Getting started with Tehama Installation

Have you completed the Getting Started with Joining Tehama Guide? If not, please go back and do so before proceeding.

Purpose

This guide provides the basic steps necessary in order to create, configure and connect to a Room running within Tehama Service.

Here are some typical scenarios to help you understand the flexibility provided by Tehama PSM. Choose one that applies best to your situation.

  1. Typical room creation scenarios
  2. Typical room configuration scenarios

Typical room creation scenarios

These scenarios result from your organization wanting to create a Room and invite another organization to either complete the configuration of the room or to join it to deliver services.

  1. I am a buyer of services and want to create a room and invite a provider to deliver services where they need access to assets or services running on my infrastructure.
    See Creation Scenario #1.

  2. I am a service provider and I want to invite my buyer to create a room that I will use to deliver service.
    See Creation Scenario #2.

Room Creation Scenario 1:

"I am creating a room connected to my organization and then inviting another organization to join and use the room"

  1. Select the ROOMS tab in the top navigation bar.

  2. Click the NEW button at the top right.

    The CREATE ROOM dialog will appear.

    • In the CREATE ROOM dialog:

      • Give the room a name
      • Select Connect this room to --> "Your Organization"
      • You may opt to select the Create Free Trial Room option. If you leave this option unselected, you will be billed for this room. (This option is only visible to those organizations who are eligible for a free trial room. The TCU usage within the Trial room is offset by the Trial TCU credits allocated to your organization. If the TCU usage in the Trial room is over the number of available Trial TCU credits, then you will be billed for the difference.)
      • Select Region --> the region in which you want this room's infrastructure to be provisioned
      • Click CONTINUE
        A dialog displaying the following message will appear:
        "Before you can start using the room, you need to connect it to your network."

  3. Click CONTINUE.
    This will start a guided process to configure and create your room and, if you so choose, connect it to your Organization's network.

  4. The Desktop Settings - Network Access Configuration dialog will appear.

    (a) Decide whether or not to grant Desktop Administrator privileges to desktop users.

    This is an important question that asks whether you want users of desktops provisioned in the Room to have admin access to their desktops. This decision is unfortunately not reversible.

    Attention: This setting is a global setting for your room and will impact ALL desktop users within your room, including the organization owner (the user with the Admin role for your organization) and users with the Tehama Admin role from the Tehama Support team.


    • If you wish to grant administrator privileges to desktop users, place a checkmark beside Give Desktop Administrator Privileges. (Please read the information on the screen carefully before making this decision.)
    • If you do not wish to grant administrator privileges to desktop users, leave the check box blank.

      (b) Select one of the options in the Network Access Mode dropdown field.

      You have two options:

    • Internet only
      Choose this if you only want your Room to connect to applications and services in the cloud (constrained by your Room's firewall settings).
      Since the default value for Network Access is 'Tehama Gateway', to choose this option:
      • Click on the dropdown Network Access Mode field to open it.
      • Select the 'Internet Only' option.

        The Status page will change to reflect your choice of 'Internet Only' mode.

        NOTE: When network access is set to 'Internet Only', Tehama denies all UDP traffic apart from DNS lookup.

        or
    • Tehama Gateway
      Choose this if you want your Room to connect to your organization's private network (as with the 'Internet only' option, constrained by your Room's firewall settings).
      This is the default option. You do not have to do anything to choose this option when creating a room.

      This option requires you to install a Tehama Gateway (at least one) somewhere in your network's infrastructure.

  5. If you selected Internet Only as your network access method ...

    You will see a FINISH button and a checkbox giving you the option to build your new room's infrastructure as soon as you click FINISH. This checkbox is enabled by default.

    You will incur the cost of the room when the room's infrastructure begins to build.

    If you are willing to accept responsibility for the cost of the room, leave the checkmark in place beside Build room when finish button is pressed. Otherwise, click in the checkbox to remove the checkmark.

    Click FINISH to proceed.

    Proceed to step eight.

  6. If you selected Tehama Gateway as your network access method ...

    You will see a CONTINUE button. Click the button to proceed.

  7. You will see the Gateway page.

    The Gateway page gives you the information you need to install a gateway in your private network and gives you the access key you will need to connect the gateway to your room.

    Connecting a Tehama Gateway to your new room will cause your new room's infrastructure to begin building.

    You will incur the cost of the room when you connect it to a Tehama Gateway, causing the room's infrastructure to begin building.

    You can either install/connect the gateway to your room now:
    1. Proceed to install the TEHAMA GATEWAY now using the Tehama Gateway User Guide instructions, which you can access by clicking on the Show User Guide link. Note that if you're just trying out Tehama you can also just install the Tehama Gateway in a temporary location and have your IT people move it later.

      NOTE: Due to a limitation in the authentication framework used by Tehama, the Tehama Gateway cannot be installed on the 172.31.x.x network. In addition, Tehama cannot connect to resources that are on the 172.31.x.x network directly.
      If you have the following situation:
      • the Tehama Gateway is on a supported network; and
      • a resource is on the 172.31.x.x network
      then a workaround would be to create a NAT on the network to NAT the address of the resource to an address that Tehama can see, like 10.x.x.x or something similar.


      or, if you're not comfortable doing that and need an IT person to help:
    2. Opt to leave installation of the TEHAMA GATEWAY until after you have invited another person to your organization so they can help. See the Organization User Guide if you need help figuring out how to invite someone but it's fairly easy to figure out if you just go to TEAM in the top navigation bar.

      Click DONE to proceed.
  8. Observe that the navigation bar will have changed to display: "ROOMS > your room name". Your Room page will sprout four tabs, CONNECTION, MEMBERS, AUDIT and POLICY.

  9. Select the STATUS sidebar item in the CONNECTION tab. (This should be the current page after the previous step.) This page shows your Room's status and its current 'Network Access' selection.

    At this point your room status should be one of the following, depending on the choices you made in the previous step:

    • Building or Built (for 'Internet Only' network access mode, if you opted to build above), or
    • Pending Gateway Connection or Connected (for 'Tehama Gateway' network access mode).

      If you opted not to build your 'Internet Only' room during the room creation process, you will not see any room status. Instead you will see a BUILD button. Click this button to build your room's infrastructure. You will incur the cost of the room when the room's infrastructure begins to build.

      From this page you both monitor your room's status and configure your network access.

      You can change the room's network access mode between 'Internet Only' and 'Tehama Gateway'.

      If your room's mode is 'Tehama Gateway', you can regenerate the room's access key, enable/disable the multiple gateways option and trigger automated gateway version updates (if an update is available).

      See the Rooms Connection Tab's Status Page documentation for help.

      Note on the Multiple Gateways Feature:
      • The 'Multiple Gateways' feature provides redundancy for a room's network access when the selected network access mode is 'Tehama Gateway' and the feature is enabled. It can be enabled/disabled by the owner (user with admin role) and managers of the organization that owns the room (which is your organization in this case). It allows you to provision a second Tehama Gateway, which you must install in your network's infrastructure. The two gateways will run simultaneously. Access to this feature is not offered by default. Contact Tehama Support to arrange for access to this feature in your room.

  10. Click the MEMBERS tab. You should see your organization listed. Invite members from your organization to join your room, if desired.

  11. Click ADD ORGANIZATION and use it to invite your contact from the 3rd party organization.

  12. Optionally, you can apply a policy for that organization. See Policy User Guide for details.

You've now got a Room and invited a third party organization to use it. Once the third party requests access for individual members, you should get notifications to approve them.

As the owner of the room you can either provision desktops for them or approve their requests for desktops. See Desktops User Guide for more details.

  • NOTE: You may want to set things up so that you auto approve members in the room proposed by the other organization. This is tied to the policy you have assigned to the other organization. Click on the MEMBERS tab, then click on the policy for the other organization. You will see the ASSIGN POLICY dialog. Toggle the "Auto approve proposed members" switch to "On". If you don't do this, every member added to the room by the other organization will result in an approval request. If you do, you are trusting the other organization to add/remove members to the room.

  • ANOTHER NOTE: Did you opt to leave installation of the TEHAMA GATEWAY until after you had invited another person to your organization so they could help? Direct them to the room's STATUS page under the CONNECTION tab. They can begin by clicking on the View or Regenerate link in the Access Key field to display the Access Key page. This page has a link to the Tehama Gateway User Guide instructions (Show User Guide) for installing and connecting a Tehama Gateway to your room, as well as instructions for regenerating the access key.

Once connected, you will have to go into the CONFIGURE tab to configure what resources are accessible from the room. See Secrets User Guide and Rooms User Guide for more details.

You can now check out the other scenarios in this guide or continue getting started with the Getting Started with Tehama Administration Guide.


Room Creation Scenario 2:

"I'm creating a room and requesting another organization to connect it to their network"

  1. Select the ROOMS tab in the top navigation bar.

  2. Click the NEW button at the top right or the CREATE NEW ROOM button at the end of the room list.

    The CREATE ROOM dialog will appear.

    • In the CREATE ROOM dialog:

      • Give the room a name
      • Select Connect this room to --> "Third-Party Organization (Invite)"
      • You may opt to select the Create Free Trial Room option. If you leave this option unselected, you will be billed for this room. (This option is only visible to those organizations who are eligible for a free trial room. The TCU usage within the Trial room is offset by the Trial TCU credits allocated to your organization. If the TCU usage in the Trial room is over the number of available Trial TCU credits, then you will be billed for the difference.)
      • Select Region --> the region in which you want this room's infrastructure to be provisioned
      • Click CONTINUE. You will see the ADD ORGANIZATION dialog.
      • Fill out the Organization Name, Contact Name and Contact Email and click SEND. (Note that this can be an organization that already has an account in Tehama or one that does not yet have an account in Tehama.)

        You will be directed to the page for your new Room (with "ROOMS > your room name" displayed in the navigation bar).

  3. Click the MEMBERS tab. (It should be the default selection.)
  4. Invite members from your organization to use the Room. NOTE that the other organization will have to approve them after connecting the room.
  5. You can now optionally go and request or create Desktop configurations. See Rooms User Guide for more details.

You've now created a Room and invited another organization to finish configuring it by connecting it to their network.

You can now check out the other scenarios in this guide or continue getting started with the Getting Started with Tehama Administration Guide.


Typical room configuration scenarios

These scenarios result from another organization creating a Room definition and inviting you to either complete the configuration of the room or to join it to deliver services.

  1. I am a buyer of services and have been invited by my service provider to finish connecting to a room.
    See Configuration Scenario #1.

  2. I am a service provider and I have been invited to join a room by my service buyer. See Configuration Scenario #2.

Room Configuration Scenario #1

You've been invited to finish connecting a room, most likely by your service provider.

The steps that led you to this point are as follows:

  • You received an email inviting you to connect your organization to a room. This email contains a link.
  • You opened this link in a browser; and then either

Now:

  1. You will be presented with an ACCEPT INVITE TO ROOM dialog, asking you to accept the invitation to to the room. Click I ACCEPT.
  2. Navigate to your organization's ROOMS tab. You will see the name of the room in your list of rooms.
  3. Click on the room name.
  4. You will be asked to connect the room to your network. Click CONTINUE.

    This will start a guided process to configure and create your room and, if you so choose, connect it to your Organization's network.

  5. The Desktop Settings - Network Access Configuration dialog will appear.

    (a) Decide whether or not to grant Desktop Administrator privileges to desktop users.

    This is an important question that asks whether you want users of desktops provisioned in the Room to have admin access to their desktops. This decision is unfortunately not reversible.

    Attention: This setting is a global setting for your room and will impact ALL desktop users within your room, including the organization owner (the user with the Admin role for your organization) and users with the Tehama Admin role from the Tehama Support team.


    • If you wish to grant administrator privileges to desktop users, place a checkmark beside Give Desktop Administrator Privileges. (Please read the information on the screen carefully before making this decision.)
    • If you do not wish to grant administrator privileges to desktop users, leave the check box blank.

      (b) Select one of the options in the Network Access Mode dropdown field.

      You have two options:

    • Internet only
      Choose this if you only want your Room to connect to applications and services in the cloud (constrained by your Room's firewall settings).
      Since the default value for Network Access is 'Tehama Gateway', to choose this option:
      • Click on the dropdown Network Access Mode field to open it.
      • Select the 'Internet Only' option.

        The Status page will change to reflect your choice of 'Internet Only' mode.

        NOTE: When network access is set to 'Internet Only', Tehama denies all UDP traffic apart from DNS lookup.

        or
    • Tehama Gateway
      Choose this if you want your Room to connect to your organization's private network (as with the 'Internet only' option, constrained by your Room's firewall settings).
      This is the default option. You do not have to do anything to choose this option when creating a room.

      This option requires you to install a Tehama Gateway somewhere in your network's infrastructure.

  6. If you selected Internet Only as your network access method ...

    You will see a FINISH button and a checkbox giving you the option to build your new room's infrastructure as soon as you click FINISH. This checkbox is enabled by default.

    You will incur the cost of the room when the room's infrastructure begins to build.

    If you are willing to accept responsibility for the cost of the room, leave the checkmark in place beside Build room when finish button is pressed. Otherwise, click in the checkbox to remove the checkmark.

    Click FINISH to proceed.

    Proceed to step nine.

  7. If you selected Tehama Gateway as your network access method ...

    You will see a CONTINUE button. Click the button to proceed.

  8. You will see the Gateway page.

    The Gateway page gives you the information you need to install a gateway in your private network and gives you the access key you will need to connect the gateway to your room.

    Connecting a Tehama Gateway to your new room will cause your new room's infrastructure to begin building.

    You will incur the cost of the room when you connect it to a Tehama Gateway, causing the room's infrastructure to begin building.

    You can either install/connect the gateway to your room now:
    1. Proceed to install the TEHAMA GATEWAY now using the Tehama Gateway User Guide instructions, which you can access by clicking on the Show User Guide link. Note that if you're just trying out Tehama you can also just install the Tehama Gateway in a temporary location and have your IT people move it later.

      NOTE: Due to a limitation in the authentication framework used by Tehama, the Tehama Gateway cannot be installed on the 172.31.x.x network. In addition, Tehama cannot connect to resources that are on the 172.31.x.x network directly.
      If you have the following situation:
      • the Tehama Gateway is on a supported network; and
      • a resource is on the 172.31.x.x network
      then a workaround would be to create a NAT on the network to NAT the address of the resource to an address that Tehama can see, like 10.x.x.x or something similar.


      or, if you're not comfortable doing that and need an IT person to help:
    2. Opt to leave installation of the TEHAMA GATEWAY until after you have invited another person to your organization so they can help. See the Organization User Guide if you need help figuring out how to invite someone but it's fairly easy to figure out if you just go to TEAM in the top navigation bar.

      Click DONE to proceed.
  9. Observe that the navigation bar will have changed to display: "ROOMS > your room name". Your Room page will sprout four tabs, CONNECTION, MEMBERS, AUDIT and POLICY.

  10. Select the STATUS sidebar item in the CONNECTION tab. (This should be the current page after the previous step.) This page shows your Room's status and its current 'Network Access' selection.

    At this point your room status should be one of the following, depending on the choices you made in the previous step:

    • Building or Built (for 'Internet Only' network access mode, if you opted to build above), or
    • Pending Gateway Connection or Connected (for 'Tehama Gateway' network access mode).

      If you opted not to build your 'Internet Only' room during the room creation process, you will not see any room status. Instead you will see a BUILD button. Click this button to build your room's infrastructure. You will incur the cost of the room when the room's infrastructure begins to build.

      From this page you both monitor your room's status and configure your network access.

      You can change the room's network access mode between 'Internet Only' and 'Tehama Gateway'.

      If your room's mode is 'Tehama Gateway', you can regenerate the room's access key, view the multiple gateways option's current setting and trigger automated gateway version updates (if an update is available).

      See the Rooms Connection Tab's Status Page documentation for help.

      Note on the Multiple Gateway Feature:
      • The 'Multiple Gateways' feature provides redundancy for a room's network access when the selected network access mode is 'Tehama Gateway' and the feature is enabled. It can be enabled/disabled by the owner (user with admin role) and managers of the organization that owns the room (which is the organization that invited you to the room, in this case). It allows you to provision a second Tehama Gateway, which you must install in your network's infrastructure. The two gateways will run simultaneously. Access to this feature is not offered by default. Contact Tehama Support to arrange for access to this feature in your room.

  11. You can now go into the Members tab and approve proposed members from the other organization, the room's owner organization, for access. Also invite other members of your own organization to the room, if desired.

As the connected organization of the room, but not the owner, you can make requests for desktops that the owner organization must approve. See Desktops User Guide for more details.

  • NOTE: You may want to set things up so that you auto approve members in the room proposed by the other organization. This is tied to the policy you have assigned to the other organization. Click on the MEMBERS tab, then click on the policy for the other organization. You will see the ASSIGN POLICY dialog. Toggle the "Auto approve proposed members" switch to "On". If you don't do this, every member added to the room by the other organization will result in an approval request. If you do, you are trusting the other organization to add/remove members to the room.

  • ANOTHER NOTE: Did you opt to leave installation of the TEHAMA GATEWAY until after you had invited another person to your organization so they could help? Direct them to the room's STATUS page under the CONNECTION tab. They can begin by clicking on the View or Regenerate link in the Access Key field to display the Access Key page. This page has a link to the Tehama Gateway User Guide instructions (Show User Guide) for installing and connecting a Tehama Gateway to your room, as well as instructions for regenerating the access key.

Once connected, you will have to go into the CONFIGURE tab to configure what resources are accessible from the room. See Secrets User Guide and Rooms User Guide for more details.

You can now check out the other scenarios in this guide or continue getting started with the Getting Started with Tehama Administration Guide.

Room Configuration Scenario #2

Your organization has been invited to join a room, most likely by your service buyer.

The steps that led you to this point are as follows:

  • You received an email telling you that your organization has been added to a room. This email contains a link.
  • You opened this link in a browser; and then either

Now:

  1. If the other organization set a policy, you'll be asked to review and accept it.
  2. Click the MEMBERS tab.
  3. Invite members from your organization to use the Room. NOTE that the other organization will have to approve them after connecting the room.
  4. You can now optionally go and request desktop configurations. See Rooms User Guide for more details.

You can now check out the other scenarios in this guide or continue getting started with the Getting Started with Tehama Administration Guide.