The Virtual Private Cloud (VPC) allows you to network Flame instances, a project server, and Burn nodes together in your cloud implementation.

This topic lists minimum requirements. Adapt these to your own deployment to implement an operational security that matches your environment.

Network & Security

To have Flame Family services run across your Virtual Private Cloud (VPC), you need to define Security Groups and open ports and port ranges. You want to create these security groups:

• Flame Family products
  • (optional) Elastic Fabric Adapter for use with CDI
• Burn
• Project Server
• IGMP-multicast

You also need to create a security group for your remote streaming protocol solution. See the HP Anyware and the AWS NICE DCV pages for their respective groups.

You create the VPC security groups in VPC > Security > Security Groups.

Flame Family products security group flame

Inbound rules only. Use the default outbound rules.

Elastic Fabric Adapter (EFA) Security Group

If you plan on using AWS CDI, you must enable EFA on Flame instances you will create. This requires creating an EFA-specific security group. Follow these steps to create one.

1. In the AWS console, under the EC2 service, select Security Groups under Network & Security.
2. Click Create security group.
3. Give a descriptive name to your security group, eg Flame EFA SG, and enter a description.
4. Click Create security group.
5. On the new page that appears, copy the Security Group ID (sg-###) of your security group.
6. Click Edit inbound rules, then Add rule.
7. For type, select All traffic, select Custom for Source, then paste the Security group ID from the previous step in the source address box.
8. Click Save rule.
9. Select the Outbound rules tab, then Edit outbound rules.
10. For type, select All traffic, select Custom for Source, then paste the Security group ID from the previous step in the source address box
11. Click Save rule.

Burn security group

Inbound rules only. Use the default outbound rules.

Project Server security group

Inbound rules only. Use the default outbound rules.

NAS security group

Inbound rules only. Use the default outbound rules.

IGMP-multicast

Inbound rules

* When adding the rule to the security group, select the type "Custom Protocol" from the drop-down.

** When adding the rule to the security group, type '2' in the protocol text field.

Outbound rules

* When adding the rule to the security group, select the type "Custom Protocol" from the drop-down.

** When adding the rule to the security group, type '2' in the protocol text field.

Set Up an AWS Transit Gateway

To support the various networking capabilities of Flame Family products, you need to configure Transit Gateway service on your instances.

You could edit the framestore map to enable Wire between Flame instances on your VPC, but a Transit Gateway enables Wire without editing the framestore map. In short, a Transit Gateway allows you to use the self-discovery capabilities of Autodesk Flame services.

If you plan on setting up a Transit Gateway for your VPC, AWS already has detailed documentation on the Transit Gateway and its configuration.

• Transit Gateway overview
• Getting started with Transit Gateways
• Transit Gateway FAQ

Transit Gateway uses a subnet in each availability zone (AZ) used by your Virtual Private Cloud (VPC). You only need to attach the subnets in your VPC where you provision a Flame instance. If there is a subnet (AZ) that you won’t be using, then you don't need to attach it to your TGW.

The following steps provide an overview of the process to set up a Transit Gateway, with the options required to make it work with a Flame-based workflow. For detailed operation and settings information, refer to the AWS documentation.

To set up a Transit Gateway, you use the AWS Console > VPC menu. Down the left menu, open Transit Gateways.

To set up a Transit Gateway, you need to open and set up the different sections in the following order:

1. Transit Gateways
2. Transit Gateway Attachments
3. Transit Gateway Route Table
4. Transit Gateway Multicast

1. Transit Gateways

Where you create the Transit Gateway. Make sure to select the following options:

• DNS support
• Default route table association
• Default route table propagation
• Multicast support

You can leave Auto accept shared attachments deselected.

2. Transit Gateway Attachments

Where you attach your Transit Gateway to your Virtual Private Cloud (VPC).

Set the following options:

• Details

  • Transit Gateway ID: The Transit Gateway you created.
  • Attachment Type: VPC

• VPC attachment

  • DNS Support: Selected
  • IPv6: Unselected
  • VPC ID: The ID of your VPC

3. Transit Gateway Route Tables

Where the routing tables are created.

You do not have any options to set in this menu: it is automatically generated when you create your Transit Gateway attachment.

4. Transit Gateway Multicast

Where you set how traffic flows for all associated subnets.

Set the following options:

• Details

  • Transit Gateway ID: The Transit Gateway you created.

• Configure the Transit Gateway multicast domain

  • IGMPv2 support: Selected
  • Auto accept shared associations: Unselected

You must also associate your VPC subnets to your Transit Gateway multicast domain. This constrains the multicast to only the subnets that require it. Your subnets are listed in Virtual Private Cloud > Subnets. Every Flame instance part of the same Wire/Backburner network must be in a subnet associated to the same Transit Gateway multicast domain.