Prepare the hardware, software, and network requirements for deploying the Secure Workload Software Appliance on VMware vSphere.
System requirements
Hypervisor
-
VMware vSphere version 7.0 and 8.0.
-
Download the Secure Workload Software Appliance installation OVA file for VMware vSphere from the Secure Workload Downloads page.
Datacenter requirements
Software Appliance resource specifications
| Resource Specification |
Workloads <= 20,000 |
Workloads <= 40,000 |
Comments |
|---|---|---|---|
| Total vCPU | 590 | 814 | all non–end-of-support (EOS) x86-64 CPUs since calendar year 2020 |
| Total Memory | 4996 Gib | 6852Gib | preferred DDR4 or higher memory |
| Total Usable Storage | 78101 GB | 118101GB | 35k+ IOPs @4K Payload (Read), 25k+ IOPs @4k Payload (Write) and Thin Provisioning), supports iSCSI, FC storages and internal storage |
| Network |
3 (10Gb) |
3 (10Gb) |
|
| Total number of Hosts |
Min 3, Preferred 6 |
Min 3, Preferred 6 |
|
| Hypervisor |
VMware ESXi |
VMware ESXi |
|
| SPECint_rate2017 |
Minimum 1,526 |
Minimum 2,092 |
For references, see Cisco Secure Workload Datasheet.
Secure Workload supports all non–end-of-support (EOS) CPUs released from calendar year 2020 onward.
Setup the network
Network specifications
All hosts in the cluster must be equipped with at least 10 Gigabit Ethernet (GbE) interfaces and have the following three virtual networks available for Secure Workload operations.
Management network
The management network (virtual network) is designed specifically for management and administrative purposes. It facilitates secure access for system administrators to perform routine management tasks and critical operations. This network provides a secure and isolated channel for infrastructure configuration, deployment, ongoing management, and decommissioning activities.
Public network
Dedicated or shared public network for external cluster traffic that must be reachable from sensors and clients and have access to the vCenter. This network is used for Secure Workload application access. You must specify a minimum subnet of /28 for 20,000 scale factor and /27 for 40,000 scale factor. If the external network is dedicated with the full range of IP addresses being available, then eight IP addresses are automatically consumed as shown in the following tables.
If the public network is shared, you must define specific available addresses.
| IP Address |
Description |
|---|---|
| 1st |
Gateway |
| 2nd and 3rd |
Reserved |
| 4th |
Web UI Virtual IP |
| 5th |
Sensor Management Virtual IP |
| 6th |
Collector-1 |
| 7th |
Collector-2 |
| 8th |
Collector-3 |
| 9th |
Collector-4 |
| 10th |
Collector-5 |
| 11th |
Collector-6 |
| 12th |
Application Interface -1 |
| 13th |
Application Interface -2 |
| 14th |
Adhoc-Kafka |
| 30th |
Orchestrator-publicIP |
| IP Address |
Description |
|---|---|
| 1st |
Gateway |
| 2nd and 3rd |
Reserved |
| 4th |
Web UI Virtual IP |
| 5th |
Sensor Management Virtual IP |
| 6th |
Collector-1 |
| 7th |
Collector-2 |
| 8th |
Collector-3 |
| 9th |
Collector-4 |
| 10th |
Collector-5 |
| 11th |
Collector-6 |
| 12th |
Collector-7 |
| 13th |
Collector-8 |
| 14th |
Application Interface -1 |
| 15th |
Application Interface -2 |
| 16th |
Adhoc-Kafka |
| 30th |
Orchestrator-publicIP |
Private network
Set up a dedicated private network for internal cluster communication. Make sure your network is not routable or shared. You must use a subnet of /16 (255.255.0.0) for your dedicated network.