# Air-gapped This guide shows you how to install AxoConsole in an air-gapped environment on a virtual machine. To deploy an on-premises AxoConsole that has internet access, see [Deployment guide](../../docs/axoflow/0.81/deploy/onprem/deployment-guide/index.md). Since this is a single instance deployment, we don’t recommend using it in production environments. For additional steps and configurations needed in production environments, [contact our support team](). At a high level, the deployment consists of the following steps: 1. Preparing a virtual machine. 2. Running the installation script on the virtual machine that deploys: * Kubernetes * cert-manager and Traefik * AxoConsole Any of these components can be skipped if already installed. 3. Basic authentication with admin user and password is configured by default. You can also configure other common authentication methods like [LDAP](../../docs/axoflow/0.81/deploy/onprem/authentication/dex/ldap/index.md), [Github](../../docs/axoflow/0.81/deploy/onprem/authentication/dex/github/index.md) and [Google](../../docs/axoflow/0.81/deploy/onprem/authentication/dex/google/index.md). 4. [Before deploying AxoRouter](../../docs/axoflow/0.81/deploy/onprem/prepare-axorouter-hosts/index.md) describes the steps you have to complete on a host before deploying AxoRouter on it. These steps are specific to on-premises AxoConsole deployments, and aren’t needed when using the SaaS AxoConsole. ## Prerequisites To install AxoConsole, you’ll need the following: * The URL for downloading the AxoConsole bundle. You’ll receive this URL from our team. You can request it using the [contact form](). **CAUTION:** Don’t start the [Install AxoConsole](../../docs/axoflow/0.81/index.md#install-console) process until you’ve received the bundle URL. * A license key for AxoConsole. You’ll receive this from our team. You can request it using the [contact form](). * A host that meets the [system requirements](../../docs/axoflow/0.81/deploy/airgapped/index.md#system-requirements). ### System requirements Supported operating system: Ubuntu 24.04, Red Hat 9 and compatible (tested with AlmaLinux 9) The virtual machine (VM) must have at least: Resource | Minimum | Production ---|---|--- CPU | 4 vCPU | 16 vCPU RAM | 8 GB | 16 GB Disk (`/`) | 100 GB | 250 GB * A Minimum setup with 4 vCPU (x86_64-based), 8 GB RAM, and 100 GB disk space can handle about 100 AxoRouter instances and 1000 data source hosts. * A real-life production scenario that handles 100 AxoRouter and 3000 data source hosts with 30-day metric retention would need: * 16 vCPU (x86_64-based) * 16 GB RAM * 250 GB disk space Note Note that AxoRouter and Axoflow agent collects detailed, real-time metrics about the data-flows – giving you observability over the health of the security data pipeline and its components. Your security data remains in your self-managed cloud or in your on-prem instance where your sources, destinations, Axoflow agents, and AxoRouters are running, only metrics are forwarded to AxoConsole. For details on sizing, [contact our support team](). You’ll need to have access to a user with `sudo` privileges. ## Install AxoConsole **CAUTION:** This procedure covers how to deploy a new AxoConsole instance. The installation script can’t upgrade existing deployments, [contact the Axoflow support team]() for detailed upgrade instructions. 1. Download the installation bundle file from the URL you’ve received from the Axoflow Support Team. 2. Transfer the file to the host where you want to install AxoConsole. Extract the file and navigate into the directory. ``` tar -xf axoflow-all-in-one-0.81.3-linux-amd64.tar cd axoflow-all-in-one-0.81.3-linux-amd64 ``` 3. Run the installation script with your license key and the domain name for your AxoConsole deployment. Note Re-running the installer will reuse any existing or modified manifests or user settings (for example, authentication settings added to `/var/lib/rancher/k3s/server/manifests/axoflow-config.yaml`) available on the host. ``` sudo LICENSE_KEY= BASE_HOSTNAME= AXOFLOW_VERSION=0.81.3 bash ./axoflow-install.sh ``` You can use the following flags as needed for your environment. * `--step`: Prompt before each step * `--dry-run`: Show what would be done without executing anything * `--skip-k3s`: Skip k3s installation (already installed) * `--skip-cert-manager`: Skip cert-manager installation * `--disable-traefik`: Disable the built-in Traefik ingress controller of k3s. Use this option when using a custom ingress controller. Advanced flags: * `--skip-images`: Skip container image import entirely. Use when images are already loaded into k3s. * `--image-mode bundle|component|skip`: Control how container images are imported. `bundle` (default) imports pre-packaged image tarballs; `component` imports one image per component; `skip` skips import. * `--prepare-env`: Install k3s, cert-manager, and Traefik only — skip AxoConsole itself. Use for a two-phase install where you want to configure the environment before deploying AxoConsole. * `--ignore-requirements`: Bypass hardware requirement checks. 4. If needed, follow the on-screen instructions. For a test installation, you can usually use the default values. For recommendations for a production environment, [contact our support team](). 5. Wait a few minutes until everything is installed. In case of any errors, check [Troubleshooting](../../docs/axoflow/0.81/deploy/airgapped/index.md#troubleshooting) for tips. 6. The script prompts to display the password of the default `admin` user. Record it, you’ll need it to log in to AxoConsole. ``` ... [2026-06-02 20:44:28] [INFO ] All pods in axoflow are ready/complete [2026-06-02 20:44:28] [INFO ] Axoflow is healthy [2026-06-02 20:44:28] [INFO ] Access the UI at: https:// Show admin credentials? [y/N]: y Username: admin Password: MzGIjuWKjXOtiRs4 ``` If needed, later you can retrieve the password by running: ``` kubectl -n "${AXOFLOW_NAMESPACE}" get secret axoidp-admin \ -o go-template='Username: {{ .data.username | base64decode }}{{ printf "\n" }}Password: {{ .data.password | base64decode }}{{ printf "\n" }}' ``` Note When using AxoRouter with an on-premises AxoConsole deployment, you have to [prepare the hosts before deploying AxoRouter](../../docs/axoflow/0.81/deploy/onprem/prepare-axorouter-hosts/index.md). These steps are specific to on-premises AxoConsole deployments, and are not needed when using the SaaS AxoConsole. ## Login to AxoConsole 1. If the domain name of AxoConsole cannot be resolved from your desktop, add it to the `/etc/hosts` file in the following format. Use and IP address of AxoConsole that can be accessed from your desktop. ``` idp. kcp. telemetry. ``` 2. Open the `https://` URL in your browser. 3. The on-premise deployment of AxoConsole shows a self-signed certificate. If your browser complains about the related risks, accept it. 4. Use the email address and password you got or set in the installation step to log in to AxoConsole. ## Firewall configuration If you run a host firewall (for example, `firewalld`), open the ports AxoConsole and AxoRouter need before you start the installation, otherwise agents and log sources won’t be able to connect. OS- and runtime-specific The reference commands in this section are written for **RHEL 9.X** and the **k3s** Kubernetes distribution, which is the default in the air-gapped AxoConsole bundle. If you run a different operating system, a different firewall front-end, or a Kubernetes distribution other than k3s, the commands, zones, and CIDRs may differ: use the port list and adapt the commands to your environment. For the operating system requirements of k3s, see the [k3s installation requirements](). The [k3s project recommends disabling firewalld entirely]() (`systemctl disable --now firewalld`) and relying on k3s-managed iptables rules instead. Only apply the rules below if your security policy requires `firewalld` to stay enabled. ### Ports to open **On the AxoConsole node:** The AxoConsole host must have the following **Open Ports** : * 80 TCP: Traefik ingress (HTTP, redirected to HTTPS). * 443 TCP: HTTPS for the AxoConsole UI, API, and all web traffic. * 6443 TCP: k3s API server, required for `kubectl` and for the `axolet` agents on AxoRouter nodes to connect back to the cluster. In addition, the k3s pod and service CIDRs (by default `10.42.0.0/16` and `10.43.0.0/16`) must be trusted so that intra-cluster traffic is not filtered. If you deploy AxoRouter on the AxoConsole host, open the ports needed by AxoRouter. For details, see [Install AxoRouter on Linux](../../docs/axoflow/0.81/provisioning/axorouter/linux/index.md). ### Reference rules for RHEL and k3s (default in air-gapped setup) Show the reference `firewalld` commands for RHEL 9.X and k3s. Note These commands assume RHEL 9.X with `firewalld` and a default k3s installation (with Traefik as the ingress controller). Adjust the pod and service CIDRs only if you’ve changed the k3s defaults (`--cluster-cidr` / `--service-cidr`). On the AxoConsole node: ``` # Traefik ingress - HTTP redirect and HTTPS (Console UI, API, all web traffic) firewall-cmd --permanent --add-port=80/tcp firewall-cmd --permanent --add-port=443/tcp # k3s API server - required for kubectl and for axolet agents on AxoRouter nodes firewall-cmd --permanent --add-port=6443/tcp # Trust k3s pod and service CIDRs so intra-cluster traffic is not filtered # Adjust these only if you changed the k3s defaults (--cluster-cidr / --service-cidr) firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 # pod CIDR firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 # service CIDR firewall-cmd --reload ``` If you’ve deployed AxoRouter on the node, open the log-ingestion ports that correspond to the default `portMapping` in the `axorouter-syslog` chart. Disable or skip any port your deployment does not use. ``` # Syslog - standard UDP and TCP firewall-cmd --permanent --add-port=514/udp firewall-cmd --permanent --add-port=514/tcp # Syslog - reliable delivery (RFC 3195) firewall-cmd --permanent --add-port=601/tcp # Syslog - TLS (RFC 5425) firewall-cmd --permanent --add-port=6514/tcp # OpenTelemetry - gRPC receiver firewall-cmd --permanent --add-port=4317/tcp # Splunk HEC receiver (optional - only if you forward Splunk HEC traffic) firewall-cmd --permanent --add-port=9900/tcp # Windows Event Collector (WEC) LoadBalancer service (optional) firewall-cmd --permanent --add-port=5085/tcp firewall-cmd --reload ``` When you create a connector rule in AxoConsole that opens a new listening port on a AxoRouter node, open that port in `firewalld` on the corresponding node as well: ``` # Replace and (tcp or udp) with the values from your connector rule firewall-cmd --permanent --add-port=/ firewall-cmd --reload ``` To list all currently open ports: ``` firewall-cmd --list-ports ``` ## Prepare AxoRouter hosts Note When using AxoRouter with an on-premises AxoConsole deployment, you have to [prepare the hosts before deploying AxoRouter](../../docs/axoflow/0.81/deploy/onprem/prepare-axorouter-hosts/index.md). These steps are specific to on-premises AxoConsole deployments, and are not needed when using the SaaS AxoConsole. ## AxoConsole service reference Service Name | Namespace | Purposes | Function ---|---|---|--- KCP | `axoflow` | Backend API | Kubernetes Like Service with built in database, that service manage all the settings that our system manage Chalco | `axoflow` | Frontend API | Serve the UI API Calls, implement business logic for the UI Controller-Manager | `axoflow` | Backend Service | Reacts to state changes in our business entities, manage business logic for the Backend Telemetry Proxy | `axoflow` | Backend API | Receives agents telemetries UI | `axoflow` | Dashboard | The frontend for AxoConsole Prometheus | `axoflow` | Backend API /Service | Monitoring component to store time series information and an API for query, manage alert rules Alertmanager | `axoflow` | Backend API /Service | Monitoring component to send alerts based on alerting rules (optional, disabled by default) Axoflow IDP | `axoflow` | Identity Connector/Proxy | Identity Connector/Proxy to allow the customer to use own identity (Google, LDAP, etc.) Axolet Dist | `axoflow` | Backend API | Static artifact store to contains agents binaries Cert Manager (kcp) | `axoflow` | Automated Certificate management tool | Manage certificates for Agents Cert Manager | `cert-manager` | Automated Certificate management tool | Manage certificates for Axoflow components (Backend API, HTTP Proxy) Traefik Ingress Controller | `kube-system` | HTTP Proxy | Route the HTTP traffic between multiple Frontend/Backend APIs ## Troubleshooting * If you get the `[ERROR] Timed out waiting for k3s node to be Ready` error message, increase the timeout limit by running `K3S_TIMEOUT=180`, then rerun the installation script. In case of other errors, run the following command to create a debug package from the cluster, and [contact our support team](). ``` sudo k3s kubectl cluster-info dump --all-namespaces --output-directory=./cluster-dump && tar -czvf cluster-dump.tar.gz cluster-dump ``` ## Uninstall AxoConsole If you want to uninstall every component installed by the `axoflow-install.sh`, including any custom configuration changes you made, run the following commands. **CAUTION:** Hazard of data loss The following commands remove the k3s Kubernetes distribution as well. If you’re using k3s to run other software apart from AxoConsole, don’t run these commands. ``` k3s-uninstall.sh; rm-rf /var/lib/rancher ```