Installation on Rocky Linux 9
What the server needs, and how to prepare Rocky Linux 9 to receive it. The gateway software itself is installed by NetvynX during onboarding — this page covers everything you do before that. The same steps apply to any RHEL 9 rebuild.
Hardware requirements
Sizing is per deployment — these are the floors. Peak concurrent sessions, busy-hour packet rate and which services you enable all move the numbers, and we size against them before you buy anything.
CPU x86-64, 16 cores minimum, single socket preferred
AVX2 required; constant TSC and no C-state overrides
Memory 32 GB minimum; 64 GB+ for large session or NAT tables
all DIMM channels populated, single NUMA node preferred
NICs 2 minimum (core-facing + subscriber-facing)
Intel or Mellanox recommended; ask us before buying
Management 1 separate NIC, never one of the data ports
Disk 120 GB SSD; more if compliance logs are kept locally
BIOS VT-d / IOMMU enabled, hyper-threading either way
Supported release
Rocky Linux 9, or any RHEL 9 rebuild such as AlmaLinux. This is the platform to choose for telco and regulated environments: the support horizon suits multi-year deployments, and the tuning profiles the data plane relies on are part of the base system rather than something bolted on.
Release Rocky Linux 9.x, x86_64 (or a RHEL 9 rebuild) Profile Minimal Install or Server, no GUI Filesystem XFS — the distribution default is fine Repos BaseOS, AppStream, EPEL
Installing the OS
A Minimal Install is enough. Enable EPEL during preparation so the packages we need at bring-up are already reachable, then bring the box fully up to date.
# in anaconda: "Minimal Install", no GUI
dnf install -y epel-release
dnf -y update
dnf install -y chrony tuned
reboot
Management network
Give the box a static management address on an interface that is not one of the data ports. The data NICs are handed to the fast path during install and will disappear from the OS — if management is on one of them, you lose the box at that moment.
nmcli con mod eno1 \ ipv4.addresses 198.51.100.20/24 \ ipv4.gateway 198.51.100.1 \ ipv4.dns 198.51.100.53 \ ipv4.method manual nmcli con up eno1 hostnamectl set-hostname bng01.example.net
Time synchronisation
Not optional. Compliance records are only useful if their timestamps hold up, and a lawful-intercept request answered from a clock that drifted is worth nothing. Point chrony at a source you trust and confirm it is stepping before the gateway carries traffic.
systemctl enable --now chronyd
chronyc sources -v # confirm a source is selected (^*)
timedatectl
Leave SELinux enforcing
Rocky ships SELinux enforcing and firewalld enabled. Leave both on — in a regulated deployment they are usually the thing being audited, and we handle the policy and port rules during bring-up rather than asking you to switch them off. Tell us if your security policy requires specific handling and we will work inside it.
getenforce # Enforcing
systemctl is-active firewalld
Access we need
Bring-up is done with your team, not behind your back. We need SSH to the management address, an account with sudo, and out-of-band console access — IPMI, iDRAC, iLO or a serial concentrator. The console matters: binding the data NICs is exactly the step that can cut a network path, and recovering from that without a console means a site visit.
Readiness checklist
When these are all true, the box is ready for us. Send the output of the last three with your handover note and the first session usually completes in under an hour.
cat /etc/rocky-release uname -r lscpu | head -n 20 # cores, NUMA, flags free -g # memory lspci | grep -i ethernet # adapter inventory