---
title: "Deploy UserGate VE on a cloud server"
sidebar_label: "Deploy UserGate VE on a cloud server"
sidebar_position: 1
description: "How to deploy a UserGate VE image on a cloud server"
---

import Formbricks from '@theme/MDXComponents/Formbricks';

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';
import CopyIcon from '@selectel/docux/icons/copy';

# Deploy UserGate VE on a cloud server

1. [Save the firewall image](#save-firewall-image).
2. [Upload the image to the image storage](#upload-image-to-image-storage).
3. Optional: [change the virtual network adapter type](#change-network-adapter-type).
4. Optional: [enable the multi-queue property for the virtio virtual network adapter](#virtio-multiqueue-enable).
5. [Create a cloud server from the image](#create-cloud-server-from-image).
6. [Assign an IP address to access the firewall](#assign-ip-to-access-firewall).
7. [Initialize the firewall](#initialize-firewall).
8. [Specify the DNS and NTP servers](#specify-dns-and-ntp-servers).
9. [Activate the license](#activate-license).

## 1. Save the firewall image \{#save-firewall-image}

1. Go to the ticket that was created when [ordering the firewall](/firewalls/order/order-virtual-firewall.mdx).
2. Save the firewall image to the device you will use to configure it.

## 2. Upload the image to the image storage \{#upload-image-to-image-storage}

1. In the [control panel](https://my.selectel.ru/vpc/default/images/), in the top menu, click **Products** and select **Cloud Servers**.
2. Go to the **Images** section.
3. Click **Create image**.
4. Enter the image name.
5. Select the [location](/infrastructure/locations.mdx#pool) where you want to deploy the firewall.
6. In the **Operating system** field, select — Other.
7. In the **Source** field, select — File.
8. Click **Upload** and select the [firewall image file](#save-firewall-image) on your device.
9. Select the image format and container format.If you are not sure which formats to specify, enter image format `raw`, container format — `bare`.
10. Click **Create**.

## 3. Optional: change the virtual network adapter type \{#change-network-adapter-type}

By default, the UserGate firewall image properties have the virtio network adapter installed.You can change the adapter type to improve compatibility with your infrastructure.The cloud server will inherit the adapter type set in the image properties at the time of server creation.Changing the adapter type will not apply to already created cloud servers.

To change the adapter type:

1. Open [OpenStack CLI](/cloud-servers/tools/openstack-cli/).

2. Change the virtual network adapter type:

   ```bash
   openstack image set --property hw_vif_model=<vif_model> <image>
   ```

   Specify:

   * `<vif_model>` — the virtual network adapter type:

     * `vmxnet3;`
     * `e1000;`
     * `e1000e.`

   * `<image>` — image ID or name. You can view the list of images using the `openstack image list`.

## 4. Optional: enable the multi-queue property for the virtio virtual network adapter \{#virtio-multiqueue-enable}

:::warning

Enabling the multi-queue property will increase the load on all vCPUs.

:::

By default, the UserGate firewall image properties have the virtio network adapter installed.If you have not changed the adapter type, you can enable the multithreading property, which allows the use of multiple vCPUs.

1. Open [OpenStack CLI](/cloud-servers/tools/openstack-cli/).

2. Enable the multi-queue property:

   ```bash
   openstack image set --property hw_vif_multiqueue_enabled=true <image>
   ```

   Specify `<image>` — image ID or name. You can view the list of images using the `openstack image list`.

## 5. Create a cloud server from the image \{#create-cloud-server-from-image}

1. In the [control panel](https://my.selectel.ru/vpc/default/servers/), in the top menu, click **Products** and select **Cloud Servers**.

2. In the **Servers** section, click **Create server**.

3. Enter the cloud server name — it will only be displayed in the control panel.

4. Select the [location](/infrastructure/locations.mdx) where you uploaded the firewall image.

5. In the **Source** block, open the **Images** tab and select the firewall image.

6. Select the cloud server configuration.The configuration must comply with the [requirements](/firewalls/order/firewall-types.mdx#configuration-requirements) for the selected firewall model.

7. Select the internet access type.You will need at least one public address to access the firewall from the internet:

   * public floating IP address — a private subnet and one static public IP address;
   * direct public IP address — one static public IP address;
   * public subnet — all IP addresses in the subnet will be accessible from the internet.

8. If you selected **Public floating IP address** in step 7, select or create a private subnet to which the server will be connected.

9. Select the remaining server settings — see the [Create Cloud Server](/cloud-servers/create/create-server.mdx) instructions for details.

10. Click **Create**.

## 6. Assign an IP address to access the firewall \{#assign-ip-to-access-firewall}

<Tabs queryString="vmware-assign-ip-to-access-firewall">
  <TabItem value="ugos-6" default>
    <TabItemLabel>
      UGOS 6
    </TabItemLabel>

    1. Open the CLI.

    2. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx):

       * login — Admin;
       * password — utm.

    3. Switch the internet port to `static` mode:

       ```bash
       iface config -name port0 -mode static
       ```

    4. Assign an IP address to the port:

       ```bash
       iface config -name port0 -ipv4 <ip_address>/<mask>
       ```

       Specify:

       * `<ip_address>` — the IP address of the server's internet port. You can copy the IP address in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → **Servers** section → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the IP address. The address is specified without a mask;
       * `<mask>` — the subnet mask.

    5. Create a default route to the internet:

       ```bash
       gateway add -ipv4 <gateway> -weight 1 -enabled true -default true
       ```

       Specify `<gateway>` — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the [control panel](https://my.selectel.ru/vpc/): in the top menu, click **Products** → **Cloud Servers** → **Servers** → server page → **Ports** tab → subnet name → **Subnets** tab → subnet card → **Subnet Gateway** field.
  </TabItem>

  <TabItem value="ugos-7">
    <TabItemLabel>
      UGOS 7
    </TabItemLabel>

    1. Open the CLI.

    2. Select **UGOS NGFW (serial console)** mode.

    3. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx):

       * login — Admin;
       * password — leave the field empty.

    4. Enter configuration mode:

       ```bash
       configure
       ```

    5. Assign an IP address to the port:

       ```bash
       set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]
       ```

       Specify `<ip_address>/<mask>` — the IP address of the server's internet port with the subnet mask. You can copy the IP address in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → **Servers** section → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the IP address. Square brackets `[ ]` must be separated by spaces on both sides.

    6. Create a gateway:

       ```bash
       create network gateway interface port0 enabled on ip <gateway> weight 1 default on
       ```

       Specify `<gateway>` — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the [control panel](https://my.selectel.ru/vpc/): in the top menu, click **Products** → **Cloud Servers** → **Servers** → server page → **Ports** tab → click the subnet name → **Subnets** tab → subnet card → **Subnet Gateway** field.
  </TabItem>

  <TabItem value="ugos-7-1">
    <TabItemLabel>
      UGOS 7.1 and higher
    </TabItemLabel>

    1. Open the CLI.

    2. Select **UGOS NGFW (serial console)** mode.

    3. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx):

       * login — Admin;
       * password — usergate.

    4. Enter configuration mode:

       ```bash
       configure
       ```

    5. Assign an IP address to the port:

       ```bash
       set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]
       ```

       Specify `<ip_address>/<mask>` — the IP address of the server's internet port with the subnet mask. The IP address can be copied in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the IP address. The square brackets `[ ]` must be separated by spaces on both sides.

    6. Create a gateway:

       ```bash
       create network gateway interface port0 enabled on ip <gateway> weight 1 default on
       ```

       Specify `<gateway>` — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the [control panel](https://my.selectel.ru/vpc/): in the top menu, click **Products** → **Cloud Servers** → **Servers** → server page → **Ports** tab → click the subnet name → **Subnets** tab → subnet card → **Subnet Gateway** field.
  </TabItem>
</Tabs>

## 7. Initialize the firewall \{#initialize-firewall}

1. Open the following page in your browser:

   ```bash
   https://<ip_address>:8001
   ```

   Specify `<ip_address>` — the IP address of the firewall. You can copy the IP address in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → **Servers** section → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the public IP address.

2. Select the system language.

3. Select the time zone.

4. Accept the license agreement.

5. Optional: change the administrator login.

6. Change your password.

7. Click **Start**.

8. Wait for the installation procedure to complete.

## 8. Specify DNS and NTP servers \{#specify-dns-and-ntp-servers}

1. Open the following page in your browser:

   ```bash
   https://<ip_address>:8001
   ```

   Specify `<ip_address>` — the IP address of the firewall. You can copy the IP address in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → **Servers** section → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the IP address.

2. Enter login and password.

3. Go to **Settings** → **Network** → **DNS**.

4. Click **Add**.

5. Enter the DNS server IP addresses.We recommend using the [Selectel recursive DNS servers](/infrastructure/dns/dns-recursive-servers-list.mdx), but you can specify any available DNS servers.

6. Click **Save**.

7. Optional: go to the **Settings** section and in the **Server Time Configuration** block, change the value in the **Primary NTP Server** field.We recommend using the [Selectel NTP servers](/infrastructure/ntp/ntp-servers-list.mdx), but you can specify any available NTP servers.

## 9. Activate the license \{#activate-license}

<Tabs queryString="vmware-activate-license">
  <TabItem value="UGOS 6" default>
    <TabItemLabel>
      UGOS 6
    </TabItemLabel>

    1. Open the following page in your browser:

       ```bash
       https://<ip_address>:8001
       ```

       Specify `<ip_address>` — the IP address of the firewall. The IP address can be copied in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → section **Servers** → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the public IP address.

    2. Enter login and password.

    3. At the top, click the **Unregistered version** button.

    4. Enter the PIN code received in the ticket when [ordering the firewall](/firewalls/order/order-virtual-firewall.mdx).

    5. Click **Next**.

    6. Fill out the registration form. We recommend using the same data as in your Selectel account.

    7. Click **Next**.

    8. Wait for the firewall to register. Information about the license composition and expiration dates of the components will be displayed in the **Dashboard** section in the **License** block.
  </TabItem>

  <TabItem value="ugos-7">
    <TabItemLabel>
      UGOS 7 and higher
    </TabItemLabel>

    1. Open the following page in your browser:

       ```bash
       https://<ip_address>:8001
       ```

       Specify `<ip_address>` — the IP address of the firewall. The IP address can be copied in the [control panel](https://my.selectel.ru/vpc/default/servers/): in the top menu, click **Products** → **Cloud Servers** → section **Servers** → server page → **Ports** tab → in the port card, click <CopyIcon /> next to the IP address or public IP address.

    2. Enter login and password.

    3. Go to **License Information** → **Registered version**.

    4. Enter the PIN code received in the ticket when [ordering the firewall](/firewalls/order/order-virtual-firewall.mdx).

    5. Click **Next**.

    6. Wait for the firewall to register. Information about the license composition and expiration dates of the components will be displayed in the **License Information \*\*\*\* section**.
  </TabItem>
</Tabs>

<Formbricks />