git clone <repository-URL>

You can deploy FTDc using either the default configuration or a custom values file.

• Using Helm with default configuration:

  helm install ftdc . -n <namespace>

• Using Helm with a custom values file:

  helm install ftdc . -f my-values.yaml -n <namespace>

helm install ftdc . \
  --set ftdc.repository=myregistry.example.com/ftdc:7.4 \
  --set ftdc.app_name=ftdc \
  --set ftdc.cpus=8 \
  --set ftdc.memory=16384 \
  --set ftdc.shmSize=4Gi \
  --set ftdc.hugepages=2Gi \
  --set ftdc_manager.enabled=true \
  --set ftdc_manager.repository=myregistry.example.com/ftd-manager:v1 \
  --set fmcv.ip=10.0.0.50 \
  --set fmcv.user=admin \
  --set fmcv.password=<your-password> \
  --set fmcv.access_policy=Production-Policy \
  --set fmcv.inside_zone=inside \
  --set fmcv.outside_zone=outside \
  --set fmcv.license_caps=BASE \
  --set fmcv.performance_tier=FTDv30 \
  --set worker_nodes.cni.type=macvlan \
  --set worker_nodes.persistence.lina.enabled=true \
  --set worker_nodes.persistence.lina.storageClass=lina-storage \
  --set worker_nodes.persistence.lina.size=1Gi \
  --set worker_nodes.persistence.lina.hostPath=/data/ftdc/lina \
  --set worker_nodes.persistence.lina.accessMode=ReadWriteMany \
  --set worker_node1.name=k8s-worker1 \
  --set worker_node1.ip=10.10.3.4 \
  -n default

See the configuration parameters in the following tables:

Supported CPU and memory configurations:

The following CPU and memory configurations are supported for FTDc deployment in Kubernetes environments. These configurations align with supported performance tiers.

• FTDv5 – 4 vCPU, 8 GB RAM

• FTDv10 – 4 vCPU, 8 GB RAM

• FTDv20 – 4 vCPU, 8 GB RAM

• FTDv30 – 8 vCPU, 16 GB RAM

• FTDv50 – 12 vCPU, 24 GB RAM

• FTDv100 – 16 vCPU, 32 GB RAM

Hugepages configuration:

The ftdc.hugepages parameter supports two modes:

1. Auto-calculation ("auto"): Calculates hugepages based on CPUs and interfaces:

   Formula: (CPUs128) + (numInterfaces64) Mi, rounded upto nearest 256 Mi.

   Example: 4 CPUs + 3 interfaces = (4×128) + (3×64) = 704Mi → rounded to 768Mi

2. Fixed value: Specify exact size like "512Mi", "1Gi", "2Gi"

FTD manager settings:

The FTD manager is an optional component that automates FTDc registration with Management Center.

When enabled, FTD manager creates the following resources:

• Secret for Management Center credentials

• ConfigMap for day0 configuration

• Deployment with RBAC (ServiceAccount, ClusterRole, ClusterRoleBinding)

Management Center configuration:

Prerequisites in Management Center for the ftd-manager pod:

• The required user account, access policy, and security zones must already be configured in Management Center.

• Management Center must have a valid license or it should be operating within the evaluation license period.

License capabilities:

Valid values for fmcv.license_caps are BASE, THREAT, URL, MALWARE, or Multiple.

• BASE: Base license

• THREAT: Threat protection

• URL: URL filtering

• MALWARE: Malware protection

• Multiple: BASE, THREAT, URL, MALWARE, CARRIER

Performance tiers:

Valid values for fmcv.performance_tier:

• FTDv5: 100 Mbps

• FTDv10: 1 Gbps

• FTDv20: 3 Gbps

• FTDv30: 5 Gbps

• FTDv50: 10 Gbps

• FTDv100: 16 Gbps

Passwords:

Use one of these methods to create passwords:

• Command line override

  helm install ftdc . --set fmcv.password=<your-password>

• Separate secrets file (add to .gitignore)

  helm install ftdc . -f secrets.yaml

CNI Configuration:

The Helm chart supports two CNI types for data plane interfaces: Macvlan and SR-IOV.

Macvlan Configuration:

Use this configuration when worker_nodes.cni.type is set to macvlan.

worker_nodes: 
  cni: 
    type: "macvlan" 
    macvlan: 
  networks: 
    - name: "macvlan-data1-bridge" # NetworkAttachmentDefinition name 
      interface: "ens224"          # Host interface 
    - name: "macvlan-data2-bridge" 
      interface: "ens256" 
    - name: "macvlan-data3-bridge" 
      interface: "ens161"

The Helm chart automatically creates NetworkAttachmentDefinition resources for each network.

• Generated interface-config:

  [interface0] 
    iface_id = net1; 
    uio_driver = afpacket;
  [interface1] 
    iface_id = net2; 
    uio_driver = afpacket;
  [interface2] 
    iface_id = net3; 
    uio_driver = afpacket;
  

SR-IOV Configuration:

Use this configuration when worker_nodes.cni.type is set to sriov.

worker_nodes: 
  cni: 
    type: "sriov" 
    sriov: 
      networks: 
        - name: "sriov-net-data1" 
          resourceName: "intel.com/intel_sriov_ens7f0" 
        - name: "sriov-net-data2" 
          resourceName: "intel.com/intel_sriov_ens7f1"

• Generated interface-config:

  [interface0] 
    iface_id = net1; 
    uio_driver = vfio-pci;
  [interface1]
    iface_id = net2; 
    uio_driver = vfio-pci;
  

Persistent storage:

Persistent volumes retain FTDc data across restarts.

Lina storage (default):

NGFW storage (Optional):

The day0.json file provides initial bootstrap configuration for FTDc.

Default Configuration (day0.json):

{ 
"EULA": "accept", 
"Hostname": "cisco-ftdc", 
"AdminPassword": "<PASSWORD>", 
"FirewallMode": "routed", 
"DNS1": "208.67.222.222", 
"Diagnostic": "OFF", 
"IPv4Mode": "DHCP", 
"IPv4Addr": "", 
"IPv4Mask": "", 
"IPv4Gw": "", 
"FmcIp": "DONTRESOLVE", 
"FmcRegKey": "docker",  
"FmcNatId": "docker"
}

Deployment Examples:

Example 1: Basic Deployment with Macvlan

# values-basic.yaml
ftdc: 	
  repository: "myregistry.example.com/ftdc:7.4" 
  app_name: "ftdc" 
  cpus: 4 
  memory: 8192 
  shmSize: "2Gi" 
  hugepages: "auto"

ftdc_manager: 
  enabled: false

worker_nodes: 
  cni: 
    type: "macvlan" 
    macvlan: 
      	networks: 
         - name: "macvlan-inside" 
           interface: "eth1" 
         - name: "macvlan-outside" 
           interface: "eth2" 
  persistence:  
      lina: 
        enabled: true 
        storageClass: "lina-storage" 
        size: "1Gi" 
        hostPath: "/data/ftdc/lina" 
        accessMode: "ReadWriteMany"

 worker_node1: 
   name: "worker-01" 
   ip: "192.168.1.100"

helm install ftdc . -f values-basic.yaml

Example 2: Production Deployment with SR-IOV and FTD manager

# values-production.yaml
ftdc: 	
  repository: "myregistry.example.com/ftdc:7.4" 
  app_name: "ftdc-prod" 
  cpus: 8 
  memory: 16384 
  shmSize: "4Gi" 
  hugepages: "2Gi"

ftdc_manager: 
  enabled: true
  repository: "myregistry.example.com/ftd-manager:v1"

fmcv: 
  ip: "10.0.0.50" 
  user: "admin" 
  password: "" # Set via --set or secrets file 
  access_policy: "Production-Policy" 
  inside_zone: "inside" 
  outside_zone: "outside" 
  license_caps: "BASE,THREAT,URL" 
  performance_tier: "FTDv30"

worker_nodes: 
  cni: 
    type: "sriov" 
    sriov: 
      	networks: 
         - name: "sriov-inside" 
           resourceName: "intel.com/intel_sriov_ens3f0"  
         - name: "sriov-outside" 
           resourceName: "intel.com/intel_sriov_ens3f1"
         - name: "sriov-dmz" 
           resourceName: "intel.com/intel_sriov_ens3f0"

  persistence:  
      lina: 
        enabled: true 
        storageClass: "fast-storage" 
        size: "5Gi" 
        hostPath: "/data/ftdc/lina" 
        accessMode: "ReadWriteMany"

  worker_node1: 
    name: "prod-worker-01" 
    ip: "10.0.1.100"

 helm install ftdc-prod . -f values-production.yaml --set fmcv.password=<password>