--- title: Remote Access Portal (RAP) Configuration slug: kronpam-installation-guide/sQFP-remote-access-portal-rap-configuration docTags: createdAt: 2025-11-03T14:50:30.681Z --- The following steps should be read carefully to successfully install **Remote Access Portal (RAP)** on the regarding machine: :::hint{type="warning"} **Prerequisite** Check the Secure Reboot Enabled status before the installation by running **mokutil --sb-state** command. In case the secure reboot is enabled, it might cause an error during the Wireguard installation. **Please disable it to continue the installation!!!** ::: :::hint{type="warning"} **Prerequisite** The user must allow the necessary ports on the **Remote Access Portal (RAP)** environment. sudo firewall-cmd --add-port=443/tcp --permanent sudo firewall-cmd --add-port=\{selected-Wireguard-port(e.g., 51820)}/udp --permanent sudo firewall-cmd --add-port=7777/tcp --permanent sudo firewall-cmd --add-port=7777/udp --permanent ::: 1.    Download the Remote Access Portal (RAP)’s installation script on the machine that will be used for **Remote Access Portal (RAP)**. The support team can provide the installation script. After downloading the script, unzip the installation script on the machine. The user can use unzip command to extract the files from the installation script file. | **Linux CLI** | **\[root\@rap\~]#** unzip RAP\_MTC\_ONCLOUD-1.2.0.zip | | ------------- | ----------------------------------------------------- | ![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/yzFgO0MiRVMN2FYRj9h7S_image.png "Extracting the Remote Access Portal (RAP) installation script") :::hint{type="info"} In case **bash: unzip: command not found** error is shown, the unzip package should be installed via **sudo dnf install -y unzip** command. ::: :::hint{type="info"} If somehow the user needs to start the script again (maybe, because of the wrong input or missing file etc…), please remove all installation files except for compressed Remote Access Portal (RAP)’s installation script file and unzip the compressed installation script file again. After this you can execute the script. **We highly recommend this method since the extracted files might be modified after the script execution for the first time, and executing the script with modified files might cause faulty installation!** ::: 2.    Navigate to the cloud directory: | **Linux CLI** | **\[root\@rap\~]#** cd cloud/ | | ------------- | ----------------------------- | ::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/cr7OFjGWMtHUm9bFWwFGL_image.png" size="50" width="496" height="156" position="center" showCaption="false"} 3.    Run the configuration script: | **Linux CLI** | **\[root\@cloud\~]#** sh configure.sh | | ------------- | ------------------------------------- | ::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gPMFucFzqitkIHtUIFy-g_image.png" size="50" width="567" height="196" position="center" caption="Executing the Remote Access Portal (RAP) installation script" showCaption="true"} :::hint{type="info"} In case you need to set script permissions to execute it, you need to run **chmod +x configure.sh** command. ::: :::hint{type="info"} You need root privileges to run this script. ::: 4.    The Remote Access Portal (RAP)’s installation script should be restarted after the forced reboot. The installation script asks user either: a) to install MT Outbound Connector, or to install MT Inbound Connector, or b) to install **Remote Access Portal (RAP)** module on the cloud. (the Secure Remote Access Connector is installed on prem by means of the Secure Remote Access Connector’s installation script (e.g., **RAP-MTC-ONPREM-1.2.0.zip**)) 5.    To continue with **Remote Access Portal (RAP)** installation, the user should select the third option by **entering 3 and pressing the enter key.** ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/zQuPmX9GVyIEB1m0t6v1u_image.png) 6.    The Remote Access Portal (RAP)’s installation script asks user to: :::Paragraph{indent="1"} **a. For the first-time installation** on the cloud, the whole **Remote Access Portal (RAP)** system should be configured from scratch, thus, the first option should be selected by **entering 1 and pressing the enter key.** ::: ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/IqLYLv6PE6L47s-SIJ3MY_image.png) The Remote Access Portal (RAP)’s installation script asks several configuration details: o   The **Remote Access Portal (RAP)** hostname, o   The port number of Wireguard, o   The IP segment of Wireguard, o   The Wireguard IP address that will be assigned to **Remote Access Portal** **(RAP)** environment, o   The Wireguard IP address that will be assigned to **Secure Remote Access Connector** environment, o   A public key generated by the **Secure Remote Access Connector**’s installation script. | **Portal Configuration Descriptions** | **Example Values** | | --------------------------------------------------------------------------------------------------- | ------------------------------------------- | | **Remote Access Portal (RAP)** hostname | https\://rap.company.com | | Port Number of the Wireguard | 51820 | | IP segment of the Wireguard | 10.0.0.0/29 | | Wireguard IP address assigned to the **Remote Access Portal (RAP)**’s side | 10.0.0.1 | | Wireguard IP address assigned to the** Secure Remote Access Connector**’s side | 10.0.0.2 | | Public Key generated by the **Secure Remote **
**Access Connector**’s installation script | AAAAAAA0NN0751JBnXoJ5R8M3uTw8NmAkTGI5bLy4= | ![](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/pM411uNsJF9tEm6nubYHA_image.png "Filling in the necessary values for the Remote Access Portal (RAP) installation") After all information has been filled in, the user should press **y** to continue, however, if the user fails to fill in every information successfully (either missing or wrong info), the user can press **n** to reenter information again. :::hint{type="info"} Once the Remote Access Portal (RAP)’s installation script asks the user to enter the public key, if the user doesn’t know the public key generated by the Secure Remote Access Connector’s installation script yet, the user can set temporary public key for now (e.g., AAAAAAA0NN0751JBnXoJ5R8M3uTw8NmAkTGI5bLy4=). **But please do not forget to set the public key by using the Remote Access Portal’s installation script (please check 6.b below this section on this page), after the Secure Remote Access Connector’s installation script generates a public key.** ::: At the end of Remote Access Portal’s installation script, the public key generated by this script is ready to use on the Secure Remote Access Connector (on-prem) environment (e.g., BBBBBBB28P4pEn/ya2fJ0NgUgIWsV40NMBRyiz3iRI=). ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/juImCcEN2cpvb8YVUPnK4_image.png) **Please do not forget to add this info on the Secure Remote Access Connector environment by using Secure Remote Access Connector’s installation script (please check 4.b at the next page).** :::hint{type="info"} In the last step here to change self-signed certificate and generic RSA private key with **the** **user’s own certificate and RSA private key**. The user should remove the self-signed certificate and generic RSA private key on **/etc/nginx/certs** directory. After this, the user should add the user’s AWS certificate and RSA private key with the same names. Lastly, the user should restart nginx service by using **sudo systemctl restart nginx.service** command. ::: ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/NExHbMjFOlxLV-ngjXttx_image.png) :::Paragraph{indent="1"} **b.**    Once the Remote Access Portal (RAP) has been fully installed, only one configuration is missing here regarding public key that would be generated by the Secure Remote Access Connector’s installation script. If the user executes the Secure Remote Access Connector’s installation script on premise (please, check 4.a at the Section-3.3), it generates a public key which would be used in the Remote Access Portal (RAP) here, thus now this option can configure the secure tunnel configuration file with the generated public key from Secure Remote Access Connector’s side. ::: The user should select the second option by **entering 2 and pressing the enter key.** ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/A3R6X_YK4Wk_r-S9CL-aR_image.png) Set the public key data of the secure tunnel configuration file with a public key generated by the Secure Remote Access Connector’s installation script (e.g., CCCCCq8tpC6nMNEzIzUtNxNuVePGDPvYF6rFHYBdmU=). ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xvhmBiFwku0l1JsRyLaT__image.png)