--- title: Deploying on Openstack slug: ps/help/en_us/ics/25x/vadep/deploying-on-openstack createdAt: 2026-09-21T05:29:32.290Z --- - [Overview](docId:5k6bvuyXb-SmzggCXP_gH) - [Supported Platform Systems](docId:5k6bvuyXb-SmzggCXP_gH) - [Prerequisites and System Requirements](docId:5k6bvuyXb-SmzggCXP_gH) - [Deploying ICS on OpenStack Using Horizon Dashboard](docId:5k6bvuyXb-SmzggCXP_gH) - [ICS Provisioning Parameters](docId:5k6bvuyXb-SmzggCXP_gH) - [vTPM and Secure Boot Support on OpenStack](docId:5k6bvuyXb-SmzggCXP_gH) - [Limitations](docId:5k6bvuyXb-SmzggCXP_gH) ## Overview ### Assumptions The basic understanding of deployment models of ICS on a data center and basic experience in using OpenStack is needed for the better understanding of this guide. ## Supported Platform Systems This section helps you in choosing the instance types that should be deployed with Ivanti Connect Secure. - ISA4500-V - ISA6500-V - ISA8500-V For more details, see [ISA VA Supported Platforms](docId:5RAgfN8DstZa5LJ7GbVq4). ## Prerequisites and System Requirements The OpenStack Fabric has various components such as Controller, Compute, Identity, Image, Networking etc. that are separately installed. For details about these services, To deploy the ICS VA on OpenStack, you need the following: - Access to the OpenStack Dashboard - An OpenStack account with deployment rights - ICS KVM Image - (Optional) ICS licenses - (Optional) ICS configuration in xml format, required only for zero touch deployment - Desired flavors of ISA-V. For details, see [ISA VA Supported Platforms](docId:5RAgfN8DstZa5LJ7GbVq4). - Desired ICS KVM image on OpenStack - Internal, External and Management networks on OpenStack - Security Groups for Internal, External and Management Ports - Compute nodes should support vTPM. - Compute nodes should support secure boot for virtual machines. - Compute nodes should have Ivanti released OVMF firmware binary (OVMF\_CODE.secboot.ivanti.fd) and NVRAM file (OVMF\_VARS\_4M.ivanti.fd) for secure boot. ## Deploying ICS on OpenStack Using Horizon Dashboard Before proceeding with the ICS deployment, ensure that the necessary prerequisites are set up. For details, see [Appendix A: Setting Up Prerequisites](docId:6l9V4pW4M6e4CMT-DMDO6) To deploy ICS on OpenStack, do the following: 1. Log in to the OpenStack. 2. In the OpenStack dashboard displayed, select **Project > Compute > Images**and then create an image. For more information, see [Create Image.](docId:6l9V4pW4M6e4CMT-DMDO6) ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3RbAj-RXJP_cByXhTohqW_appendixacreateimage508x543.png" position="flex-start" size="51" width="508" height="543" initialPath="img/appendix_a_create_image_508x543.png" githubPath="img/appendix_a_create_image_508x543.png" darkWidth="508" darkHeight="543" showCaption="false" indent="1"} 3. From the list of images displayed, click on **Launch** corresponding to the ICS KVM image you want to launch. Image selected must have following attributes for secure boot and vTPM supported ICS image. - hw\_disk\_bus='virtio' - hw\_firmware\_type='uefi' - hw\_machine\_type='q35' - hw\_tpm\_model='tpm-crb' - hw\_tpm\_version='2.0' - os\_secure\_boot='required' :::Paragraph{indent="1"} The following figure depicts the ICS VA Images screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/wBaDJ-veuZuO59qakcNmB_pcsvaimages474x113.png" position="flex-start" size="47" width="474" height="113" initialPath="img/pcs_va_images_474x113.png" githubPath="img/pcs_va_images_474x113.png" showCaption="false" indent="1"} 4. In the Launch Instance Details window, fill the following and then click **Next**. - Instance Name: Specify host name of the ICS Virtual instance - Description: Enter a brief description on this instance - Availability Zone: Select the zone where the instance is deployed - Count: Number of VM instances :::Paragraph{indent="2"} The following figure depicts the Device Details screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/wCbrSxbI05AlQV94lcNHI_devicedetails462x347.png" position="flex-start" size="46" width="462" height="347" initialPath="img/device_details_462x347.png" githubPath="img/device_details_462x347.png" showCaption="false" indent="2"} 5. The Source window displays the details of the image used. Click **Next**. :::Paragraph{indent="1"} The following figure depicts the Source Selection screen. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3avnj9GCTDodhLFSP2F7W_sourceselection479x383.png" position="flex-start" size="48" width="479" height="383" initialPath="img/source_selection_479x383.png" githubPath="img/source_selection_479x383.png" showCaption="false" indent="1"} 6. In the Flavor window, select required flavors of ISA-V from the list based on the memory and storage capacity of the instance. Click **Next**. :::Paragraph{indent="1"} The following figure depicts a sample Flavor Selection screen. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/Z7RXZ--y8Sfp9e58KMwN__flavorselection474x388.png" position="flex-start" size="47" width="474" height="388" initialPath="img/flavor_selection_474x388.png" githubPath="img/flavor_selection_474x388.png" showCaption="false" indent="1"} 7. In the **Networks** window, select networks from the list that specifies internal, external and management subnets. ICS supports VM with 2-NICs model and 3-NICs model for deployment. Click **Next**. :::Paragraph{indent="1"} The following figure depicts the Network Selection screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/c7TMEBV38rLmOegsjquCv_networkselection464x379.png" position="flex-start" size="46" width="464" height="379" initialPath="img/network_selection_464x379.png" githubPath="img/network_selection_464x379.png" showCaption="false" indent="1"} 8. (Optional) Network Ports window. Click **Next**. :::Paragraph{indent="1"} The following figure depicts the Network Ports Selection screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/rt2l_mB1ftz4qC1aQZrKP_networkportsselection472x298.png" position="flex-start" size="47" width="472" height="298" initialPath="img/network_ports_selection_472x298.png" githubPath="img/network_ports_selection_472x298.png" showCaption="false" indent="1"} 9. In the Security Groups window, select the required network security groups from the list for internal, external and management ports. Click **Next**. To create new security groups, refer [Creating Required Security Groups for Internal, External and Management Ports](docId:6l9V4pW4M6e4CMT-DMDO6) :::Paragraph{indent="1"} The following figure depicts the Security Groups Selection screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/j5oA8MW08Wj6MIBm5U5t8_securitygroupsselection475x410.png" position="flex-start" size="48" width="475" height="410" initialPath="img/security_groups_selection_475x410.png" githubPath="img/security_groups_selection_475x410.png" showCaption="false" indent="1"} 10. Key Pair is not used. Click **Next**. :::Paragraph{indent="1"} The following figure depicts the Key Pair screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/TKK9aCAE8QwMcIuNjXlBT_keypair479x430.png" position="flex-start" size="48" width="479" height="430" initialPath="img/key_pair_479x430.png" githubPath="img/key_pair_479x430.png" showCaption="false" indent="1"} 11. Click **Choose File** and import the file that contains the provisioning parameters in XML format OR paste the **Customization script** and do the required modifications. Select the **Configuration Drive** check box. The template file is available for ISA-V instance and click **Launch** Instance upon selecting the Configuration Drive option. :::Paragraph{indent="1"} The following figure depicts the Configuration Script screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4SQW8y32K4WxC4_phndSj_configurationscript477x311.png" position="flex-start" size="48" width="477" height="311" initialPath="img/configuration_script_477x311.png" githubPath="img/configuration_script_477x311.png" showCaption="false" indent="1"} 12. The Instances window lists all the ICS VA instances. The blue bar in the Task column shows the status of creation of the instance. This will take a few minutes. :::Paragraph{indent="1"} Open the created ICS VA instance by clicking on the Instance Name link. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3scFk3Sdt52m40WJLkB7m_instances475x102.png" position="flex-start" size="48" width="475" height="102" initialPath="img/instances_475x102.png" githubPath="img/instances_475x102.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} The Interface tab shows the networks that are created. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/LcKv9nS65KE3P9w8E2zqC_interfacetab460x87.png" position="flex-start" size="46" width="460" height="87" initialPath="img/interface_tab_460x87.png" githubPath="img/interface_tab_460x87.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} The Log tab shows the log details of the device that is created. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/XSE1gGu1TSDQOCSoDRO95_logtab478x149.png" position="flex-start" size="48" width="478" height="149" initialPath="img/log_tab_478x149.png" githubPath="img/log_tab_478x149.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} The console tab provides the virtual console to view the device coming up. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/0ZJ66nc_JKwEt-kFoXHmN_consoletab480x299.png" position="flex-start" size="48" width="480" height="299" initialPath="img/console_tab_480x299.png" githubPath="img/console_tab_480x299.png" showCaption="false" indent="1"} ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ncUBAXSZdezHJhQbll2X8_linuxbootmenu481x250.png" position="flex-start" size="48" width="481" height="250" initialPath="img/linux_boot_menu_481x250.png" githubPath="img/linux_boot_menu_481x250.png" showCaption="false" indent="1"} 13. Next, the Internal and External interfaces are configured by DHCP (Zero touch configuration). :::Paragraph{indent="1"} The following figure depicts the Internal and External Interfaces Configuration by DHCP screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/COPngAlU8rCkB-foUucwM_intextinterfacesconfigurationbydhcp487x255.png" position="flex-start" size="49" width="487" height="255" initialPath="img/int_ext_interfaces_configuration_by_dhcp_487x255.png" githubPath="img/int_ext_interfaces_configuration_by_dhcp_487x255.png" showCaption="false" indent="1"} 14. The Config URL is downloaded for initial configuration. :::Paragraph{indent="1"} The following figure depicts the Download Config URL from Template screen: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/88GE-5vLYh7f9do_3vfc3_urltodownloadconfiguration484x270.png" position="flex-start" size="48" width="484" height="270" initialPath="img/url_to_download_configuration_484x270.png" githubPath="img/url_to_download_configuration_484x270.png" showCaption="false" indent="1"} ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/xU_jbJR4pxVnOsxGHaZSp_complete482x270.png" position="flex-start" size="48" width="482" height="270" initialPath="img/complete_482x270.png" githubPath="img/complete_482x270.png" showCaption="false" indent="1"} ## ICS Provisioning Parameters Provisioning parameters are those parameters which are required during the deployment of a virtual appliance. ICS accepts the following parameters as provisioning parameters in the XML format. | \
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\ | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Parameter Name | Type | Description | | ------------------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | vaIPAddress | IP address | Internal interface IP | | vaNetmask | IP address | Internal interface subnet mask | | vaGateway | IP address | Internal interface IP gateway | | vaDefaultVlan | integer | VLAN number to assign to this interface | | vaExternalIPAddress | IP address | External interface IP | | vaExternalNetmask | IP address | External interface subnet mask | | vaExternalGateway | IP address | External interface IP gateway | | vaExternalDefaultVlan | Integer | VLAN number to assign to this interface. | | vaManagementIPAddress | IP address | Management interface IP | | vaManagementNetmask | IP address | Management interface subnet mask | | vaManagementGateway | IP address | Management interface IP gateway | | vaManagementDefaultVlan | Integer | VLAN number to assign to this interface | | vaPrimaryDNS | IP address | Primary DNS IP | | vaSecondaryDNS | IP address | Secondary DNS IP | | vaWINSServer | IP address | Windows server IP | | vaDNSDomain | string | Windows domain name | | VaAdminUsername | string | Admin username | | vaAdminPassword | string | Admin password | | vaCommonName | string | Common name | | vaOrganization | string | Organization name | | vaRandomText | string | Random text to generate self-signed certificate | | vaAcceptLicenseAgreement | character | “**y**” to accept the license agreement | | vaEnableLicenseServer | character | “**y**” to enable it as VLS server. “n” to bring it up as a ICS node. | | vaAdminEnableREST | character | “**y**” to enable REST for administrator user | | vaAuthCodeLicense | string | Authentication code that needs to be obtained from Ivanti. | | vaConfigURL | String URL | Http based URL where XML based ICS configuration can be found. | | vaConfigServerCACertPEM | string | PEM format of CA certificate. | | vaConfigData | string | base64 encoded XML based ICS configuration. | | vaInternalPortReconfigWithValueIn
VAppProperties | integer | The Internal port overwrite property. If set to 1, overwrite the virtual appliance’s internal port settings with the ones specified during deployment. Set this value as 1. | | vaManagementPortReconfigWithValueIn
VAppProperties | integer | The Management port overwrite property. If set to 1, overwrite the management port-related parameters in the ICS with the ones defined here. Set this value as 1. | | vaExternalPortReconfigWithValueIn
VAppProperties | integer | The External port overwrite property. If set to 1, overwrite the external port-related parameters in ICS/IPS with the ones defined here. Set this value as 1. | IICS supports zero touch provisioning. This feature can detect and assign DHCP networking settings automatically at the ICS boot up. The following ICS parameters should be set to null in order to fetch the networking configuration automatically from the DHCP server. - vaIPAddress - vaExternalIPAddress - vaManagementIPAddress - vaNetmask - vaExternalNetmask - vaManagementNetmask - vaGateway - vaExternalGateway - vaManagementGateway - vaPrimaryDNS - vaSecondaryDNS - vaDNSDomain :::hint{type="info"} Leased IP from DHCP server should be valid for a long time as ICS does not request for DHCP renewals. ::: ## vTPM and Secure Boot Support on OpenStack This section provides guidance on enabling virtual Trusted Platform Module (vTPM) and Secure Boot features for Ivanti Connect Secure virtual appliances deployed on OpenStack. Implementing vTPM and Secure Boot improves data protection by supporting encrypted secrets and secure firmware validation. ### vTPM Overview This section describes the process and prerequisites for enabling vTPM (virtual Trusted Platform Module) and Secure Boot for Ivanti Connect Secure virtual appliances on OpenStack. Enabling these security features ensures that sensitive data such as encryption keys are stored securely and validates the integrity of the virtual appliance firmware during boot. The guidance provided here will help you configure a compliant and robust OpenStack environment for secure ICS deployments. ### Enabling vTPM To enable vTPM (virtual Trusted Platform Module) support on OpenStack for Ivanti Connect Secure virtual appliances, ensure the following requirements and steps are met on each compute host: ### Prerequisites: - An OpenStack key manager service, such as Barbican, must be deployed and configured on the controller node. This service is required to store the secrets used for encrypting virtual device files at rest. - The user deploying the ICS virtual appliance must have the creator role in the corresponding OpenStack project to allow Barbican to create ICS secrets. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ximtoTJz74FptrMjnnyf-_vtpm1.png" alt caption size="63" width="626" height="47"} - The swtpm binary and associated libraries must be installed on each compute node :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/40XbGJIPusIJkl94bvm4A_vtpm2.png" alt caption size="30" width="301" height="33"} - /etc/nova/nova-compute.conf should have following configuration to support virtual TPM. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/_ZloVgy-bx7EQ9dq1k77l_vtpm6.png" alt caption size="29" width="286" height="112"} - Set the :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3Dm5gIbx60T0O7lS-3pGb_vtpm4.png" alt caption size="22" width="221" height="25"} config option to 'True' in:inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/R5LnUbXADpagZCIpxJAD-_vtpm3.png" alt caption size="20" width="201" height="30"}of compute node. This will enable support for both TPM version 1.2 and 2.0. With the above requirements satisfied, verify vTPM support by inspecting the traits on the compute node’s resource provider: :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/mf0xT0ftH_kat-VRzZMd6_vtpm5665x100.png" alt caption size="67" width="665" height="100"} ### Enabling Secure Boot To enable UEFI secure boot on OpenStack, follow steps as per [OpenStack documentation](https://docs.openstack.org/nova/latest/admin/secure-boot.html). You can verify UEFI Secure Boot support by inspecting the traits on the compute node’s resource provider: :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/Ni_7FgP2h1lhXRGv3js5G_sb5662x104.png" alt caption size="66" width="662" height="104"} In order to boot Ivanti virtual ICS in secure boot mode, perform following steps. 1. Extract Ivanti released OVMF firmware and VARS file from KVM ZIP artifact. 2. Ivanti released OVMF firmware and VARS file needs to be copied to /usr/share/OVMF directory of compute nodes. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/fMCFo_c6h7X_v7Qbp8UhF_sb1615x57.png" alt caption size="62" width="615" height="57"} Ivanti released VARS file has secure boot certificate required to boot virtual ICS in secure boot mode. 3. Copy 40-edk2-x86\_64-secure-enrolled.json to 10-edk2-x86\_64-secure-enrolled.json and modify 10-edk2-x86\_64-secure-enrolled.json file in /usr/share/qemu/firmware directory to use Ivanti’s secure boot OVMF files. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/1YK0TTk8qHsHpHRnGYDS7_sb2625x54.png" alt caption size="63" width="625" height="54"} b. Following contents need to be changed to use Ivanti’s released OVMF files.:inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/Ily-0VIwIJ0S8Ta1WBk7g_sb3627x248.png" alt caption size="63" width="627" height="248"} 4. Restart libvirtd and nova-compute on compute nodes :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/bUSADRJlPrLNr51vi8kaU_sb4.png" alt caption size="54" width="536" height="68"} ### Setting Virtual ICS Image Attributes Following attributes need to be set to enable secure boot for virtual ICS. 1. Select virtual ICS image. 2. Edit image. 3. Select Metadata section. 4. Update following attributes. - hw\_disk\_bus='virtio' - hw\_firmware\_type='uefi' - hw\_machine\_type='q35' - hw\_tpm\_model='tpm-crb' - hw\_tpm\_version='2.0' - os\_secure\_boot='required' ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/gZCxlAPvYLUAfPFf40AdN_virtualics1676x655.png" size="68" isUploading="false" initialPath="img/virtualics1_676x655.png" githubPath="img/virtualics1_676x655.png" width="676" height="655" showCaption="false"} If above listed attributes are enabled then virtual ICS will boot with secure boot enabled and vTPM attached. ## Limitations 1. Snapshot and Restore functionality does not work in OpenStack for ICS with vTPM. a. [Source](https://specs.openstack.org/openstack/nova-specs/specs/ussuri/approved/add-emulated-virtual-tpm.html) b. Spawning from an image created by snapshotting a VM with a vTPM will result in a fresh, empty vTPM 2. Operations like “hard reboot” or “shut off/start” may fail to start ICS with vTPM. Refer [Bug link](https://bugs.launchpad.net/nova/+bug/2118888) :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/wSVwzXbnlnb1npA2V9fmZ_oslimitations645x170.png" alt caption size="65" width="645" height="170"} a. Above error may be seen. b. OpenStack fix [link](https://review.opendev.org/c/openstack/nova/+/955657) is needed to solve this issue. c. Alternately, following workaround can be added in your OpenStack environment. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/8HYZnfN5lpiIEecIcd2XO_oslimitations2642x217.png" alt caption size="64" width="642" height="217"}