In the GCP console, choose VPC networks, then click Create VPC Network.

In the Name field, enter a descriptive name for your VPC network.

From Subnet creation mode, click Custom.

In the Name field under New subnet, enter the desired name.

From the Region drop-down list, select the region appropriate for your deployment.

From the IP address range field, enter the first network's subnet in CIDR format, such as 10.10.0.0/24.

Accept the defaults for all other settings, then click Create.

In the GCP console, choose Networking > VPC network > Firewall, then click Create Firewall Rule.

In the Name field, enter a descriptive name for your firewall rule, for example, vpc-asiasouth-mgmt-ssh.

From the Network drop-down list, select the name of the VPC network for which you are creating the firewall rule, for example, fmcv-south-mgmt.

From the Targets drop-down list, select the option applicable for your firewall rule, for example, All instances in the network.

In the Source IP ranges field, enter the source IP address ranges in CIDR format, for example, 0.0.0.0/0.

Under Protocols and ports, select Specified protocols and ports.

Add your security rules:

1. Add a rule to allow SSH (TCP/22).

2. Add a rule to allow TCP port 443.

   You access the Firewall Management Center Virtual UI which requires port 443 to be opened for HTTPS connections.

Click Create.

Log into to the GCP Console.

Click Navigation menu > Marketplace.

Search the Marketplace for “Firewall Management Center BYOL” and choose the offering.

Click Launch.

1. Deployment name — Specify a unique name for the instance.

2. Image version — Select the version from the drop-down list.

3. Zone — Select the zone where you want to deploy the Firewall Management Center Virtual.

4. Machine type — Choose the correct machine type based on the GCP Machine Type Support.

5. SSH key (optional) — Paste the public key from the SSH key pair.

   The key pair consists of a public key that GCP stores and a private key file that the user stores. Together they allow you to connect to your instance securely. Be sure to save the key pair to a known location, as it will be required to connect to the instance.

6. Choose whether to allow or Block project-wide SSH keys to access this instance. See the Google documentation Allowing or blocking project-wide public SSH keys from a Linux instance.

7. Startup script — Provide the day0 configuration for the Firewall Management Center Virtual.

   The following example shows a sample day0 configuration you can copy and paste in the Startup script field:

   {
   "AdminPassword": "myPassword@123456",
   "Hostname": "cisco-fmcv"
   }

   Tip

   To prevent execution errors, you should validate your day0 configuration using a JSON validator.

8. Select the Boot disk type from the drop-down list.

   By default, the Standard Persistent Disk is selected. Cisco recommends that you use the default Boot disk type.

9. The Boot disk size in GB default value is 250 GB. Cisco recommends that you keep the default boot disk size. It cannot be less than 250 GB.

10. Click Add network interface to configure the Management interface.

    Note

    You cannot add interfaces to an instance after you create it. If you create the instance with an improper interface configuration, you must delete the instance and recreate it with the proper interface configuration.

    • From the Network drop-down list, select a VPC network, for example, vpc-branch-mgmt.

    • From the External IP drop-down list, select the appropriate option.

      For the management interface, select the External IP to Ephemeral.

    • Click Done.

11. Firewall— Apply the firewall rules.

    • Check the Allow TCP port 22 traffic from the Internet (SSH access) check box to allow SSH.

    • Check the Allow HTTPS traffic from the Internet (FMC GUI) check box to allow HTTPS connections.

    • Check the Allow TCP port 8305 traffic from the Internet (SFTunnel comm.) check box to allow the Firewall Management Center Virtual and managed devices to communicate using a two-way, SSL-encrypted communication channel.

12. Click More to expand the view and make sure that IP Forwarding is set to On.

Click Deploy.