Air-gapped

This guide shows you how to install AxoConsole in an air-gapped environment on a virtual machine. To deploy an on-premises AxoConsole that has internet access, see Deployment guide.

Since this is a single instance deployment, we don’t recommend using it in production environments. For additional steps and configurations needed in production environments, contact our support team.

At a high level, the deployment consists of the following steps:

1. Preparing a virtual machine.

2. Running the installation script on the virtual machine that deploys:

   • Kubernetes
   • cert-manager and Traefik
   • AxoConsole

   Any of these components can be skipped if already installed.

3. Basic authentication with admin user and password is configured by default. You can also configure other common authentication methods like LDAP, Github and Google.

4. Before deploying AxoRouter describes the steps you have to complete on a host before deploying AxoRouter on it. These steps are specific to on-premises AxoConsole deployments, and aren’t needed when using the SaaS AxoConsole.

Prerequisites

To install AxoConsole, you’ll need the following:

• The URL for downloading the AxoConsole bundle. You’ll receive this URL from our team. You can request it using the contact form.

  CAUTION:

  Don’t start the Install AxoConsole process until you’ve received the bundle URL.

• A license key for AxoConsole. You’ll receive this from our team. You can request it using the contact form.

• A host that meets the system requirements.

System requirements

Supported operating system: Ubuntu 24.04, Red Hat 9 and compatible (tested with AlmaLinux 9)

The virtual machine (VM) must have at least:

• A Minimum setup with 4 vCPU (x86_64-based), 8 GB RAM, and 100 GB disk space can handle about 100 AxoRouter instances and 1000 data source hosts.

• A real-life production scenario that handles 100 AxoRouter and 3000 data source hosts with 30-day metric retention would need:

  • 16 vCPU (x86_64-based)
  • 16 GB RAM
  • 250 GB disk space

For details on sizing, contact our support team.

You’ll need to have access to a user with sudo privileges.

Install AxoConsole

1. Download the installation bundle file from the URL you’ve received from the Axoflow Support Team.

2. Transfer the file to the host where you want to install AxoConsole.

   Extract the file and navigate into the directory.

   tar -xf axoflow-all-in-one-0.81.3-linux-amd64.tar
   cd axoflow-all-in-one-0.81.3-linux-amd64
   

3. Run the installation script with your license key and the domain name for your AxoConsole deployment.

   Note Re-running the installer will reuse any existing or modified manifests or user settings (for example, authentication settings added to /var/lib/rancher/k3s/server/manifests/axoflow-config.yaml) available on the host.

   sudo LICENSE_KEY=<your-license-key> BASE_HOSTNAME=<axoconsole-domain-name> AXOFLOW_VERSION=0.81.3 bash ./axoflow-install.sh 
   

   You can use the following flags as needed for your environment.

   • --step: Prompt before each step
   • --dry-run: Show what would be done without executing anything
   • --skip-k3s: Skip k3s installation (already installed)
   • --skip-cert-manager: Skip cert-manager installation
   • --disable-traefik: Disable the built-in Traefik ingress controller of k3s. Use this option when using a custom ingress controller.

   Advanced flags:

   • --skip-images: Skip container image import entirely. Use when images are already loaded into k3s.
   • --image-mode bundle|component|skip: Control how container images are imported. bundle (default) imports pre-packaged image tarballs; component imports one image per component; skip skips import.
   • --prepare-env: Install k3s, cert-manager, and Traefik only — skip AxoConsole itself. Use for a two-phase install where you want to configure the environment before deploying AxoConsole.
   • --ignore-requirements: Bypass hardware requirement checks.

4. If needed, follow the on-screen instructions. For a test installation, you can usually use the default values. For recommendations for a production environment, contact our support team.

5. Wait a few minutes until everything is installed.

   In case of any errors, check Troubleshooting for tips.

6. The script prompts to display the password of the default admin user. Record it, you’ll need it to log in to AxoConsole.

   ...
   [2026-06-02 20:44:28] [INFO ] All pods in axoflow are ready/complete
   [2026-06-02 20:44:28] [INFO ] Axoflow is healthy
   [2026-06-02 20:44:28] [INFO ] Access the UI at: https://<axoconsole-domain-name>
   Show admin credentials? [y/N]: y
   Username: admin
   Password: MzGIjuWKjXOtiRs4
   

   If needed, later you can retrieve the password by running:

   kubectl -n "${AXOFLOW_NAMESPACE}" get secret axoidp-admin \
   -o go-template='Username: {{ .data.username | base64decode }}{{ printf "\n" }}Password: {{ .data.password | base64decode }}{{ printf "\n" }}'
   

Login to AxoConsole

1. If the domain name of AxoConsole cannot be resolved from your desktop, add it to the /etc/hosts file in the following format. Use and IP address of AxoConsole that can be accessed from your desktop.

   <AXOFLOW-CONSOLE-IP-ADDRESS> <your-host.your-domain> idp.<your-host.your-domain> kcp.<your-host.your-domain> telemetry.<your-host.your-domain>
   

2. Open the https://<your-host.your-domain> URL in your browser.

3. The on-premise deployment of AxoConsole shows a self-signed certificate. If your browser complains about the related risks, accept it.

4. Use the email address and password you got or set in the installation step to log in to AxoConsole.

Firewall configuration

If you run a host firewall (for example, firewalld), open the ports AxoConsole and AxoRouter need before you start the installation, otherwise agents and log sources won’t be able to connect.

Ports to open

On the AxoConsole node:

The AxoConsole host must have the following Open Ports:

• 80 TCP: Traefik ingress (HTTP, redirected to HTTPS).
• 443 TCP: HTTPS for the AxoConsole UI, API, and all web traffic.

• 6443 TCP: k3s API server, required for kubectl and for the axolet agents on AxoRouter nodes to connect back to the cluster.

In addition, the k3s pod and service CIDRs (by default 10.42.0.0/16 and 10.43.0.0/16) must be trusted so that intra-cluster traffic is not filtered.

If you deploy AxoRouter on the AxoConsole host, open the ports needed by AxoRouter. For details, see Install AxoRouter on Linux.

Reference rules for RHEL and k3s (default in air-gapped setup)

# Traefik ingress - HTTP redirect and HTTPS (Console UI, API, all web traffic)
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp

# k3s API server - required for kubectl and for axolet agents on AxoRouter nodes
firewall-cmd --permanent --add-port=6443/tcp

# Trust k3s pod and service CIDRs so intra-cluster traffic is not filtered
# Adjust these only if you changed the k3s defaults (--cluster-cidr / --service-cidr)
firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16  # pod CIDR
firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16  # service CIDR

firewall-cmd --reload

# Syslog - standard UDP and TCP
firewall-cmd --permanent --add-port=514/udp
firewall-cmd --permanent --add-port=514/tcp

# Syslog - reliable delivery (RFC 3195)
firewall-cmd --permanent --add-port=601/tcp

# Syslog - TLS (RFC 5425)
firewall-cmd --permanent --add-port=6514/tcp

# OpenTelemetry - gRPC receiver
firewall-cmd --permanent --add-port=4317/tcp

# Splunk HEC receiver (optional - only if you forward Splunk HEC traffic)
firewall-cmd --permanent --add-port=9900/tcp

# Windows Event Collector (WEC) LoadBalancer service (optional)
firewall-cmd --permanent --add-port=5085/tcp

firewall-cmd --reload

# Replace <PORT> and <PROTOCOL> (tcp or udp) with the values from your connector rule
firewall-cmd --permanent --add-port=<PORT>/<PROTOCOL>
firewall-cmd --reload

firewall-cmd --list-ports

Prepare AxoRouter hosts

AxoConsole service reference

Troubleshooting

• If you get the [ERROR] Timed out waiting for k3s node to be Ready error message, increase the timeout limit by running K3S_TIMEOUT=180, then rerun the installation script.

In case of other errors, run the following command to create a debug package from the cluster, and contact our support team.

sudo k3s kubectl cluster-info dump --all-namespaces  --output-directory=./cluster-dump && tar -czvf cluster-dump.tar.gz cluster-dump

Uninstall AxoConsole

If you want to uninstall every component installed by the axoflow-install.sh, including any custom configuration changes you made, run the following commands.

k3s-uninstall.sh; rm-rf /var/lib/rancher