Step 1

Create a virt-install script called “virt_install_ftdv.sh”.

For Secure Boot Configuration: Use virt-install command with specific parameters.

virt-install \ 
  --connect=qemu:///system \ 
  --network bridge:br1556,model=virtio\ 
  --network bridge:br-in,model=virtio\ 
  --network bridge:br-out,model=virtio\ 
  --name=<prefix>-vm-ftdv \ 
  --cpu host \ 
  --arch=x86_64 \ 
  --vcpus=32 \ 
  --ram=65536 \ 
  --os-type=linux \ 
  --os-variant=generic \ 
  --virt-type=kvm \ 
  --import \ 
  --watchdog i6300esb,action=reset \
  --disk path=<path to qcow2 file>,format=qcow2,device=disk,bus=virtio,cache=none \ 
  --disk path=<path to day0.iso file>,format=iso,device=cdrom,bus=sata \ 
  --console pty,target_type=serial \ 
  --serial tcp,host=127.0.0.1:<port>,mode=bind,protocol=telnet \
  --boot firmware=efi,loader_secure=yes \ 
  --machine q35 \   
  --features smm.state=on \ 
  --force 

Note	Machine type must be q35 and SMM (System Management Mode) must be ON for Secure Boot.

VM Management:

Note	To delete a VM, use the following command: virsh undefine <vm-name> --nvram

Step 2

Run the virt_install script:

Note	Inline traffic is not supported, as promiscuous mode can not be enabled for the SRIOV interfaces.

/usr/bin/virt_install_ftdv.sh

Starting install...
Creating domain...

Important

During registration of Firewall Threat Defense Virtual to the Management Center, select the FTDvU - Unlimited performance tier from the drop-down list to apply the FTDvU license tier.

Step 1

Start virt-manager (Applications > System Tools > Virtual Machine Manager).

Step 2

Click the button in the top left corner to open the New VM wizard.

Step 3

Enter the virtual machine details:

1. For the operating system, select Import existing disk image.

   This method allows you to import a disk image (containing a pre-installed, bootable operating system) to it.

2. Click Forward to continue.

Step 4

Load the disk image:

1. Click Browse... to select the image file.

2. Choose Generic for the OS type.

3. Click Forward to continue.

Step 5

Configure the memory and CPU options:

Important

The Firewall Threat Defense Virtual supports performance-tiered licensing that provides different throughput levels and VPN connection limits based on deployment requirements. See the following table for supported performance tiers and values for the --vcpus and --ram parameters for each Firewall Threat Defense Virtual platform.

Table 3. Supported vCPU and Memory Parameters for Virtual Machine Manager

CPUs	Firewall Threat Defense Virtual Platform Size
32	32 vCPU / 64 GB (FTDv Unlimited)
64	64 vCPU / 128 GB (FTDv Unlimited)

1. Set the Memory (RAM) parameter for your Firewall Threat Defense Virtual platform size.

2. Set the corresponding CPUs parameter for the Firewall Threat Defense Virtual platform size.

3. Click Forward to continue.

Step 6

Check the Customize configuration before install box, specify a Name, then click Finish.

Step 7

Modify the CPU configuration:

Step 8

Configure the Virtual Disk:

1. From the left panel, select Disk 1.

2. Select Advanced options.

3. Set the Disk bus to Virtio.

4. Set the Storage format to qcow2.

Step 9

Configure a serial console:

1. From the left panel, select Console.

2. Select Remove to remove the default console.

3. Click Add Hardware to add a serial device.

4. For Device Type, select TCP net console (tcp).

5. For Mode, select Server mode (bind).

6. For Host, enter 0.0.0.0 for the IP address, then enter a unique Port number.

7. Check the Use Telnet box.

8. Configure device parameters.

Step 10

Configure a watchdog device to automatically trigger some action when the KVM guest hangs or crashes:

1. Click Add Hardware to add a watchdog device.

2. For Model, select default.

3. For Action, select Forcefully reset the guest.

Step 11

Configure virtual network interfaces.

Step 12

If deploying using a Day 0 configuration file, create a virtual CD-ROM for the ISO:

1. Click Add Hardware.

2. Select Storage.

3. Click Select managed or other existing storage and browse to the location of the ISO file.

4. For Device type, select IDE CDROM.

Step 13

After configuring the virtual machine's hardware, click Apply.

Step 14

Click Begin installation for virt-manager to create the virtual machine with your specified hardware settings.

Note

When launching the Threat Defense Virtual in virt-manager, a graphical (SPICE) console opens by default. On some systems, this console may appear frozen or show only partial output during boot. However, the device continues to boot normally in the background. To view the full console output, go to: View → Consoles → Console or Serial If a TCP serial console is configured, use telnet to access the console instead — output will not appear in virt-manager.

Important

During registration of Firewall Threat Defense Virtual to the Management Center, select the Threat Defense Virtual Unlimited performance tier from the drop-down list to apply the FTDvU license tier.

Step 1

Log in to the vSphere Web Client (or the vSphere Client).

Step 2

Download the OVF template file from this link.

Step 3

Using the vSphere Web Client (or the vSphere Client), deploy the OVF template file you downloaded earlier by clicking File > Deploy OVF Template.

The Deploy OVF Template wizard appears.

Note

For Version 10.0, in a VMware OVF template, the network interfaces are typically mapped in a static NetAdaptor. When deploying a Threat Defense Virtual, the diagnostic interface is optional. If the Diagnostic is selected as ON, then there is no change in the network interface mapping. If the Diagnostic is selected as OFF, it results in a shift of network adapter assignments. The removal of the diagnostic interface shifts the mapping of each subsequent ethernet interface down by one position and the network adapters are reassigned as follows: Table 4. Network Interface Mapping Diagnostic: ON Diagnostic: OFF Management0-0 > Management Management0-0 -> Management Diagnostic ------- > Diagnostic Diagnostic ------> Ethernet0/0 Ethernet0-0 ------> Ethernet0/0 Ethernet0-0 ------> Ethernet0/1 Ethernet0-1 ------> Ethernet0/1 Ethernet0-1 ------> Ethernet0/2 Ethernet0-2 ------> Ethernet0/2 Ethernet0-2 ------> Ethernet0/3 Ethernet0-3 ------> Ethernet0/3 Ethernet0-3 ------> Ethernet0/4 Ethernet0-4 ------> Ethernet0/4 Ethernet0-4 ------> Ethernet0/5 Ethernet0-5 ------> Ethernet0/5 Ethernet0-5 ------> Ethernet0/6 Ethernet0-6 ------> Ethernet0/6 Ethernet0-6 ------> Ethernet0/7 Ethernet0-7 ------> Ethernet0/7 Ethernet0-7 ------> Ethernet0/8

Important

If the diagnostic setting is specified both in the Day0 configuration file and in the VMware OVF deployment wizard, the Day0 configuration takes precedence. For example: If "Diagnostic": "OFF" is specified in the Day0 configuration file, but the diagnostic option is set to ON in the OVF deployment wizard, the diagnostic interface will be disabled. The Day0 configuration is applied at first boot and overrides the OVF template selection. To avoid interface mapping inconsistencies, ensure that the diagnostic setting is consistently configured in both the Day0 configuration file and the OVF wizard.

Step 4

Browse your file system for the OVF template source location and click Next.

Step 5

On the Name and Location page, enter a name for this deployment and select the location in the inventory (host or cluster) on which you want to deploy the Firewall Threat Defense Virtual Unlimited, then click Next. The name must be unique within the inventory folder and can contain up to 80 characters.

Step 6

Navigate to, and select the resource pool where you want to run the Firewall Threat Defense Virtual and click Next.

Note	This page appears only if the cluster contains a resource pool.

Step 7

Review the OVF Template Details page and verify the OVF template information (product name, version, vendor, download size, size on disk, and description) and click Next.

Step 8

The End User License Agreement page appears. Review the license agreement packaged with the OVF template (VI templates only), click Accept to agree to the terms of the licenses and click Next.

Step 9

On the Configuration page, select either 32 vCPU / 64 GB or 64 vCPU / 128 GB for FTDvU from the the Configuration options, and click Next.

Important

The Firewall Threat Defense Virtual deploys with adjustable vCPU and memory resources.

Step 10

Select a Storage location to store the virtual machine files.

Step 11

From the Select virtual disk format drop-down list, choose the disk format to store the virtual machine virtual disks, and click Next.

Step 12

On the Select networks page, map the networks specified in the OVF template to networks in your inventory, and then click Next.

Ensure the Management0-0 interface is associated with a VM Network that is reachable from the Internet. Non-management interfaces are configurable from either the Firewall Management Center or from the Firewall Device Manager depending on your management mode.

Important

Firewall Threat Defense Virtual on VMware now defaults to vmxnet3 interfaces when you create a virtual device. Previously, the default was e1000. If you are using e1000 interfaces, we strongly recommend you switch. The vmxnet3 device drivers and network processing are integrated with the ESXi hypervisor, so they use fewer resources and offer better network performance.

The networks may not be in alphabetical order. If it is too difficult to find your networks, you can change the networks later from the Edit Settings dialog box. After you deploy, right-click the Firewall Threat Defense Virtual instance, and choose Edit Settings. However, that screen does not show the Firewall Threat Defense Virtual IDs (only Network Adapter IDs).

See the following concordance of Network Adapter, Source Networks and Destination Networks for the Firewall Threat Defense Virtual interfaces (note these are the default vmxnet3 interfaces):

Table 5. Source to Destination Network Mapping—VMXNET3

Network Adapter	Source Networks	Destination Networks	Function
Network adapter 1	Management0-0	Management0/0	Management
Network adapter 2	Reserved for internal use.	Reserved for internal use.	Reserved for internal use.
Network adapter 3	Ethernet0-0	Ethernet0/0	Outside data
Network adapter 4	Ethernet0-1	Ethernet0/1	Inside data
Network adapter 5	Ethernet0-2	Ethernet0/2	Data traffic (Optional)
Network adapter 6	Ethernet0-3	Ethernet0/3	Data traffic (Optional)
Network adapter 7	Ethernet0-4	Ethernet0/4	Data traffic (Optional)
Network adapter 8	Ethernet0-5	Ethernet0/5	Data traffic (Optional)
Network adapter 9	Ethernet0-6	Ethernet0/6	Data traffic (Optional)
Network adapter 10	Ethernet0-7	Ethernet0/7	Data traffic (Optional)

You can have a total of 10 interfaces when you deploy the Firewall Threat Defense Virtual. For data interfaces, make sure that the Source Networks map to the correct Destination Networks, and that each data interface maps to a unique subnet or VLAN. You do not need to use all Firewall Threat Defense Virtual interfaces; for interfaces you do not intend to use, you can simply leave the interface disabled within the Firewall Threat Defense Virtual configuration

Step 13

On the Customize templates properties page, set the user-configurable properties packaged with the OVF template (VI templates only):

1. Password

   Set the password for Firewall Threat Defense Virtual admin access.

2. Network

   Set the network information, including the Fully Qualified Domain Name (FQDN), DNS, search domain, and network protocol (IPv4 or IPv6).

3. Management

   Set the management mode. Click the drop-down arrow for Enable Local Manager and select Yes to use the integrated Firewall Device Manager web-based configuration tool. Select No to use Firewall Management Center to manage this device.

4. Firewall Mode

   Set the initial firewall mode. Click the drop-down arrow for Firewall Mode and choose one of the two supported modes, either Routed or Transparent.

   If you chose Yes for Enable Local Manager, you can only select Routed firewall mode. You cannot configure transparent firewall mode interfaces using the local Firewall Device Manager.

5. Deployment Type

   Set the deployment type to Standalone or Cluster. Choose Cluster to enable jumbo-frame reservation, which is required for the cluster control link. Choose Standalone for a standalone or High Availability deployment. Note that if you deploy as a Standalone device, you can still use it in a cluster; however, enabling jumbo frames for clustering after deployment means you will have to restart.

6. Registration

   If you chose No for Enable Local Manager, you need to provide the required credentials to register this device to the managing Secure Firewall Management Center. Provide the following:

   • Managing Defense Center—Enter the host name or IP address of the Firewall Management Center.

   • Registration Key—The registration key is a user-generated one-time use key that must not exceed 37 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-). You will need to remember this registration key when you add the device to the Firewall Management Center.

   • NAT ID—If the Firewall Threat Defense Virtual and the Firewall Management Center are separated by a Network Address Translation (NAT) device, and the Firewall Management Center is behind a NAT device, enter a unique NAT ID. This is a user-generated one-time use key that must not exceed 37 characters. Valid characters include alphanumerical characters (A–Z, a–z, 0–9) and the hyphen (-).

7. Click Next.

Step 14

On the Ready to complete page, review and verify the displayed information. To begin the deployment with these settings, click Finish. To make any changes, click Back to navigate back through the screens.

Note	To successfully register the Firewall Threat Defense Virtual with the Cisco Licensing Authority, the Firewall Threat Defense Virtual requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.

Important

During registration of Threat Defense Virtual to the Management Center, select the FTDvU - Unlimited performance tier from the drop-down list to apply the FTDvU license tier.

Step 1

Power off the Firewall Threat Defense Virtual instance.

Step 2

Remove the data interfaces.

Step 3

Attach the SR-IOV interface.

Step 4

Power on the Firewall Threat Defense Virtual instance.

Note	To successfully register the Firewall Threat Defense Virtual with the Cisco Licensing Authority, the Firewall Threat Defense Virtual requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.

Important

During registration of Firewall Threat Defense Virtual to the Management Center, select the Threat Defense Virtual Unlimited performance tier from the drop-down list to apply the FTDvU license tier.

Step 1

Download the Firewall Threat Defense Virtual install package for VMware ESXi from Cisco.com, and save it to your local management computer:

Step 2

Unpack the tar file into a working directory. Do not remove any files from the directory. The following files are included:

Step 3

In a browser, enter the ESXi target host name or IP address using the format http://host-name/ui or http://host-IP-address/ui.

Step 4

Enter the administrator user name and password.

Step 5

Click Login to continue.

Step 6

Right-click on Host in the VMware Host Client inventory and select Create/Register VM.

Step 7

On the Select creation type page of the wizard, select Deploy a virtual machine from an OVF or OVA file and click Next.

Step 8

On the Select OVF and VMDK files page of the wizard:

1. Enter a name for your Firewall Threat Defense Virtual machine.

   Virtual machine names can contain up to 80 characters and must be unique within each ESXi instance.

2. Click the blue pane, browse to the directory where you unpacked the Firewall Threat Defense Virtual tar file, and choose the ESXi OVF template and the accompanying VMDK file:

   Cisco_Secure_Firewall_Threat_Defense_Virtual-ESXi-X.X.X-xxx.ovf

   Cisco_Secure_Firewall_Threat_Defense_Virtual-X.X.X-xxx.vmdk

   day0.iso

   where X.X.X-xx is the version and build number of the archive file you downloaded.

   Attention

   Make sure you select the ESXi OVF.

Step 9

Click Next.

Step 10

Choose a datastore from the list of accessible datastores on the Select storage page of the wizard.

Step 11

Click Next.

Step 12

Configure the Deployment options that come packaged with the ESXi OVF for the Firewall Threat Defense Virtual:

1. Network Mapping—Map the networks specified in the OVF template to networks in your inventory, and then select Next.

   Ensure the Management0-0 interface is associated with a VM Network that is reachable from the Internet. Non-management interfaces are configurable from either the Firewall Management Center or from the Firewall Device Manager depending on your management mode.

   Important

   Firewall Threat Defense Virtual on VMware now defaults to vmxnet3 interfaces when you create a virtual device. Previously, the default was e1000. If you are using e1000 interfaces, we strongly recommend you switch. The vmxnet3 device drivers and network processing are integrated with the ESXi hypervisor, so they use fewer resources and offer better network performance.

   The networks may not be in alphabetical order. If it is too difficult to find your networks, you can change the networks later from the Edit Settings dialog box. After you deploy, right-click the Firewall Threat Defense Virtual instance, and choose Edit Settings. However, that screen does not show the Firewall Threat Defense Virtual IDs (only Network Adapter IDs).

   See the following concordance of Network Adapter, Source Networks and Destination Networks for Firewall Threat Defense Virtual interfaces (note these are the default vmxnet3 interfaces):

   Table 6. Source to Destination Network Mapping—VMXNET3

   Network Adapter	Source Networks	Destination Networks	Function
   Network adapter 1	Management0-0	Management0/0	Management
   Network adapter 2	Reserved for internal use.	Reserved for internal use.	Reserved for internal use.
   Network adapter 3	Ethernet0-0	Ethernet0/0	Outside data
   Network adapter 4	Ethernet0-1	Ethernet0/1	Inside data
   Network adapter 5	Ethernet0-2	Ethernet0/2	Data traffic (Optional)
   Network adapter 6	Ethernet0-3	Ethernet0/3	Data traffic (Optional)
   Network adapter 7	Ethernet0-4	Ethernet0/4	Data traffic (Optional)
   Network adapter 8	Ethernet0-5	Ethernet0/5	Data traffic (Optional)
   Network adapter 9	Ethernet0-6	Ethernet0/6	Data traffic (Optional)
   Network adapter 10	Ethernet0-7	Ethernet0/7	Data traffic (Optional)

   You can have a total of 10 interfaces when you deploy the Firewall Threat Defense Virtual. For data interfaces, make sure that the Source Networks map to the correct Destination Networks, and that each data interface maps to a unique subnet or VLAN. You do not need to use all Firewall Threat Defense Virtual interfaces; for interfaces you do not intend to use, you can simply leave the interface disabled within the Firewall Threat Defense Virtual configuration.

2. Disk provisioning—Select the disk format to store the virtual machine virtual disks.

   When you select Thick provisioned, all storage is immediately allocated. When you select Thin provisioned, storage is allocated on demand as data is written to the virtual disks. Thin provisioning can also reduce the amount of time it takes to deploy the virtual appliance.

Step 13

On the Ready to complete page of the New virtual machine wizard, review the configuration settings for the virtual machine.

1. (Optional) Click Back to go back and review or modify the wizard settings.

2. (Optional) Click Cancel to discard the creation task and close the wizard.

3. Click Finish to complete the creation task and close the wizard.

   After you complete the wizard, the ESXi host processes the VM; you can see the deployment status in the Recent Tasks pane. A successful deployment shows Completed successfully under the Results column.

   The new Firewall Threat Defense Virtual virtual machine instance then appears under the Virtual Machines inventory of the ESXi host. Booting up the new virtual machine could take up to 30 minutes.

   Note	To successfully register the Firewall Threat Defense Virtual with the Cisco Licensing Authority, the Firewall Threat Defense Virtual requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.

Step 1

Open the VMware console.

Step 2

At the firepower login prompt, log in with the default credentials of username admin and the password Admin123.

Step 3

When the Firewall Threat Defense Virtual Unlimited system boots, a setup wizard prompts you for the following information required to configure the system:

Step 4

Review the Setup wizard settings. Defaults or previously entered values appear in brackets. To accept previously entered values, press Enter.

Step 5

Complete the system configuration as prompted.

Step 6

Verify the setup was successful when the console returns to the firepower # prompt.

Note	To successfully register the Firewall Threat Defense Virtual with the Cisco Licensing Authority, the Firewall Threat Defense Virtual requires Internet access. You might need to perform additional configuration after deployment to achieve Internet access and successful license registration.