Network Configuration¶

This guide covers network setup for SPSA deployments.

Network Architecture¶

Network Placement¶

Place SPSA in a network segment that can:

• Receive HTTPS connections from users
• Receive HTTP connections for Let's Encrypt validation (public-facing deployments)
• Connect to target systems on required ports
• Access DNS and NTP services
• Access internet for updates (optional but recommended)

Recommended: DMZ or management VLAN

Firewall Rules¶

Inbound to SPSA¶

Outbound from SPSA¶

Protocol Flow Details¶

User Access Flow¶

Let's Encrypt Validation Flow¶

Appliance Update Flow¶

Port Summary¶

Required Ports¶

*Required if using that protocol

Optional Ports¶

DNS Configuration¶

Create DNS record for SPSA:

For Let's Encrypt to work, the DNS record must be publicly resolvable and point to the SPSA appliance.

IP Configuration¶

Configure static IP address for SPSA:

Configuration is done through the appliance console or web interface.

Routing¶

Ensure SPSA has routes to:

• All target systems (RDP, SSH, VNC, Telnet)
• DNS servers
• NTP servers
• User networks (if not default route)
• Internet (for updates and Let's Encrypt)

Deployment Scenarios¶

Public-Facing Deployment¶

For deployments accessible from the internet:

Internal-Only Deployment¶

For deployments not accessible from the internet:

Air-Gapped Deployment¶

For deployments without internet access:

Testing Connectivity¶

After configuration, verify:

1. Users can access https://spsa.yourdomain.com/
2. SPSA can reach target systems (use sshping, rdpping)
3. DNS resolution works
4. Time is synchronized
5. Updates can be downloaded (if internet access configured)

Connectivity Test Commands¶

From the SPSA console:

# Test SSH connectivity to target
sshping 192.168.1.50

# Test RDP connectivity to target
rdpping 192.168.1.50

# Display IP configuration
getip

Troubleshooting¶