of a full Landslide Test System, but at smaller scale and lower data performance. The Landslide C50-S4 / C50-S5 Test System consists of an integrated TAS Manager and Test Server residing on a single, rack-mountable SPT-C50 appliance. Users can add a single standalone, Add-on Test Server for additional scale and performance. In all other respects, the C50-S4 / C50-S5 Test System is the same as the C100 Test System.
Users interact with the Landslide Manager, while the Landslide Manager communicates with the Landslide Test Servers over the LAN. The Test Servers can communicate with the systems under test either through a direct Ethernet connection, or over the LAN.
Remote Access to Client Network system from another LAN segment or from another network, can be configured by a network administrator.
|
IMPORTANT: To achieve the maximum throughput, the Landslide Test Server must be directly connected to the SUT. |
Network Diagram
Click here to see Table for list of network diagrams for standard Landslide deployments.
TAS Manager/Test Server Network Configuration Requirements:
For Communication between the TAS Manager and Test Server :
- Need UDP Ports 8889-8897 (Test Manager (TAS) requires port 8889 open, TS/vTS with only one process will use port 8890, TS with 2 process will use port 8891.. up to TS 8 process will use port 8897) - required if you are not using VPN connection between TAS and Test Server or Web Proxy between TAS and Test Server.
-
VPN support was added between TAS and Test Server (TS) for simplified connectivity between firewalls - This option reduces the number of UDP ports that are required to be open between TAS and Test Server - See configuration details in topic - Configure VPN between TAS and Test Server. OpenVPN listen on Port 1194 on both TAS and TS.
-
UDP Port 1812 required with Advanced Security (About Test Server Configuration) option.
-
Port 1194 for VPN between TAS and TS (Configure VPN between TAS and Test Server)
-
Web Proxy between TAS and Test Server TS (also effectively TCP over the network) was added. TAS - TCP default 9998 however it is configurable. See configuration details in topic - Web Proxy between TAS and Test Server. Note : Web Proxy and VPN are mutually exclusive, they cannot both be enabled at the same time. However, a TAS can support a mix of web proxied TSs and standard TSs at the same time.
- Port 22 for SSH (For Test Server Configuration, Testing and Test Results)- (Note : Port 22 or whatever your Test Server SSH port is configured on Test Server Administration - See Managing Your Test Servers - The default value is 22 and should not be changed unless using Web Proxy, NAT, or other special routing. )
- To improve initial connectivity between TAS and TS, the ICMP (PING) protocol should be allowed.
Client Network Configuration Requirements for Client and TAS Communication
See Client Recommendations for minimum hardware and software requirements and Configuring Your Java Settings for JRE instructions.
Your Network Administrator can set up Client Network Requirements by enabling remote access to the test system and allowing traffic on the following TCP ports to transit any firewall (s) or routers between the client and the Landslide Manager: (see diagram below )
-
Port 80 HTTP service for HTML pages: Home Page, Test Results, Help, etc.
-
Port 443 HTTPS (If using HTTPS) service for HTML pages: Home Page, Test Results, Help, etc.
-
Port 8080 TCP Communication between the client platform and the TAS for RESTful API, Landslide Tcl and GUI Client, etc.
-
Port 8181 TCP Communication between the client platform and the TAS if using Secure Connection (TLS) for RESTful API, Landslide Tcl and GUI Client, etc.
-
Port 22 SSH (Secure Shell) access and SCP transfers in support of TAS Manager activities and for direct Test Server (TS) features. (Note : Port 22 or whatever your Test Server SSH port is configured on Test Server Administration - See Managing Your Test Servers - The default value is 22 and should not be changed unless using Proxy, NAT, or other special routing. )
-
NOTEs:
- All of the above mentioned HTTP / HTTPS / TLS / SSH traffic will be transported over TCP Protocol.
- TCP Port 7888 is no longer required for File transfers between the Landslide Tcl and GUI client and the TAS. File transfers to / from the Client / TAS are now done over the TAS Service TCP/TLS-based ports.
For HTTPS Communication, we recommend installing a proper SSL Certificate prior to use. For additional details on installing an SSL Certificate on the TAS, see Signed SSL Server Certificate in the TAS Manager Menu or in the TAS Manager Web UI.
TAS – License Server Networking Requirements
For communications between TAS and License Server:
- If using License Server License, the TAS must be able to reach the License Server using TCP Port 443 (or Alternate port 8443) on the internet or customer network.
|
NOTE: To test port 8080 for communications between the Client PC and the TAS Manager, SSH to port 8080 from the Client PC and verify that the connection is successful. For example, SSH 192.168.0.1 8080, where 192.168.0.1 is the TAS Manager IP Address. |
There are several options for how to setup Landslide for use with License Server Licenses.
Options :
- If the TAS can reach the internet and the corporate firewall will allow Spirent CA Signed SSL certificates, the standard setup is to use our #1 License Server, ls-lic-server.spirent.com or 38.99.7.67.
- If the TAS has issues with Option 1 due to the SSL Certificate and needs a public CA, our AWS License Server, ls-license-srv.spirent.com uses a SSL Certificate signed by Digicert.
- If the TAS has issues with accessing the internet directly from where it is located and a Proxy is available, a proxy can be configured and then choose between Option 1 or Option 2 License Server as needed.
- If the TAS has no possibility of reaching the internet, a Corporate E10 License Server can be used. A black box E10 can be provided and installed in the customers corporate network for direct access.
ETH1
Another option is to enable a second management port that can be physically connected to a different network, and isolated for only outbound HTTPS traffic from the TAS to the License Server.
Network Table
| System | Initiate / Direction | Protocol | Destination Port | Source Port | Customizable | Service | Required for : |
| TAS | Inbound | TCP | 80 | No | HTTP Apache | Homepage, Results, TeX, Help (Can be disabled) | |
| TAS | Inbound | TCP | 8080 | No | HTTP TAS Service | Landslide Client, Standalone Client, TeX, APIs (Can be disabled) | |
| TAS | Inbound | TCP | 443 | No | HTTPS TAS Apache | Homepage, Results, TeX, Help, TAS Manager API/WebUI | |
| TAS | Inbound | TCP | 8181 | No | HTTPS TAS Service | Landslide Client, Standalone Client, TeX, APIs | |
| TAS | Inbound | TCP | 5000 | No | HTTP Results Dashboard | Optional Results Dashboard | |
| TAS,TS | Inbound | TCP | 22 | Yes | SSH | SSH clients, TAS-TS communications, administration of systems as cfguser. | |
| TAS | Inbound | UDP | 8890-8897 | 8889 | No | TAS-TS Comms | Running Landslide. TS messages sent to TAS at this port. |
| TS | Inbound | UDP | 8889 | 8890-8897 | No | TAS-TS Comms | Running Landslide. TAS messages sent to TS on these ports |
| TAS | Outbound | UDP | 162 | random | No | SNMP Traps | Landslide SNMP Traps, will use random source port and send UDP to port 162 |
| TS | Inbound | TCP | 5666 | No | Nagios Agent | Nagios Manager monitoring/querying of Test Servers. | |
| TAS | Inbound | UDP | 1812 | No | Radius Server | Radius User Authentication in Advanced Security | |
| TAS | Inbound | TCP | 9998 | Yes | Web Proxy Server | Web Proxy connection with the Test Servers | |
| TS | Outbound | TCP | 9998 | random | Yes | Web Proxy Client | Web Proxy connection to the TAS |
| TAS, TS | Inbound / Outbound | UDP | 1194 | Yes | VPN Server | VPN connection between TAS and Test Servers | |
| TAS | Outbound | TCP | 443 | random | No | License Server Comms | License Server License Checkout Requests |
| TAS | Outbound | TCP | 8442 | random | No | License Server Comms | Alternate port for License Server License Checkout Requests |
| TAS,TS | Inbound | TCP | 9100 | Yes | Node-Exporter | Prometheus Node-Exporter Service, queried by Prometheus Server, Nagios Manager or users | |
| TAS,TS | Inbound | TCP | 9275 | Yes | NRPE-Exporter | Prometheus NRPE-Exporter Service, queried by Prometheus Server, Nagios Manager or users | |
| TAS | Outbound | TCP | 9090 | No | Prometheus server | Prometheus server monitoring/querying of Test Servers and Test Manager | |
| TAS | Outbound | TCP | 9092/9093 | random | Yes | Kafka Producer | Kafka messages to Broker, can be TLS |