Deploy Cloud Hubs in Azure

Configuration > Cloud Services > IaaS > Deploy Cloud Hubs in Azure

The Deploy Cloud Hubs in Azure tab provides the Azure account details and EC-V deployment configuration details for all Azure cloud EC-Vs that have been deployed.

IMPORTANT: For more detailed information and configuration options, including integration with services such as the Standard Internal Load Balancer and Azure Route Server, see the HPE Aruba Networking EdgeConnect SD-WAN Virtual (EC-V) in Microsoft Azure Deployment Guide.

NOTE: Before you can deploy EC-Vs to the Azure cloud, you must perform several tasks on the Azure portal. For more information, see Azure Subscriptions.

NOTE: EC-Vs that are deployed manually in Azure will not be displayed in Orchestrator.

Use this tab to:

Create and modify Azure subscriptions
Deploy EC-Vs in the Azure cloud, within either a Transit VNet or a vWAN hub
Remove an Azure cloud deployment

NOTE: When you remove a deployment, all EC-Vs in the deployment will be deleted.

The following table describes each field on this tab.

Field	Description
Deployment name	Name given on the deployment configuration page.
Subscription	Name of the Azure account used to deploy the EC-Vs.
Region	Region of the EC-V deployment.
Resource group	Name of the Azure Resource Group used for the EC-V deployment.
Platform	Type of platform (azure or azure_nva) used for the EC-V deployment.
Virtual network	CIDR block used for deployment.
Instances	Number of EC-V instances in the deployment. To add one or more EC-Vs to the deployment, click +Add. In the New Instance in Azure dialog box, select the Availability Zone to use and an optional tag to apply to the new instance. Max indicates that the maximum number of instances have been created for this deployment. If the region you selected does not support Availability Zones, the New Instance in Azure dialog box does not display an Availability Zone menu.
Status	Status of the deployment. If more information is available, an information icon is displayed. NOTE: If the deployment was incomplete, the info dialog contains a link to download the log file and steps to resolve the issue.
Terminate	To permanently delete a deployment, click Terminate. This action deletes all resources associated with the EC-Vs, including all Azure resources. If you created more than one EC-V in the deployment, all EC-Vs will be deleted when you click Terminate. The Resource Group that was used for the deployment will not be deleted.
Deployment info	Click the info icon in this column to view deployment and virtual machine details.
Resources	Click the info icon in this column to view details about each Azure resource that Orchestrator created during the deployment.
Comment	Comments that were added to the deployment when the EC-V was created. To edit the comment, click the edit icon.

Create or modify an Azure subscription

Click Azure Subscriptions to create or modify an Azure subscription to Orchestrator.

Deploy a new EC-V

You can deploy a new EC-V within either a Transit Virtual Network (VNet) or a Virtual WAN (vWAN) Hub as a Managed NVA.

When deciding between the two deployment methods, there are several factors to consider. Deploying an EC-V inside a transit VNet offers more flexibility and control of the EC-V deployment. Managed NVA includes limitations such as not being able to add or delete network interfaces on the EC-V, not having access to SSH, and others. For more information on this decision and design specifications of each deployment, see the HPE Aruba Networking EdgeConnect SD-WAN Virtual (EC-V) in Microsoft Azure Deployment Guide.

Click Deploy Cloud Hubs in Transit VNet or Deploy Cloud Hubs in Virtual WAN Hub to deploy one or more EC-V instances in Azure.

Remove an EC-V

If a deployment does not complete or you no longer want the EC-V in the Azure cloud, you can remove the deployment and all associated artifacts.

To remove a deployment, locate the deployment you want to remove, and then click Terminate in the desired row.

Azure subscriptions

Before deploying an EC-V in Azure, you must configure an Azure subscription and add it to Orchestrator.

The Azure Subscriptions dialog box lists all the Azure subscriptions that have been added to Orchestrator.

Add new Azure subscription

To add a new Azure subscription, click Add Azure Subscription.

Edit an existing Azure subscription

To edit an existing Azure subscription:

Hover over the Actions column of the subscription you want to edit, and then click the edit icon.

The Azure Subscription Configuration dialog box appears.

NOTE: You cannot modify subscriptions that have active deployments.
Modify the elements as necessary.
Click Save.

Orchestrator validates the subscription information.
Click Close.

Deploy cloud hubs in Transit VNet

Use the Deploy Cloud Hubs in Transit VNet dialog box to create one or more EC-V instances in Azure.

Configure the Azure subscription

Before deploying an EC-V via Orchestrator, you must configure your Azure subscription by accepting Marketplace terms for EdgeConnect to enable programmatic deployment, creating an app registration (service principal), resource group, and custom role, and assigning that role to the resource group.

Accept Azure Marketplace image terms

Accepting Azure Marketplace’s image terms for EdgeConnect is required for the Orchestrator to automatically deploy an EdgeConnect image from the Azure Marketplace. You only need to do this once per Azure subscription.

Log in to the Azure Portal.
Under Azure services, click + Create a resource.
On the Create a resource page, enter edgeconnect, and then click Silver Peak Unity EdgeConnect.
On the Plan drop-down menu, select the latest EdgeConnect version, and then click Get started.
On the Configure Programmatic Deployment page, select Enable next to the subscription ID that you want to use to deploy the EdgeConnect VMs.
Click Save.

A message at the top of the page notifies you when configuration updates are complete.

Create a new app registration

Azure app registrations are used to create service principals, which are identities used by applications or services to access Azure resources securely and with restricted permissions. The Orchestrator uses the app registration to authenticate itself with Azure. An app registration allows you to assign least-privilege access using custom roles. It avoids sharing credentials and exposing elevated privileges unnecessarily.

To create a new app registration for the Orchestrator:

Log in to the Azure Portal.
In the main search menu, enter app registrations, and then click App registrations.
Click + New registration.
On the Register an application page, in the Name field, enter a user-facing display name for the application.
Under Supported account types, select Accounts in this organizational directory only (Default Directory only - single tenant).
(Optional) Enter a redirect URI.
Click Register.

NOTE: Note the application (client) ID and directory (tenant) ID. You need these IDs when you add the subscription details in Orchestrator.
Under Manage, click Certificates & secrets.
Click New client secret.
Enter a Description and Expiration Date.
Click Add.

A new client secret is created.
Copy the text in the Value column.

IMPORTANT: This text can only be viewed immediately after creation. Be sure to save the secret before leaving the page.
On the main search menu bar, enter subscription, and then press Enter.
Copy the subscription ID.

Create a new resource group

Creating a new resource group on the Azure Portal is considered a best practice. This ensures that the SD-WAN Orchestrator only has access to that resource group to deploy EC-Vs. However, it is possible to deploy one or more EC-Vs into an existing resource group that contains other Azure resources.

To create a new resource group:

On the main search menu, enter resource group, and then click Resource groups.
Click + Create.
On the Create a resource group page, select the subscription that you want to use to create the resource group.
Enter a name for the resource group, and then select a region.
Click Review + create.
Click Create.

Create a custom role

To create custom roles, you must have owner or user access administrator permissions. There are multiple ways to create a custom role. The following steps create a custom role from within the resource group that you created.

Select the resource group you created in Create a new resource group, and then click Access control (IAM).
Click Add, and then click Add custom role.

The Custom Roles editor appears (the Basics tab is displayed).
In the Custom role name field, enter a name for the custom role. The name must be unique for the Azure AD directory. The name can include letters, numbers, spaces, and special characters.
(Optional) In the Description field, enter a description for the custom role. The description displays in the tool tip for the custom role.
Accept the default value for the Baseline permissions, and then click the JSON tab.
Click Edit.
Go to https://arubanetworking.hpe.com/techdocs/SilverPeak/files/cloud-ecv/cloud_ecv_json.htm and click Permissions required to deploy Cloud Hubs in Azure in a Transit Virtual Network (VNet).
Copy and paste the list of Azure permissions within the square brackets next to actions (line 10).
Click Save.
Click the Assignable scopes tab, and then verify that the resource group you created is added as an assignable scope and Type is set to the resource group.
Click the Permissions tab, and then verify that the permissions, descriptions, and permission types you added are listed.
Click Review + create.
Click Create.

A message displays to confirm that you have successfully created your custom role.

Assign the custom role to the resource group

Assigning the custom role to the resource group ensures that the Orchestrator has the exact set of permissions needed to deploy only the resources within that resource group, in line with the principle of least privilege. However, if you want to deploy EdgeConnect gateways into multiple resource groups, you can assign the custom role at the Azure subscription level. This allows the Orchestrator to list multiple resource groups and lets you select the one you want for deployment. In this example, the custom role is assigned only to the specific resource group.

Navigate to the resource group you created, and then click Access control (IAM).

NOTE: If you just completed the previous task of creating a custom role, the Access control (IAM) page is already open.
Click Add, and then click Add role assignment.

The Role assignment page appears.
On the Role tab, enter the name of your custom role.

NOTE: If the role you created is not displayed, refresh the page.
Select the custom role, and then click Next.

The Members tab appears.
Ensure that User, group, or service principle is selected, and then click + Select members.

The Select members page appears.
Enter the name of your app registration (service principle), select your app, and then click Select.

Your app is added under Members.
Click Review + assign.
Click Review + assign again.

Add Azure subscription details to Orchestrator

Add your Azure subscription details such as subscription ID, directory (tenant) ID, application (client) ID, and client secret value to Orchestrator. You only need to do this once per Azure subscription unless you are a large enterprise with multiple teams that want to use different resource groups to segregate deployments.

To add the Azure subscription to Orchestrator:

Log in to Orchestrator.
Navigate to Configuration > Cloud Services > IaaS > Deploy Cloud Hubs in Azure.
Click Azure Subscriptions.
Click Add Azure subscription.
Enter a Name, Subscription ID, Directory (tenant) ID, Application (client) ID, and Client secret value for the Azure subscription.

NOTE: You copied the directory (tenant) ID, application (client) ID, and client secret in Create a new app registration.

NOTE: If you copy and paste the subscription ID, Azure might add a blank space to the beginning of the subscription ID. Be sure to remove all spaces from your subscription ID.
Click Save.

Orchestrator validates the subscription information.

NOTE: If you have multiple Azure subscriptions, you can load the credentials for each subscription.

Deploy EC-V into a transit VNet from Orchestrator

To deploy EC-V into a transit VNet from Orchestrator:

On the Deploy Cloud Hubs in Azure tab, click Deploy Cloud Hubs in Transit VNet.

The Deploy Cloud Hubs in Transit VNet dialog box appears.

To instantiate EC-V instances, enter the deployment details in the Orchestrator’s Deploy Cloud Hubs in Transit VNet dialog box, as noted in the table below.

NOTE: If you do not have an Azure subscription configured in Orchestrator, the Deploy Cloud Hubs in Transit VNet dialog box is blank. Click the Subscriptions link to go to the Azure subscription page and enter your Azure credential.

Field	Description
Name	Enter a name for the deployment. This name is used only for identifying the deployment. A deployment consists of one or more EC-Vs that an Orchestrator creates in an Azure Virtual Network. Only alphabetical letters and hyphens are allowed in the deployment name. The maximum allowed length is 20 characters.
Azure account	Select an Azure account to use for deploying the EC-V.
Resource group	Select an Azure resource group to use for deploying the EC-V.
Region	Select an Azure region where you want to deploy the EC-V.
Virtual network	Select Create new virtual network or Existing virtual network. Create new virtual network: If selected, Orchestrator creates a new VNet for the EC-V. Orchestrator creates three subnets (MGMT0, WAN0, and LAN0) for each EC-V you deploy. For example, if you deploy two EC-Vs, Orchestrator creates six subnets. Existing virtual network: If selected, Orchestrator allows you to select an existing VNet and subnets for MGMT0, WAN0, and LAN0 interfaces. NOTE: If you select Existing virtual network and you deploy multiple ECVs using the Horizontally scale setting, the MGMT0, WAN0, and LAN0 interfaces for each EC-V are created using the subnets you select in the Available subnets fields. For example, if you deploy two EC-Vs, the MGMT0 interface for each EC-V is created on the MGMT0 subnet you select in the mgmt0 field, the WAN0 interface for each EC-V is created on the subnet you select in the wan0 field, and the LAN0 interface for each EC-V is created on the subnet you select in the lan0 field. For a two-EC-V (or a multiple EC-V) deployment, you need three subnets. If you select Create new virtual network, Orchestrator creates six new subnets for a two-EC-V deployment. If you select Existing virtual network, the VNet that you select must be created within the same resource group as the EC-V deployment. If your VNet is created in a different resource group, the Orchestrator does not display that VNet under the Existing virtual network option.
Virtual network CIDR	If you select the Create new virtual network option, you need to enter a Virtual Network Classless Inter-Domain Routing (CIDR) block. Orchestrator uses this CIDR block to create a new VNet. The smallest supported CIDR block is /24 and the largest supported CIDR block is /16. Orchestrator creates all Azure resources required for the EC-V deployment within this virtual network. For each EC-V you deploy, Orchestrator creates three subnets that are /28 in size. In other words, if you deploy two EC-Vs, Orchestrator creates six subnets in total. This is true even if both EC-Vs are created in a single Availability Set or Availability Zone.
Choose virtual network	If you selected Existing virtual network, enter the name of the network in this field.
Available subnets	If you selected Existing virtual network, enter a subnet for each network interface.
WAN optimization	After WAN optimization and an appropriate WAN bandwidth value are selected, Orchestrator displays the appropriate Azure instance types for the deployment on the Instance Type menu. NOTE: Selecting WAN optimization does not enable WAN optimization on the EC-V. It only allows Orchestrator to display appropriate Azure instance types that can support WAN optimization for the selected WAN bandwidth. To enable WAN optimization on the EC-V, go to the Deployment page and the Business Intent Overlay (BIO) page after the deployment is complete.
WAN bandwidth	The WAN bandwidth list displays the current EdgeConnect license tiers. After you select a WAN bandwidth value, Orchestrator displays the appropriate Azure instance types for the deployment in the Instance type list.
Instance type	Based on your selected WAN optimization and WAN bandwidth values, Orchestrator displays the appropriate instance types.
Availability option	Select Availability Set or Availability Zone. Some regions only support Availability Set. HPE Aruba Networking recommends selecting Availability Zone, if available.
SSH public key	Generate a public key with an application, such as PuTTYgen, and then input the value here. IMPORTANT: EdgeConnect only supports single-line SSH public keys. Do not use multi-line SSH public keys. Additionally, use an EdDSA (ED25519) key pair. NOTE: Save the private key file. If you need to log in via SSH to the appliance after it is deployed, you will need this key.
Azure tags (Optional)	Any comma-separated tags entered here are applied to all Azure resources that Orchestrator creates while deploying the EC-V. If you do not enter any tags, Orchestrator automatically creates a unique tag for each Azure resource that it creates while deploying the EC-V. This Azure tag is created to identify each resource created by Orchestrator. The tag is formatted as follows: `sp-automated-``deployment name``-instance-``index-resource name`.
Comment (Optional)	Enter a comment if you want to attach any additional details for the deployment.
Advanced settings	Custom VHD: Leave this field blank unless you have an EdgeConnect VHD that you want to use for the deployment. When this field is blank, the Azure Marketplace image is deployed.
Horizontally scale	You can deploy multiple EC-Vs by clicking + and selecting the Availability Set or Availability Zone for each EC-V. If the selected region supports multiple availability zones, each availability zone appears on the menu. You can deploy up to five EC-Vs with a CIDR block of /24. If you need to deploy more than five EC-Vs within a single virtual network, select a virtual network CIDR block that is bigger than /24, such as /23 or /22. The maximum number of EC-Vs you can deploy within a single network is 20.
Appliance tags (Optional)	Enter an appliance tag. If this field is left blank, Orchestrator automatically assigns an appliance tag for its own configuration purposes.
Availability zone	Enter the Azure availability zone for the EC-V. NOTE: This field only displays if the region supports availability zones.

When you have completed all the required fields, click Review and deploy.
Review the configuration summary, and then click Deploy to create the EC-V instances.

NOTE: After a few minutes, click the refresh icon next to the Deploy Cloud Hubs in Azure label to check the status. If your EC-V deployment fails, the status will be shown as Incomplete in the Cloud Hubs in Azure table. Click the info icon to download the log file. The reason for the failure is typically at the bottom of the log file.
- To remove (delete) a deployment after a failure, click Terminate. All Azure resources created by the Orchestrator are removed. If termination fails, it indicates that an Azure resource is blocking the deletion. To view details of this Azure resource, download the log file and check the last error message.
- To proceed with the termination, you can manually delete this resource on the Azure Portal.
If your deployment succeeds, the status will be shown as Deployed.
After the deployment succeeds, the newly deployed EC-Vs appear on the Discovered Appliances tab in Orchestrator. Please allow at least 10 minutes for EC-Vs to be discovered in Orchestrator. On the Discovered Appliances tab, the Approve button appears after the EC-V is fully configured.

Deploy Cloud Hubs in Virtual WAN Hub

This section describes how to deploy EC-V gateways directly within an Azure vWAN hub and establish BGP. This design is also referred to as Managed NVA or NVA in vWAN hub. To learn more about this design, see the HPE Aruba Networking EdgeConnect SD-WAN Virtual (EC-V) in Microsoft Azure Deployment Guide.

Configure the Azure subscription

Before deploying Managed NVA via Orchestrator, you must configure your Azure subscription by creating an app registration (service principal), a resource group, and a custom role, and assigning that role to the resource group.

Create a new app registration

To create a new App registration for the Orchestrator:

Log in to the Azure Portal.
In the main search menu, enter app registrations, and then click App registrations.
Click + New registration.
On the Register an application page, in the Name field, enter a user-facing display name for the application.
Under Supported account types, select Accounts in this organizational directory only (Default Directory only - single tenant).
(Optional) Enter a redirect URI.
Click Register.

NOTE: Note the application (client) ID and directory (tenant) ID. You need these IDs when you add the subscription details in Orchestrator.
Under Manage, click Certificates & secrets.
Click New client secret.
Enter a Description and Expiration Date.
Click Add.

A new client secret is created.
Copy the text in the Value column.

NOTE: This text can only be viewed immediately after creation. Be sure to save the secret before leaving the page.
On the main search menu bar, enter subscription, and then press Enter.
Copy the subscription ID.

Create a new resource group

Creating a new resource group on the Azure Portal is considered the best practice. This ensures that the SD-WAN Orchestrator only has access to that resource group to deploy EC-Vs. However, it is possible to deploy one or more EC-Vs into an existing resource group that contains other Azure resources.

To create a new resource group:

From the main search menu in Azure Portal, enter resource group, and then click Resource groups.
Click + Create.
On the Create a resource group page, select the subscription that you want to use to create the resource group.
Enter a name for the resource group, and then select a region.
Click Review + create.
Click Create.

Create a custom role

To create custom roles, you must have Owner or User Access Administrator permissions. There are multiple ways to create a custom role. The following steps create a custom role from within the resource group you created.

Select the resource group you created in the previous section, and then click Access control (IAM).
Click Add, and then click Add custom role.

The Custom Roles editor appears (the Basic tab is displayed).
In the Custom role name field, enter a name for the custom role. The name must be unique for the Azure AD directory. The name can include letters, numbers, spaces, and special characters.
(Optional) In the Description field, enter a description for the custom role. The description displays in the tool tip for the custom role.
Accept the default value for the Baseline permissions, and then click the JSON tab.
Click Edit.
Go to https://arubanetworking.hpe.com/techdocs/SilverPeak/files/cloud-ecv/cloud_ecv_json.htm, and then click Permissions required to deploy EC-Vs inside an Azure Virtual WAN Hub-Managed NVA and establish BGP connectivity.
Copy the list of Azure permissions, and then paste the list within the square brackets under Actions (line 10).
Click Save.
Click the Assignable scopes tab, and then verify that the resource group you created is added as an assignable scope and Type is set to the resource group.
Click the Permissions tab, and then verify that the permissions, descriptions, and permission types you added are listed.
Click Review + create.
Click Create.

A message displays to confirm that you have successfully created your custom role.

Assign the custom role to the resource group

Assigning the custom role to the resource group ensures that the Orchestrator has the exact set of permissions needed to deploy only the resources within that resource group, in line with the principle of least privilege. However, if you want to deploy EdgeConnect gateways into multiple resource groups, you can assign the custom role at the Azure subscription level. This allows the Orchestrator to list multiple resource groups and lets you select the one you want for deployment. This example assigns the custom role only to the specific resource group.

Navigate to the resource group you created, and then click Access control (IAM).

NOTE: If you just completed the previous task of creating a custom role, the Access control (IAM) page is already open.
Click Add, and then click Add role assignment.
On the Role tab, enter the name of your custom role.

NOTE: If the role you created is not displayed, refresh the page.
Select the custom role, and then click Next.
On the Members tab, ensure that User, group, or service principle is selected, and then click + Select members.
On the Select members tab, enter the name of your App registration (Service Principle), select your app, and then click Select.

Your app is added under Members.
Click Review + assign.
Click Review + assign again.

Add Azure subscription details on Orchestrator

This section explains how to add your Azure subscription details—such as Subscription ID, Directory (tenant) ID, Application (client) ID, and Client secret value—to Orchestrator. You only need to do this once per Azure subscription unless you are a large enterprise with multiple teams that want to use different resource groups to segregate deployments.

To add the Azure subscription to Orchestrator:

Log in to Orchestrator, and then navigate to Configuration > Cloud Services > IaaS > Deploy Cloud Hubs in Azure.
Click Azure Subscriptions, and then click Add Azure subscription.
Enter a Name, Subscription ID, Directory (tenant) ID, Application (client) ID, and Client secret value for the Azure subscription.

NOTE: You copied the directory (tenant) ID, application (client) ID, and client secret in Create a new app registration.

NOTE: If you copy and paste the subscription ID, Azure might add a blank space to the beginning of the subscription ID. Be sure to remove all spaces from your subscription ID.
Click Save.

Orchestrator validates the subscription information.

NOTE: If you have multiple Azure subscriptions, you can load the credentials for each subscription.

Deploy Managed NVA

To deploy Managed NVA from Orchestrator:

Log in to the Orchestrator, and then navigate to Configuration > Cloud Services > IaaS > Deploy Cloud Hubs in Azure.
Click Deploy Cloud Hubs in Virtual WAN Hub.

Enter the deployment details shown below.

NOTE: If you do not have an Azure subscription configured in Orchestrator, the Deploy Cloud Hubs in Virtual WAN Hub dialog box is blank. Click the Subscriptions link to go to the Azure subscription page and enter your Azure credential.

Field	Description
Name	Enter a name for the deployment. This name is used only for identifying the deployment. A deployment consists of two EC-Vs created within a vWAN Hub. Only alphabetical letters and hyphens are allowed in the deployment name. The maximum allowed length is 20 characters.
Azure account	Select an Azure subscription to use for deploying the Managed NVA.
Resource group	Select an Azure resource group to use for deploying the Managed NVA.
Region	Select an Azure region where you want to deploy the Managed NVA.
Virtual WAN hub	Select Create new virtual network or Existing virtual network. Select your vWAN Hub. If no vWAN Hubs are shown, the region you selected does not have any vWAN Hubs created, or you have not entered the required permissions to your custom role.
Scale units	The scale unit determines the resource allocation on the Managed NVA. The higher the scale unit, the greater the amount of traffic that can be handled.
EdgeConnect ASN	Enter an ASN between 64512 and 65534, excluding the following ASNs: i. ASNs reserved by Azure: 1. Public ASNs: 8074, 8075, 12076 2. Private ASNs: 65515, 65517, 65518, 65519, 65520 ii. ASNs reserved by IANA: 1. 23456, 64496-64511, 65535-65551 NOTE: vWAN Hub only supports 16-bit ASNs. As a result, do not enter a 32-bit ASN. The ASN you enter here will be assigned to both EC-Vs.
SSH public key	Generate a public key with an application, such as PuTTYgen, and then input the value here. IMPORTANT: EdgeConnect only supports single-line SSH public keys. Do not use multi-line SSH public keys. Additionally, use an EdDSA (ED25519) key pair. NOTE: Save the private key file. If you need to log in via SSH to the appliance after it is deployed, you will need this key.
Comment (Optional)	Enter a comment if you want to attach any additional details for the deployment.

Click Review and deploy.
Review the configuration summary, and then click Deploy to create the EC-V instances.

NOTE: To check the status after a few minutes, click the refresh icon next to the Deploy Cloud Hubs in Azure button.
If your EC-V deployment fails, the status appears as Incomplete in the Cloud Hubs in Azure table. To download the log file, click the info icon. The reason for the failure is typically at the bottom of the log file.
- To remove (delete) a deployment after a failure, click Terminate. All Azure resources created by the Orchestrator will be removed. If termination fails, an Azure resource is blocking the deletion.
- To view details of this Azure resource, download the log file and then check the last error message. To proceed with the termination, you can manually delete this resource on the Azure Portal.
If your deployment succeeds, the status appears as Deployed.
After the deployment succeeds, the newly deployed EC-Vs appear on the Discovered Appliances tab in Orchestrator. Please allow at least 10 minutes for EC-Vs to be discovered in Orchestrator. On the Discovered Appliances tab, the Approve button appears after the EC-V is fully configured.