License Server Tunnel

Introduction

If you are unfamiliar with the terminology on this page, please contact Sabalcore Support directly for assistance in setting up your license. If you already have a local license server and a valid license file for your software, it is possible to run your application on Sabalcore by connecting to your license server to your Sabalcore account, even if your license server is behind a firewall. Follow these instructions to enable a secure and encrypted connection between Sabalcore and your local license server. Our service will only allow connections to your license server from your account so only that account will be able to use the license at Sabalcore. These instructions are for Flex-style licenses. Contact support@sabalcore.com if your software uses a different licensing style. If your license agreement does not allow this type of usage, you can also temporarily transfer your license to our site.

In this section you will find:

  • Methods of Remote Connections
  • Request a VPN Tunnel
    • Direct
    • Routed
  • Setting up the SSH Tunnel
    • Special Instructions when using SSH Tunnel for ANSYS and STAR-CCM+

Terminology

“license server” – your local computer or server on your LAN where the software license is installed. Typically the software license is served up by a Flex-style license manager.

“VPN or OpenVPN” – OpenVPN provides flexible VPN solutions to secure data communications for networking Cloud data centers. It uses AES-256-CBC cipher for encryption, HMAC-SHA256 for authentication, Diffie-Hellman Group 1 4, and 2048-bit RSA key length.

Methods of Remote Connections

There are two secure methods for connecting your license server – VPN or SSH Tunneling.

VPN

A OpenVPN Client (OpenVPN is a commercial grade VPN solution) will be created by Sabalcore specifically for your server which hosts your license. It is typically installed on your server. It will provide a private connect between your license server and your account at Sabalcore. The user controls the VPN connection from their server. When running a job at Sabalcore, the license is checked-out over the VPN. Only you have access to the VPN.

There are two VPN scenarios – Direct or Routed

VPN Direct

This is the most common and most stable scenario. The illustration below illustrates the direct connection.  In this scenario, the Sabalcore VPN client is installed directly on the license server and the system administrator controls the connection by starting or stopping the VPN. When the VPN is active, the user (or multiple users from your organization) can access the license from their Sabalcore account or locally. Only license data traverses the VPN. When running a job at Sabalcore, the license is automatically checked-out through the VPN and the job runs.

 

VPN Routed

The illustration below illustrates the routed connection. In this scenario, the Sabalcore VPN client is installed on the user’s PC located on their local LAN. The user controls the connection by starting or stopping the VPN. When the VPN is active, only the user can access the license from their Sabalcore account. Only license data traverses the VPN. When running a job at Sabalcore, the license check-out is automatically routed through the users PC. This is less optimal than VPN Direct. It requires the user’s host to be up the entire time.

 

 

 

SSH

The illustration below shows connecting the License Server through a workstation using Secure Shell (SSH). SSH is integrated into the Sabalcore Secure Client so no special software is required. SSH uses 256bit AES encryption.  In this scenario, only the user can access the license from their Sabalcore account. When running a job at Sabalcore, the license check-out is automatically routed through the users PC using SSH.

Choose which method to use – VPN or SSH Tunneling

VPN is the preferred method for connecting to your local license server. However, if you do not have access to your local license server directly, then SSH Tunneling is the only other option. SSH tunneling will require that the PC you are using to access Sabalcore also has access to your license server on your local network (i.e. you can use the license). You cannot use VPN and SSH Tunneling for the same license server. You must pick one or the other.

1) VPN – if you choose VPN then read the section “Setting up the VPN Tunnel” below.

2) SSH Tunneling – if you choose SSH then read the section “Setting up the SSH Tunnel” below.

After we have received the required information about your license server, we will setup the service to allow secure connections to your licenses. You will receive an email when this has been completed. Follow the instructions in the email first. After following the instructions in the email, you may connect to your licenses server on your next login.

Request a VPN Tunnel

Provide your license server details

In order to setup the VPN connection between Sabalcore and your license server, we need to know some information about your license server in order to generate a node-locked VPN client for your server. Below is a list of the required information:

  • Operating System (for example Windows 10, Linux, Mac).
  • License server host name as it appears in the license file. This must be a unique name. It can not be “localhost”.
  • Method you’d like to use, direct or routed.

Email support@sabalcore.com the above information along with your Sabalcore account ID.

Direct – Installing the OpenVPN client directly on your license server

After we setup the service you will receive an email with instructions when your server specific OpenVPN client is ready. You will need use the ssClient to install the OpenVPN client. You only need to use the ssClient to install the VPN once. NOTE: the VPN client will node-lock to the server it is first installed on. If you inadvertently install it on the wrong server or if you ever need to move it to a different server, you will need notify Support so that we can refresh it.

You do not need to always log in using the ssClient when running the VPN. To install, run the ssClient directly on the license server and log into your account. Then select “Tunnels ->  Install OpenVPN” from the ssClient menu. Follow instructions at the prompts.

After it is installed, you’ll need to launch the VPN client by double clicking the OpenVPN icon on your desktop or from the start menu as administrator. You must launch it using an admin account. When asked, accept the new profile. If you are prompted for a hostname, username, or password there has been an error. Contact Sabalcore support.

Double click the OpenVPN client and choose

“Connect to the vpn-melb.sabalcore.com”.

After a few moments, the VPN should connect. From this point, you only need to start the OpenVPN client on your license server when you want the tunnel up and active. You do not need to use the ssClient from the license server any longer.

If you have a  local firewall on your license server, be sure it is not blocking incoming connections from the VPN interface (TAP adapter). It would be simplest to set the firewall to allow connections from the VPN interface. Alternatively, you can set it to allow connections from the 172.27.224.0/20 network.

Next, log into your Sabalcore account from any computer other or workstation as you normally would, and start your software such as STAR-CCM+ or Ansys. Just starting the software GUI will normally trigger the license verification. The software should connect to your license server and you should not get any errors or license warnings. If you experience an issue, please contact support.

Routed – Installing the OpenVPN client on a Windows  PC networked to a license server

After we setup the service you will receive an email with instructions when your server specific OpenVPN client is ready. You will need use the ssClient to install the OpenVPN client. To install, log into your account. Then select “Tunnels ->  Install OpenVPN” from the ssClient menu. Follow instructions at the prompts.

After it is installed, you’ll need to launch the VPN client by double clicking the OpenVPN icon on your desktop or from the start menu as administrator. You must launch it using an admin account. When asked, accept the new profile. If you are prompted for a hostname, username, or password there has been an error. Contact Sabalcore support.

  1. Double click the OpenVPN client and choose “Connect to the login.sabalcore.com”.
  2. After a few moments, the VPN should connect.
  3. Next, configure your Windows PC using these instructions. 

From this point, you will need to start the OpenVPN client on your PC to enable the license tunnel.

Next, log into your Sabalcore account and start your software such as STAR-CCM+ or Ansys. Just starting the software GUI will normally trigger the license verification. The software should connect to your license server and you should not get any errors or license warnings. If you experience an issue, please contact your network’s system administrator and Sabalcore support.

Setting up the SSH Tunnel

If you do not have direct access to your local license server, then SSH Tunneling is the only option. SSH tunneling will require that the PC you are using to access Sabalcore also has access to your license server on your local network (i.e. you can use the license from your workstation). In order to setup the connection between Sabalcore and your license server, we need to know some information about your license server and license file. Below is a list of the required information:

  • The operating system your license server is running (i.e. Windows, Linux, Mac).
  • Local Server Port Number (LSPN) –  This is the listening port number of the license file server. This is usually the last number on the SERVER line of your license file. For example. If your license file contains the line “SERVER host 00aa11bb22cc 2001”, then 2001 is the LSPN.
  • License Server Hostname (LSH) –  This is also listed on the SERVER line of your license file and is usually the same as the hostname of the computer on which the license server is running.
  • Local Vendor Port Number (LVPN) –  This the listening port number of the vendor daemon. This is usually specified on the “VENDOR” line of your license file. For example, “VENDOR aplmd PORT=2201”. If you have a VENDOR line, but no port specification, you will need to add one. Sabalcore Support will provide you with the correct port number to use. For example, add “PORT=2201” to the end of your VENDOR line to set the LVPN to 2201. After modifying the license file, please restart your license server. Changing the LVPN should not affect your ability to run the software at your location.

Please email the above information to support@sabalcore.com along with your Sabalcore user ID using the email address that was used to register your Sabalcore account with.

At your LAN, if you are not running the license server on your computer, then you must be able to connect to the license server from your own computer on your network. If you can run the software on your computer, then the local connection to your license server is OK.

To make the connection to your license server, simply select ‘Tunnels -> License Servers’ from the Sabalcore Secure Client menu options. See Figure 1: License Server Setup. Select each of your license tunnels and click ‘Open’ to make the connection. The ‘[*]’ indicates the tunnel is connected. You can save them so they automatically connect each time you login via the ‘File -> Save Settings’ menu option.

 Note that in Fig. 1, two ports are forwarded to the license server. Ports 2345 and 2346 are the local ports on your license server and port 3345 and 3346 are the remote ports on scicluster.com. The first line in Fig. 1, corresponds to the license file SERVER. In order for the software to find your license file server, you will need to specify its location, i.e. PORT@LIC_SERVER. This largely depends on the specific software that you are using. Please refer to your software manual for details on specifying the location of your file server. It is common for this to be set in an environment variable, e.g. LM_LICENSE_FILE. If this is the case for you software, you can simply add “export LM_LICENSE_FILE=PORT@LIC_SERVER” to your ~/.bash_profile file where PORT is the remote port number (not the local port) for license server on scicluster.com (3345 in Fig. 1) and LIC_SERVER is the hostname of your license server (lic_server in Fig. 1). Some software may use a different environment variable name. Other software may have a configuration file in which you can specify the license server. Usually, you will not have to specify the location of the VENDOR daemon because the license server will communicate this to your software. Specific instructions for a few software packages are included below. If you need additionally help, please contact us at support@sabalcore.com.

After we have received the required information about your license server, we will setup the service to allow secure connections to your licenses. You will receive an email when this has been completed. Follow the instructions in the email first. After following the instructions in the email, you may connect to your licenses server on your next login.

Follow the instructions in the License Tunnel email first. You will receive this email after we’ve configured your account for the Tunnel.

Special Instructions when using SSH Tunnel for ANSYS and STAR-CCM+

ANSYS ** This is NOT required if you are using VPN **

** This is NOT required if you are using VPN ** ANSYS software licensing requires at least 3 ports to be forwarded from scicluster.com to your license server. The first port is the ANSYS License Server Port and is found on the SERVER line of your license file and is typically 1055. This corresponds to the ANSYSLMD_LICENSE_FILE variable. You must set this environment variable in your ~/.bash_profile by adding the line:

export ANSYSLMD_LICENSE_FILE=PORT@LIC_SERVER

Where PORT is the remote port on scicluster.com corresponding to your local license server port and LIC_SERVER is the hostname of your license server. Note that the remote port is NOT the same as the local port and will be provided to you by Sabalcore Support. The second port is the Local Vendor Port. For ANSYS, this is the port that the ansys vendor daemon (ansyslmd) uses. After forwarding this port, you do not need to specify it as the server will communicate this to your software. This port must be specified in the license file on the VENDOR line, for example:

VENDOR ansyslmd port=2346

Sabalcore Support will provide you with the port number to use here. Changing this port number in your license file will not affect your ability to use your license locally. The third port is the ANSYSLI_SERVERS port and is used for ANSYS’s license interconnect server. This port is typically 2325 on the license server. You must set this environment variable in your ~/.bash_profile by adding the line:

export ANSYSLMD_LICENSE_FILE=PORT@LIC_SERVER

Where PORT is the remote port on scicluster.com corresponding to your local license interconnect server port and LIC_SERVER is the hostname of your license server. Note that the remote port is NOT the same as the local port and will be provided to you by Sabalcore Support.

STAR-CCM+ ** This is NOT required if you are using VPN **

Power Session License with SSH license tunnel ( ** This is NOT required if you are using VPN Tunnel**)

STARCCM+ sofware licensing requires at least 2 ports to be forwarded from scicluster.com to your license server. The first port is the STARCCM+ License Server Port and is found on the SERVER line of your license file and is typically 1999. This corresponds to the CDLMD_LICENSE_FILE variable. You must set this environment variable in your ~/.bash_profile by adding the line:

export CDLMD_LICENSE_FILE=PORT@LIC_SERVER

Where PORT is the remote port on scicluster.com corresponding to your local license server port and LIC_SERVER is the hostname of your license server. Note that the remote port is NOT the same as the local port and will be provided to you by Sabalcore Support. The second port is the Local Vendor Port. For STARCCM+, this is the port that cd-adapco vendor daemon (cdlmd) uses. After forwarding this port, you do not need to specify it as the server will communicate this to your software. This port must be specified in the license file on the VENDOR line, for example:

VENDOR cdlmd port=2346

Sabalcore Support will provide you with the port number to use here. Changing this port number in your license file will not affect your ability to use your license locally.