Login to the TCA Airgap Appliance using SSH admin account then switch to root with su to use agctl command.

Prerequisites

• The network the TCA Airgap Appliance is wiring to is reachable to the Proxy Server.

• The Proxy Server allows anonymous access.

Procedure

1. (Optional) Upload untrusted Root CA certificate or self-signed certificate of proxy server.

   This step is only required if the Proxy Server in your organization is HTTPS and configured with an untrusted self-signed certificate or private CA signed certificate.

   1. Copy the untrusted Root CA certificate file or self-signed certificate to some directory of the TCA Airgap Appliance. For example, on the TCA Airgap Appliance console, users create and edit proxy-ca.crt file with the editor, copy the certificate content to it, then save it with :wq

      vi /tmp/proxy-ca.crt

   2. Verify the proxy-ca.crt.

      openssl s_client -connect <proxy address>:<proxy https port> -CAfile /tmp/proxy-ca.crt

      It is expected the output of above command contains “Verification: OK”.

2. Edit /usr/local/airgap/scripts/vars/user-inputs.yml using the following commmand:

   vi /usr/local/airgap/scripts/vars/user-inputs.yml

   Update following settings in the file:

   enable_proxy: True
   http_proxy: <proxy url>
   https_proxy: <proxy url>
   no_proxy: <network list sperated by comma by passing the proxy>
   proxy_ca_cert_path: <optional, file path prepared in Step 1>

   Examples:

   The Proxy opens HTTP port on 3128

   enable_proxy: True
   http_proxy: http://proxy.example.com:3128
   https_proxy: http://proxy.example.com:3128
   no_proxy: 192.168.0.0/15,.example.com
   #proxy_ca_cert_path: /tmp/proxy-ca.crt

   Proxy opens HTTPS port on 3443

   enable_proxy: True
   http_proxy: https://proxy.example.com:3128
   https_proxy: https://proxy.example.com:3128
   no_proxy: 192.168.0.0/15,.example.com
   proxy_ca_cert_path: /tmp/proxy-ca.crt

3. Apply the configuration using the agctl deploy command.
4. Log out the console then log in again to ensure your shell takes the latest proxy environment variable. Check the connectivities to remote repositories by running agctl selfcheck remote command. It is expected all repository sites in the output are reachable.

   For example:

   root@airgap320 [ /home/admin ]# agctl selfcheck remoteCheck Remote Repositories Connectivities
   Environment Proxy settings:
       http_proxy  : http://proxy.ipv6.eng.vmware:3128    
       https_proxy :http://proxy.ipv6.eng.vmware.com:3128    
       no_proxy    :localhost,192.168.0.0/16,172.16,0.0/16,
                   .ipv6.eng.vmware.com
   Docker proxy settings:    
       http_proxy  :http://proxy.ipv6.eng.vmware:3128    
       https_proxy : http://proxy.ipv6.eng.vmware.com:3128    
       no_proxy    : localhost,192.168.0.0/16,172.16,0.0/16,
                    .ipv6.eng.vmware.com
   projects.registry.vmware.com : reachable
   packages.vmware.com/photon   : reachable
   vmwaresaas.jfrog.io          : reachable
   s3.amazonaws.com             : reachable