Learning Forum

[ANSYS_MMadore]

Connecting Ansys Gateway Powered by AWS to your on-premises license server

/ Introduction

This article covers the steps required for a customer to set up a connection to an on-premises license server to utilize their floating Ansys software licenses on Ansys Gateway Powered by AWS.

/ Setting up IP Forwarding

IP forwarding mode is a method that involves the relocation of address and/or port numbers of a packet and sending it to a new destination. IP forwarding is quick and easy to set up. It is a self-service solution and when configured requires no ongoing maintenance. This is the simplest configuration that allows you to run jobs on Ansys Gateway Powered by AWS using your on-premises licenses. An alternative is to configure a VPN for connectivity of your VPC to your on-premises network to allow direct license checkout.

 

 / Prerequisites

To set up IP forwarding, you need the following:

·         An IT administrator with access to your company's on-premises license server.

·         The public IP address of the on-premises license server or firewall. The IP address must be static.

·         A list of associated license and vendor ports:

o    Ensure that vendor ports are fixed in license files

o    For Ansys FlexLM licensing these are typically ports 1055,1056, and 2325

/ Obtain Information, Update Ports and Restart On-Premises License Server

This section lists the steps to be followed on your local on-premises workstation where the license server is hosted.

/ Obtain Port Information

Let us first obtain the port (license and the vendor) information from the license file and/or the license logs. For both FlexLM and RLM there are 2 processes that handle license access:

• License Server (lmgrd or rlm)
• Vendor Daemon

For FlexLM, look at the part of the log when the license server was started. It will display information in the following format. You will need to obtain the ports from this part of the log:

00:00:00 (lmgrd) FlexNet Licensing () started on

00:00:00 (lmgrd) lmgrd tcp-port

00:00:00 (lmgrd) Started (pid )

00:00:00 (lmgrd) using TCP-port

/ Update Vendor Ports

Each time the license server is restarted the vendor port(s) might change therefore we need to persist a port number to be further used in the Ansys Gateway Powered by AWS IP Filtering setup. Before making changes to the vendor port(s), make sure you temporarily shut down the license server and there are no running jobs.

• Open the license file in a text editor with admin privileges.
• Edit the vendor port(s) to assign a fixed port to the vendor daemon. We suggest using port 1056 as an example given below:

VENDOR ansyslmd PORT=1056

Restart the License Server and Verify Changes

• In order to apply the changes, the license server should be restarted
• Look at the FlexNet license log file and verify if the vendor port is correctly updated

/ Ensure Firewall Access

Firewalls often cause issues in these setups. Use the tips and guidelines below to ensure that Windows and Linux firewalls as well as company firewalls allow traffic to flow properly.

• In the ansyslmd.ini file on the license server, set the ANSYSLI_EXTERNAL_IP entry to the IP of the firewall's Internet-facing IP address. Then, restart the license services.
• Set up port forwarding on the main firewall for ports 1055, 1056, and 2325 (for the incoming Ansys IP address).
• The DNS resolution for the public-facing IP address used in the step above must resolve for both reverse lookups, and the name returned must resolve in a forward lookup to something that will eventually get to the IP address. Trying the DNS name of the firewall in the Cloud Admin interface and your license server may help.
• The IP and DNS must be static.
• Add a new A-name record to the DNS hosting service to set the public IP address to a fixed DNS name (for example, 127.0.0.1 server.abc.com).
• Use the Fully Qualified Domain Name in the license file (for example, server.abc.com).

/ Verify the Connection

From a Windows command line, from a VM within your Ansys Gateway Powered by AWS environment, run the following command for each of the three ports (1055, 1056, 2325), changing 127.0.0.1 to the DESTINATION IP and the Port value as appropriate:

powershell -Command "Test-NetConnection 127.0.0.1 -Port 1055"

A successful test looks similar to the following:

ComputerName     : 127.0.0.1
 
RemoteAddress    : 127.0.0.1
 
RemotePort       : 1055
 
InterfaceAlias   : Loopback Pseudo-Interface 1
 
SourceAddress    : 127.0.0.1
 
TcpTestSucceeded : True

Once connectivity is successful, the firewalls may be modified to restrict to only the necessary IP addresses to cover your VPC pool of potential IP addresses.

/ Setting up Ansys License Manager for Express Setup 

With Express Onboarding Setup, since there is no Active Directory, AWS DNS is used for resolving hostnames. For Linux machines the hostname is set appropriately and is of the format ip-x-x-x-x.region.compute.internal. Windows hostname should be similar but Windows OS does not accept “.” In the hostname. AWS instead creates a dummy hostname of the format “EC2AMAZ-xxxxx” which is not resolvable to an IP address. The hostname displayed on Windows VDI tile on Ansys Gateway interface of the format “ansxxx” is also a dummy hostname. 

 

To address above issue, Ansys License Manager should be configured to use private IP address instead of hostname. Before using the license file to setup Ansys License Manager, ensure that the private IP address of the server hosting the Ansys License Manager is used.  

 

1. Using the hostname as shown in Ansys License Manager below will not work due to the hostname resolution issue mentioned above. Use private IP address.
2. When you receive your license file, you will need to edit the file to replace the server hostname with the private ip address of the license server.
3. You will also need to add the static port for ansyslmd by adding PORT=1056 on the SERVER line. 

 

To summarize, using private IP address for any communication within VPC should work.  

For cross communication across VPCs, VPCs should be peered. For example, if Ansys License Server is hosted on another region/VPC, it should be peered with the VPC from which you are trying to connect to the license server. 

For communication with a local network, the local network and VPC should be connected via VPN. For example, if Ansys License Server is hosted on a local network, local network and the VPC from which you are trying to connect to the license server should be connected by VPN.