MSP master collector and router

The design

 Customer A site                       Your data center
 ┌───────────────────┐  HTTPS (TLS 1.3)  ┌────────────────────┐     ┌──────────────┐
 │ Uplivra collector ├──────────────────►│  Master collector  ├────►│ Uplivra      │
 └───────────────────┘                   │  (+ router mode)   │     │ server       │
 ┌───────────────────┐  VRF, BGP/static, │                    │     │ (multi-      │
 │ Customer B router ├◄─────────────────►│  NAT to B's chosen │     │  tenant)     │
 └───────────────────┘  GRE over IPsec   │  external network  │     └──────────────┘
                                         └────────────────────┘

• The Uplivra server holds every customer as a separate tenant (the MSP multi-tenant module).
• Master collectors in your data center relay for customer collectors, so customers only need outbound HTTPS to you, and your server is never exposed to them.
• Router mode on a master collector lets it reach into customer networks directly: each customer gets a VRF, and your monitoring traffic is translated (NAT) into an external network the customer chooses, which you advertise to them by BGP, or they reach by a static route. Overlapping customer networks are no problem.

Use two master collectors (and a router pair) for redundancy: customer collectors fail over between masters automatically, and routers share connection state.

Sizing

Plan one CPU core per 1 Gbps of IPsec traffic (with AES-NI) plus two spare, and about 330 MB of memory per million tracked connections. Full internet BGP tables need 8 GB or more; partial or default routes need very little.

Use Ubuntu 24.04 LTS or the MSP edition of the virtual appliance. Give router VMs multi-queue virtual NICs (VMXNET3 or virtio) and pass through AES-NI.

Step 1: The multi-tenant server

1. Install the server as in Install the Uplivra server.
2. Add the MSP multi-tenant module to your license (partners get it with their discount).
3. Open Customers and add each customer. Switch to a customer to create their sites and people.

Step 2: Master collectors

On a computer in your data center, run the installer and choose MSP master collector. Answer:

The master collector listens on the port you chose (8443 by default) for customer collectors. On its page in Uplivra you'll see its relay fingerprint. By default it uses a certificate Uplivra makes; to use your own public or internal CA certificate, upload it under Settings › Certificates on the server and it's sent to the relays automatically.

Repeat on a second computer for redundancy.

Step 3: Customer collectors through the master

When you install a collector for a customer (Linux or Windows, as in the collector guides), use the master collector's address as the server address, for example https://collect.yourmsp.com:8443. The setup code still comes from the customer's site in Uplivra.

To give a Linux collector a second master to fail over to, add it to /etc/uplivra/collector.json and restart the collector:

"fallback_servers": [
  { "url": "https://collect2.yourmsp.com:8443", "fingerprint": "the second master's fingerprint" }
]

sudo systemctl restart uplivra-collector

Step 4: Router mode

Install on the router computer and choose MSP router. Setup installs FRRouting, nftables, strongSwan, keepalived and conntrackd. Then in Uplivra open the collector's page and click Router.

Customer hand-offs (recommended)

For each customer:

Uplivra builds the VRF, the NAT, the routes and prefix filters, and the BGP session that advertises the external network to them.

Tunnels, firewall and pairs

• GRE tunnels protected by IPsec: pick the suite. Strongest (AES-256-GCM, SHA-384, ECP-384) is the default; post-quantum hybrid adds ML-KEM-768; compatible is for older customer firewalls.
• Firewall: a stateful firewall per VRF: allow only what monitoring needs.
• Router pair: two routers share a virtual address (keepalived) and connection state (conntrackd) over a dedicated sync link, so a failover doesn't drop sessions.

Applying safely

Click Check and save. Uplivra checks the whole configuration with the routing and firewall tools themselves before applying it. If the router can't reach Uplivra for 3 minutes after a change, it puts the previous configuration back. Every version is kept under Earlier versions, and you can preview the generated files first.

On the router you can also run:

sudo uplivra system status      # interfaces, BGP peers, tunnels, sessions
sudo uplivra system rollback    # go back to the previous version now

Troubleshooting