Upload, create, and populate a managed disk

Create a managed disk to populate with the Access Gateway image.

• Download and decompress
• Install Microsoft Azure CLI and AZCopy tools
• Create and populate a managed disk

Download and decompress

1. Connect to the new VM using the IP address from the prior task and establish an ssh session.

   ssh okta@AA.BB.CC.DD.

2. Use wget to download the latest Access Gateway Microsoft Azure fixed disk image.

   cd /home/okta wget https://download.oag.okta.com/ga/oag_azure.vhd.gz

3. Unpack the fixed disk image to a temporary location on the /datadrive.

   sudo mkdir /datadrive/temp sudo cp oag.vhd.gz /datadrive/temp sudo gunzip -v /datadrive/temp/oag_azure.vhd.gz --keep

Install Microsoft Azure CLI and AZCopy tools

1. Change the directory:

   cd /datadrive/temp

2. Install Microsoft Azure CLI using this command:

   curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

3. Install Azcopy using this command:

   sudo wget https://aka.ms/downloadazcopy-v10-linux sudo tar -xvf downloadazcopy-v10-linux

Create and populate a managed disk

1. After installing the Microsoft Azure environment, sign in using this command:

   az login

2. Sign in to az copy.

   cd /datadrive/temp/azcopy_linux_amd64_10.3.4 sudo ./azcopy login --tenant-id=<tenant id from output of az login>

3. Sign in or return to the Microsoft Azure command line interface:

   az login

4. Use the az disk create command to create a disk large enough to contain the OVA disk file.

   az disk create -n <virtual-disk>\ --resource-group <resource-group> --location <“location”>\ --for-upload --upload-size-bytes <size> --sku standard_lrs

   • <virtual-disk> is the name of the virtual disk. It's typically the same as the OVA disk, but without the suffix.
   • <resource-group> is the name of the previously created resource group. For example, "AccessGateway".
   • <location> is the location of the resource group. For example "eastus".
   • <size> is the size of the disk in bytes. For example 236246270464. Note this is the size, in bytes, of the downloaded Access Gateway disk image.
   • --sku standard_lrs is a required parameter.

   Run this command and replace <resource-group> with AccessGateway, <location> with eastus, and <size> with 236246270464:

   az disk create -n Okta-AccessGatewayDisk --resource-group AccessGateway \ --location eastus --for-upload --upload-size-bytes 236246270464 \ --sku standard_lrs

   When you run this command, the following results appear:

   { "creationData": { "createOption": "Upload", "imageReference": null, "sourceResourceId": null, "sourceUniqueId": null, "sourceUri": null, "storageAccountId": null, "uploadSizeBytes": 20972032 },. . . "tags": {}, "timeCreated": "2020-04-20T17:51:29.894626+00:00", "type": "Microsoft.Compute/disks", "uniqueId": "d1485574-. . . ", "zones": null }

   The file size of the created disk must be an exact match to the file size used when copying up the disk image. Use a command, such as ls -ln, to determine the file size in bytes.

5. Use the az disk grant-access command to create a shared access token, which can be used to grant access to the previously created disk.

   az disk grant-access -n <virtual-disk> -g <resource-group> --access-level Write \ --duration-in-seconds 86400

   Where:

   • <virtual-disk> is the name of the virtual disk.
   • <resource-group> is the name of the previously created resource group.
   • --access-level Write is the required write access level.
   • --duration-in-seconds 86400 is the lifetime of the shared access token in seconds.

   Run this command and replace <virtual-disk> with Okta-AccessGatewayDisk, and <resource-group> with AccessGateway:

   az disk grant-access -n Okta-AccessGatewayDisk --resource-group AccessGateway \ --access-level Write --duration-in-seconds 86400

   Which produces the following results:

   "accessSas": "https://md-. . . VY1SlQ79TOnwoMaVHjaqkmVlU%3D"

6. Upload the disk file using the azcopy copy command.

   cd /datadrive/temp/azcopy_linux_amd64_10.3.4 sudo ./azcopy copy <path-to-disk> <accessSas> --blob-type PageBlob

   • <path-to-disk> is the fully qualified path to the fixed disk previously created.
   • <accessSas> is the value from the az disk grant-access command.

   Here is an example of the azcopy copy command with the parameters populated with values:

   sudo ./azcopy copy /datadrive/temp/oag.vhd "https://md-impexp-t4pdnf22n02h.blob.core.windows.net/p15jhr4gwqhl/abcd?sv=2017-04-17&sr=b&si=b1154122-1458-4f02-a226-1554c66938c0&sig=vGnmhmKMY92r3ecQLlAEXtEHzRCFTsa5rrIxNsQqaZY%3D" -blob-type PageBlob

   Azcopy uses the AZCOPY_CONCURRENCY_VALUE environment variable to control the upload process. Setting this variable to AUTO causes Azcopy to attempt to optimize the upload process.

   Here is an example of a command using the AZCOPY_CONCURRENCY_VALUE environment variable:

   export AZCOPY_CONCURRENCY_VALUE=AUTOsudo nohup sudo ./azcopy copy /datadrive/temp/oag.vhd \ "https://md-. . . VY1SlQ79TOnwoMaVHjaqkmVlU%3D" \ --blob-type PageBlob > /tmp/azcopy.log 2>&1 &
7. Monitor the copy using a command similar to this one:

   tail -f /tmp/azcopy.log

   When you run the tail command, the following results appear:

   INFO: Scanning... Job 50d659dd-6174-fe4d-78b1-5f97e305fdee has started Log file is located at: ~/.azcopy/50d659dd-6174-fe4d-78b1-5f97e305fdee.log INFO: Trying 4 concurrent connections (initial starting point) INFO: Trying 16 concurrent connections (seeking optimum) . . . INFO: Trying 5 concurrent connections (at optimum) . . . Elapsed Time (Minutes): 78.9381 Total Number Of Transfers: 1 Number of Transfers Completed: 1 . . . Total Bytes Transferred: 236223201792 Final Job Status: Completed

8. Once copied, use the az disk revoke-access command to revoke the previously granted access.

   az disk revoke-access --name "<virtual-disk>" --resource-group "<resource-group>"

   • <virtual-disk> is the name of the disk where access was granted.
   • <resource-group> is the resource group that contains the disk.

   Here is an example of the az disk revoke-access command with the parameters populated with values:

   az disk revoke-access --name "Okta-AccessGateway-2020.5.0" --resource-group "AccessGateway"

   Running this command produces the following results:

   - Running

   Failure to run the az disk revoke-access command results in an error when you attempt to create a VM as the disk will not be available for use.

   If you don't run the az disk revoke-access command, the process results in an error when you attempt to create a VM as the disk isn't available for use.

Related topics

az disk commands

Next steps

Copy disk