> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/expel-assembler/add-a-new-assembler.md). # Add a New Assembler {% hint style="info" %} If your external users are able to directly log in to the security device because it is on an external network, you do not need an assembler to set up your integration with Expel. {% endhint %} The Expel Assembler creates a secure VPN connection so that Expel can access the security devices that live on your internal network. It is packaged as a virtual machine. The first steps in leveraging an assembler as part of an Expel integration are to add a new assembler in Workbench and configure your firewall. Then you can deploy the virtual machine in a supported vendor environment, and continue on with the integration. Some virtual machine vendors may also require that you download and verify a CoreOS image file. You will find those instructions in this guide as well. ## Prerequisites 1. Your security device should live on an internal, private network where a direct external connection cannot be established. 2. You must have sufficient resources to run a virtual machine. You will need: * 2 virtual CPUs * 8 GB RAM * 20 GB disk space 3. You must be able to run an assembler with one of our supported environments. They include: * Hyper-V or VMware for on-premises environments * AWS, Azure, Google Cloud Platform (GCP), or Nutanix for cloud environments 4. You may also need space to install multiple virtual machines if your network is segmented and you require multiple assemblers. {% hint style="info" %} If you have any questions about how many assemblers to install, [contact Support](/support/how-to-reach-us.md). {% endhint %} ## Step 1: Add an Assembler in Workbench The first step is to alert us that you want to use an assembler, and to also tell us how the virtual machine should communicate with your internal network(s) and with us. You do this by adding a new assembler and configuring its properties. 1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). 2. In the side menu, navigate to **Organization Settings > Assemblers**. 3. Select **Add Assembler**. 4. Complete the fields as follows: * **Name** - enter a name that might help you more easily identify this integration, such as “VMware Assembler” or “Network1 Assembler”; this name will display in Workbench under the Name column, and is a text string that you can filter on. * **Location** - enter the location of your integration, for example “cloud” or “on prem;” this is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations. * **DNS servers (optional)** - most of the time there will not be any custom network settings and this field can be left **blank**; if you have a unique DNS server for your setup, enter the IP address here so that Expel can connect the assembler to the Internet. * **Allow SSH access to the assembler** - it is recommended that you leave this box unchecked, as we will be managing the assembler on your behalf; you can check it if you wish to have direct access to the assembler for some reason (i.e. to see the packages or install something yourself). * **Type** - the assembler will use **DHCP** by default, however you can choose to use a static IP address if you prefer. ***Note that if you choose to use a static IP address and set it up incorrectly, we will not be able to access your network or provision the assembler.*** * **Reboot window** - specify an acceptable day and window of time for Expel to apply security updates/patches to the underlying packages on your virtual machine and to reboot, as this will cause your virtual machine and assembler to temporarily go offline. *Note that the reboot could happen at any time during the window specified, and that the window cannot be less than 30 minutes; most updates take 3 minutes or less but in rare cases may take much longer.* 5. Select **Save**. 6. Repeat this process if you need to add additional assemblers. ## Step 2: Update your Firewall Configuration Each assembler requires two **outbound** connections to a port on our VPN server. These two connections are used to encrypt your information and access all necessary assets and software packages that are required by each assembler. Before you deploy a virtual machine, you must edit your firewall to allow these two outbound connections. {% hint style="warning" %} For Azure, make sure you set up these connections inside a [resource group](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal). {% endhint %} {% stepper %} {% step %} ### First Outbound Connection **Source**: Your Assembler Virtual Machine **Destination**: vpnassets.prod.assemblers.expel.io (34.149.216.90) **Port**: 443 {% endstep %} {% step %} ### Second Outbound Connection **Source**: Your Assembler Virtual Machine **Destination**: servicevpn.opsv2.expel.io (34.107.163.233) **Ports**: 443 or 8099 (either is sufficient) {% endstep %} {% step %} ### AWS Virtual Machines Only In addition to the two required outbound connections described above, you must also create one or more temporary outbound connections for the ignition file. Because of its size, the ignition file must be stored in an S3 bucket and referenced remotely during deployment. Any temporary connections are used once, and solely for that purpose. **Source**: Your Assembler Virtual Machine **Destination**: [Follow these instructions to find a range of S3 IP addresses for your region](https://repost.aws/knowledge-center/s3-find-ip-address-ranges) **Port**: 443 You will be instructed to delete any temporary connection(s) at the appropriate time in the AWS deployment guide (linked in [Step 4](#step-4-deploy-your-virtual-machine), below). {% endstep %} {% endstepper %} ## Step 3: Download the Base CoreOS Image/Artifact {% hint style="info" %} **AWS, GCP, and Nutanix users should skip this section and go to** [**Step 4**](#step-4-deploy-your-virtual-machine)**.** This is because: * If you are deploying an assembler in AWS or GCP, the CoreOS image is hosted within the infrastructure and does not need to be downloaded. * If you are deploying an assembler in Nutanix, the CoreOS image will be imported via a URL and checksum. For deploy targets such as **Hyper-V**, **VMware**, or **Azure**, you must supply the standard CoreOS image or artifact to boot your virtual machine. {% endhint %} The ignition file will provide all the necessary instructions to the CoreOS image or artifact, and will be obtained during [Step 4](#step-4-deploy-your-virtual-machine). To download the appropriate file from Fedora CoreOS: 1. Go to the [Fedora CoreOS downloads page](https://fedoraproject.org/coreos/download?stream=stable). * For Hyper-V and VMware, scroll to the **Bare Metal & Virtualized** section. * For Azure, scroll to the **Cloud Images** section. 2. Locate the correct file for your environment. * First, select the **Download** button to download the image. * Next, select the **Verify** button and follow the on-screen steps to verify your download. You will be asked to download additional files and import a Fedora GPG key as part of this process. 3. After you have successfully verified your download through Fedora, you can deploy your virtual machine. {% hint style="info" %} If you are having trouble verifying your download or need help with the checksum file, see [this topic in the Fedora CoreOS Documentation](https://docs.fedoraproject.org/en-US/fedora/latest/preparing-boot-media/#sect-verifying-images). If you still need help or are unable to successfully match the \`checksum\` values, [contact Support](/support/how-to-reach-us.md). {% endhint %} ## Step 4: Deploy Your Virtual Machine You can now configure and deploy your chosen virtual machine and verify the connection in Workbench, which will complete the Assembler portion of your integration. Go to one of the following links for instructions: * [Deploy the Assembler in AWS](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws.md) * [Deploy the Assembler in AWS (Terraform)](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-aws-terraform.md) * [Deploy the Assembler in Microsoft Azure](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-microsoft-azure.md) * [Deploy the Assembler in Microsoft Azure (Terraform)](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-microsoft-azure-terraform.md) * [Deploy the Assembler in GCP](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-gcp.md) * [Deploy the Assembler in GCP (Terraform)](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-gcp-terraform.md) * [Deploy the Assembler in Hyper-V](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-hyper-v.md) * [Deploy the Assembler in VMware](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-vmware.md) * [Deploy the Assembler in Nutanix](/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-nutanix.md) After you have a working assembler, you will need to add your technology as a security device in Workbench to complete the integration. Additional help and direct links to these instructions can be found in each guide above. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/connect-your-technology/expel-assembler/add-a-new-assembler.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.