Tutorial: How to Migrate an Access Server Installation
Overview
This tutorial provides helpful steps for migrating an Access Server installation to a new server and includes information about upgrading Access Server during the process.
Prerequisites
An installed Access Server.
Knowledge of your server's license type (covered in step 1).
Knowledge of how clients connect — via IP address or hostname (covered in step 2).
Sign in to the Admin Web UI.
Select Configuration → Activation.
Take note of your activated license key to determine the type. For descriptions and examples of the license types available, refer to License keys for Access Server.
Now that you know your license type, refer to the appropriate section below to understand how it affects an upgrade/migration.
Subscription license key
A subscription license key offers the easiest user experience for upgrading and migrating Access Server. You can activate a subscription license on more than one server at a time, and you can activate it on the old and new servers simultaneously as you migrate.
Fixed license key
A fixed license key requires you to work with our support team to reissue the license key for the new server because they are locked to one server. You can contact us before your server migration, as the old license key will still function for up to two weeks, giving you time to migrate your settings to the new server and test things out.
AWS tiered subscriptions
You can purchase your connections through AWS when you launch a per-licensed Amazon AWS image. Amazon's system then manages licensing and billing for your instances. You can set up a new instance and migrate your data there.
For example, if you want to switch from a 10 connected devices instance to a 25 connected devices instance, you would backup your old instance's Access Server configuration, restore it to the new instance, update the DNS recording pointing to your Access Server or reattach the old elastic IP to the new instance, and then take the old instance down (to avoid incurring extra costs).
Perpetual licenses
Perpetual licenses are our oldest license keys, which we no longer sell. We honor the original license terms, including that they don't support upgrades. However, because you lose this license key when you upgrade, we recommend purchasing a new subscription license key.
Your users and clients can connect to your Access Server in two ways:
Using the server's IP address.
Which of the ways above your users and clients connect will determine how impacted they'll be by a server migration. Refer to the section below that fits your setup:
If your clients connect using the IP address, this will likely change when you migrate servers, and clients will no longer be able to connect. Existing client installations will need to download new connection profiles—unless you can associate the same IP address with the new server (such as with an Elastic IP in AWS).
We recommend setting up a proper hostname, such as vpn.yourcompany.com, so you don't have to update clients and connections should the server's IP address change:
If your clients connect using the hostname, you’ll only need to update the DNS A record with the new IP address once you’ve migrated servers.
Make a backup of your current Access Server environment:
Once completed, you have a backup of configuration files in /usr/local/openvpn_as/. They all end in .bak and contain everything unique about your Access Server installation.
If you use PAM, LDAP, RADIUS, or SAML authentication:
The backup commands create a backup file of users and passwords for local authentication.
If users authenticate with PAM, their passwords are stored in the operating system. The backup commands in the tutorial don’t back up PAM users or passwords.
Passwords for user authentication with LDAP, RADIUS, or SAML are stored in those systems and are not involved in the Access Server migration process. Ensure the new installation can reach those systems when you migrate.
Install a new Access Server on the hardware and platform of your choice.
Restore the backup files to your new Access Server installation:
Access Server 2.10.0 and newer no longer creates the system user, openvpn. Instead, it’s created as a local user in Access Server’s user database.
If you migrate configuration from Access Server 2.9.6 and older, you need to create this system user with these commands:
adduser openvpn passwd <SET_PASSWORD>
Before you switch to the new server and shut down your old one, you can test a connection from your machine using the local hosts file.
Open the hosts file with administrator privileges.
Add the IP address of your new VPN server.
Point it to your hostname, such as vpn.yourcompany.com.
Test your connections to the new server:
Can you access the Admin and Client Web UIs?
Can you connect to the VPN server using your existing OpenVPN Connect connection profile?
Once your tests pass, you can update the DNS record to point to your new server so all users switch over.
Finally, update the DNS record to point to your new server so all users switch over.