You can deploy the ASAv using VMware.
The following table lists the VMware feature support for the ASAv.
Used for dynamic resource scheduling and distributed power management. |
|||
See the ASA compatibility matrix:
http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html
Security Policy for a vSphere Standard Switch
For a vSphere switch, you can edit Layer 2 security policies and apply security policy exceptions for port groups used by the ASAv interfaces. See the following default settings:
You may need to modify these settings for the following ASAv configurations.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
For failover deployments, make sure that the standby unit has the same model license; for example, both units should be ASAv30s.
You cannot specify IPv6 addresses for the management interface when you first deploy the ASAv OVA file using the VMware vSphere Web Client; you can later add IPv6 addressing using ASDM or the CLI.
Additional Guidelines and Limitations
Note: If you need to change the memory or vCPU hardware settings, use only the values documented in Licensing for the ASAv. Do not use the VMware-recommended memory configuration minimum, default, and maximum values.
Use the ASAv show vm and show cpu commands or the ASDM Home > Device Dashboard > Device Information > Virtual Resources tab or the Monitoring > Properties > System Resources Graphs > CPU pane to view the resource allocation and any resources that are over- or under-provisioned.
–The vSphere Web Client is not supported for ASAv OVA deployment; use the vSphere client instead.
–Deployment fields might be duplicated; fill out the first instance of any given field and ignore the duplicated fields.
This section describes how to deploy the ASAv using the VMware vSphere Web Client.
1. Access the vSphere Web Client and Install the Client Integration Plug-In
2. Deploy the ASAv Using the VMware vSphere Web Client
This section describes how to access the vSphere Web Client. This section also describes how to install the Client Integration Plug-In, which is required for ASAv console access. Some Web Client features (including the plug-in) are not supported on the Macintosh. See the VMware website for complete client support information.
You can also choose to use the standalone vSphere Client, but this guide only describes the Web Client.
1. Launch the VMware vSphere Web Client from your browser:
https:// vCenter_server : port /vsphere-client/
2. (One time only) Install the Client Integration Plug-in so that you can access the ASAv console.
a. In the login screen, download the plug-in by clicking Download the Client Integration Plug-in.
b. Close your browser and then install the plug-in using the installer.
c. After the plug-in installs, reconnect to the vSphere Web Client.
3. Enter your username and password, and click Login, or check the Use Windows session authentication check box (Windows only).
To deploy the ASAv, use the VMware vSphere Web Client (or the vSphere Client) and a template file in the open virtualization format (OVF); note that for the ASAv, the OVF package is provided as a single open virtual appliance (OVA) file. You use the Deploy OVF Template wizard in the vSphere Web Client to deploy the Cisco package for the ASAv. The wizard parses the ASAv OVA file, creates the virtual machine on which you will run the ASAv, and installs the package.
Most of the wizard steps are standard for VMware. For additional information about the Deploy OVF Template, see the VMware vSphere Web Client online help.
You must have at least one network configured in vSphere (for management) before you deploy the ASAv.
1. Download the ASAv OVA file from Cisco.com, and save it to your PC:
http://www.cisco.com/go/asa-software
Note: A Cisco.com login and Cisco service contract are required.
2. In the vSphere Web Client Navigator pane, click vCenter.
4. Right-click the data center, cluster, or host where you want to deploy the ASAv, and choose Deploy OVF Template.
The Deploy OVF Template wizard appears.
5. Follow the wizard screens as directed.
6. In the Setup networks screen, map a network to each ASAv interface that you want to use.
The networks may not be in alphabetical order. If it is too difficult to find your networks, you can change the networks later from the Edit Settings dialog box. After you deploy, right-click the ASAv instance, and choose Edit Settings to access the Edit Settings dialog box. However that screen does not show the ASAv interface IDs (only Network Adapter IDs). See the following concordance of Network Adapter IDs and ASAv interface IDs:
You do not need to use all ASAv interfaces; however, the vSphere Web Client requires you to assign a network to all interfaces. For interfaces you do not intend to use, you can simply leave the interface disabled within the ASAv configuration. After you deploy the ASAv, you can optionally return to the vSphere Web Client to delete the extra interfaces from the Edit Settings dialog box. For more information, see the vSphere Web Client online help.
Note: For failover/HA deployments, GigabitEthernet 0/8 is pre-configured as the failover interface.
7. (9.3(2) and Later) If your network uses an HTTP proxy for Internet access, you must configure the proxy address for smart licensing in the Smart Call Home Settings area. This proxy is also used for Smart Call Home in general.
8. For failover/HA deployments, in the Customize template screen:
–Specify the standby management IP address.
When you configure your interfaces, you must specify an active IP address and a standby IP address on the same network. When the primary unit fails over, the secondary unit assumes the IP addresses and MAC addresses of the primary unit and begins passing traffic. The unit that is now in a standby state takes over the standby IP addresses and MAC addresses. Because network devices see no change in the MAC to IP address pairing, no ARP entries change or time out anywhere on the network.
–Configure the failover link settings in the HA Connection Settings area.
The two units in a failover pair constantly communicate over a failover link to determine the operating status of each unit. GigabitEthernet 0/8 is pre-configured as the failover link. Enter the active and standby IP addresses for the link on the same network.
9. After you complete the wizard, the vSphere Web Client processes the VM; you can see the “Initialize OVF deployment” status in the Global Information area Recent Tasks pane.
When it is finished, you see the Deploy OVF Template completion status.
The ASAv VM instance then appears under the specified data center in the Inventory.
10. If the ASAv VM is not yet running, click Power On the virtual machine.
Wait for the ASAv to boot up before you try to connect with ASDM or to the console. When the ASAv starts up for the first time, it reads parameters provided through the OVA file and adds them to the ASAv system configuration. It then automatically restarts the boot process until it is up and running. This double boot process only occurs when you first deploy the ASAv. To view bootup messages, access the ASAv console by clicking the Console tab.
11. For failover/HA deployments, repeat this procedure to add the secondary unit. See the following guidelines:
–(9.3(1)) Set the same number of vCPUs as the primary unit. (9.3(2)) Set the same throughput level as the primary unit.
–Enter the exact same IP address settings as for the primary unit. The bootstrap configurations on both units are identical except for the parameter identifying a unit as primary or secondary.
Note: (9.3(2) and later) To successfully register the ASAv with the Cisco Licensing Authority, the ASAv requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.
In some cases with ASDM, you may need to use the CLI for troubleshooting. By default, you can access the built-in VMware vSphere console. Alternatively, you can configure a network serial console, which has better capabilities, including copy and paste.
For initial configuration or troubleshooting, access the CLI from the virtual console provided through the VMware vSphere Web Client. You can later configure CLI remote access for Telnet or SSH.
For the vSphere Web Client, install the Client Integration Plug-In, which is required for ASAv console access.
1. In the VMware vSphere Web Client, right-click the ASAv instance in the Inventory, and choose Open Console. Or you can click Launch Console on the Summary tab.
2. Click in the console and press Enter. Note: Press Ctrl + Alt to release the cursor.
If the ASAv is still starting up, you see bootup messages.
When the ASAv starts up for the first time, it reads parameters provided through the OVA file and adds them to the ASAv system configuration. It then automatically restarts the boot process until it is up and running. This double boot process only occurs when you first deploy the ASAv.
Note: Until you install a license, throughput is limited to 100 Kbps so that you can perform preliminary connectivity tests. A license is required for regular operation. You also see the following messages repeated on the console until you install a license:
This prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.
3. Access privileged EXEC mode:
4. Press the Enter key to continue. By default, the password is blank. If you previously set an enable password, enter it instead of pressing Enter.
All non-configuration commands are available in privileged EXEC mode. You can also enter configuration mode from privileged EXEC mode.
To exit privileged mode, enter the disable, exit, or quit command.
5. Access global configuration mode:
The prompt changes to the following:
You can begin to configure the ASAv from global configuration mode. To exit global configuration mode, enter the exit, quit, or end command.
For a better console experience, you can configure a network serial port singly or attached to a virtual serial port concentrator (vSPC) for console access. See the VMware vSphere documentation for details about each method. On the ASAv, you must send the console output to a serial port instead of to the virtual console. This section describes how to enable the serial port console.
1. Configure a network serial port in VMware vSphere. See the VMware vSphere documentation.
2. On the ASAv, create a file called “use_ttyS0” in the root directory of disk0. This file does not need to have any contents; it just needs to exist at this location:
–From ASDM, you can upload an empty text file by that name using the Tools > File Management dialog box.
–At the vSphere console, you can copy an existing file (any file) in the file system to the new name. For example:
–From ASDM, choose Tools > System Reload.
–At the vSphere console, enter reload.
The ASAv stops sending to the vSphere console, and instead sends to the serial console.
4. Telnet to the vSphere host IP address and the port number you specified when you added the serial port; or Telnet to the vSPC IP address and port.
In 9.3(1), the ASAv uses a Virtual CPU license. In 9.3(2) and later, it uses a throughput license. Both licenses affect the number of vCPUs you can use.
If you want to increase (or decrease) the number of vCPUs for your ASAv, you can request a new license, apply the new license, and change the VM properties in VMware to match the new values.
Note: The assigned vCPUs must match the ASAv Virtual CPU license or Throughput license. The vCPU frequency limit and RAM must also be sized correctly for the vCPUs. When upgrading or downgrading, be sure to follow this procedure and reconcile the license and vCPUs immediately. The ASAv does not operate properly when there is a persistent mismatch.
2. Apply the new license. For failover pairs, apply new licenses to both units.
3. Do one of the following, depending on if you use failover or not:
–Failover—In the vSphere Web Client, power off the standby ASAv. For example, click the ASAv and then click Power Off the virtual machine, or right-click the ASAv and choose Shut Down Guest OS.
–No Failover—In the vSphere Web Client, power off the ASAv. For example, click the ASAv and then click Power Off the virtual machine, or right-click the ASAv and choose Shut Down Guest OS.
4. Click the ASAv and then click Edit Virtual machine settings (or right-click the ASAv and choose Edit Settings).
The Edit Settings dialog box appears.
5. Refer to the CPU/frequency/memory requirement in Licensing for the ASAv to determine the correct values for the new vCPU license.
6. On the Virtual Hardware tab, for the CPU, choose the new value from the drop-down list. You must also click the expand arrow to change the value for the vCPU frequency Limit.
7. For the Memory, enter the new value for the RAM.
9. Power on the ASAv. For example, click Power On the Virtual Machine.
a. Open a console to the active unit or Launch ASDM on the active unit.
b. After the standby unit finishes starting up, failover to the standby unit:
- ASDM: Choose Monitoring > Properties > Failover > Status, and clicking Make Standby.