Cisco Firepower Threat Defense Virtual for VMware Getting Started Guide - Getting Started with Firepower Threat Defense Virtual and VMware [Cisco Firepower NGFW Virtual] (2024)

The following table lists the VMware feature support for the Firepower Threat Defense Virtual.

You have two options to manage your Firepower Threat Defense device.

See the Cisco Firepower Compatibility Guide for the most current information about hypervisor support for the Firepower Threat Defense Virtual.

The specific hardware used for FTDv deployments can vary, depending on the number of instances deployed and usage requirements. Each instance of the FTDv requires a minimum resource allocation—number of memory, CPUs, and disk space—on the server.

Systems running VMware vCenter Server and ESXi instances must meet specific hardware and operating system requirements. For a list of supported platforms, see the VMware online Compatibility Guide.

Support for Virtualization Technology

• Virtualization Technology (VT) is a set of enhancements to newer processors that improves performance for running virtual machines. Your system should have CPUs that support either Intel VT or AMD-V extensions for hardware virtualization. Both Intel and AMD provide online processor identification utilities to help you identify CPUs and determine their capabilities.

• Many servers that include CPUs with VT support might have VT disabled by default, so you must enable VT manually. You should consult your manufacturer's documentation for instructions on how to enable VT support on your system.

  Note	If your CPUs support VT, but you do not see this option in the BIOS, contact your vendor to request a BIOS version that lets you enable VT support.

Disable Hyperthreading

We recommend that you disable hyperthreading for your systems that run the FTDv; see Hyperthreading Not Recommended. The following processors support hyperthreading and have two threads per core:

• Processors based on the Intel Xeon 5500 processor microarchitecture.

• Intel Pentium 4 (HT-enabled)

• Intel Pentium EE 840 (HT-enabled)

To disable hyperthreading, you must first disable it in your system's BIOS settings and then turn it off in the vSphere Client (note that hyperthreading is enabled by default for vSphere). Consult your system documentation to determine whether your CPU supports hyperthreading.

Support for SR-IOV

SR-IOV Virtual Functions require specific system resources. A server that supports SR-IOV is required in addition to an SR-IOV capable PCIe adapter. You must be aware of the following hardware considerations:

• The capabilities of SR-IOV NICs, including the number of VFs available, differ across vendors and devices. The following NICs are supported:

  • Intel Ethernet Server Adapter X520 - DA2

  • Intel Ethernet Server Adapter X540

• Not all PCIe slots support SR-IOV.

• SR-IOV-capable PCIe slots may have different capabilities.

• x86_64 multicore CPU — Intel Sandy Bridge or later (Recommended).

  Note	We tested the FTDv on Intel's Broadwell CPU (E5-2699-v4) at 2.3GHz.

• Cores

  • Minimum of 8 physical cores per CPU socket.

  • Ensure that you assign all the allocated physical cores to a single socket.

    Note	CPU pinning is recommended to achieve full throughput.

You should consult your manufacturer's documentation for SR-IOV support on your system. You can search the VMware online Compatibility Guide for system recommendations that include SR-IOV support.

Support for SSSE3

• Firepower Threat Defense Virtual requires support for Supplemental Streaming SIMD Extensions 3 (SSSE3 or SSE3S), an single instruction, multiple data (SIMD) instruction set created by Intel.

• Your system should have CPUs that support SSSE3, such as Intel Core 2 Duo, Intel Core i7/i5/i3, Intel Atom, AMD Bulldozer, AMD Bobcat, and later processors.

• See this reference page for more information about the SSSE3 instruction set and CPUs that support SSSE3.

Verify CPU Support

You can use the Linux command line to get information about the CPU hardware. For example, the /proc/cpuinfo file contains details about individual CPU cores. Output its contents with less or cat.

You can look at the flags section for the following values:

• vmx—Intel VT extensions

• svm—AMD-V extensions

• ssse3—SSSE3 extensions

Use grep to quickly see if any of these values exist in the file by running the following command:

egrep “vmx|svm|ssse3” /proc/cpuinfo

If your system supports VT or SSSE3, then you should see vmx, svm, or ssse3 in the list of flags. The following example shows output from a system with two CPUs:

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov patpse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitords_cpl vmx est tm2 ssse3 cx16 xtpr lahf_lmflags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov patpse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitords_cpl vmx est tm2 ssse3 cx16 xtpr lahf_lm

Performance Tiers for FTDv Smart Licensing

The FTDv supports performance-tiered licensing that provides different throughput levels and VPN connection limits based on deployment requirements.

See the "Licensing the Firepower System" chapter in the Firepower Management Center Configuration for guidelines when licensing your FTDv device.

Management Mode

• You have two options to manage your Firepower Threat Defense device:

  • The Firepower Device Manager (FDM) onboard integrated manager.

    Note	The FTDv on VMware supports Firepower Device Manager starting with Cisco Firepower software version 6.2.2 and later. Any FTDv on VMware running Firepower software earlier than version 6.2.2 can only be managed using the Firepower Management Center; see How to Manage Your Firepower Device

  • The Firepower Management Center (FMC)

• You must install a new image (version 6.2.2 or greater) to get Firepower Device Manager support. You cannot upgrade an existing FTDv virtual machine from an older version (earlier than 6.2.2) and then switch to Firepower Device Manager.

• Firepower Device Manager (local manager) is enabled by default.

  Note	When you choose Yes for Enable Local Manager, the Firewall Mode is changed to routed. This is the only supported mode when using Firepower Device Manager.

OVF File Guidelines

Cisco_Firepower_Threat_Defense_Virtual-VI-X.X.X-xxx.ovfCisco_Firepower_Threat_Defense_Virtual-ESXi-X.X.X-xxx.ovf

where X.X.X-xxx is the version and build number of the file you want to use.

• If you deploy with a VI OVF template, the installation process allows you to perform the entire initial setup forFTDv appliance. You can specify:

  See Also

  Cómo crear una empresa o montar un negocio paso a paso [2021]

  • A new password for the admin account.

  • Network settings that allow the appliance to communicate on your management network.

  • Management, either local management using Firepower Device Manager (default) or remote management using the Firepower Management Center.

  • Firewall Mode. When you choose Yes for Enable Local Manager, the Firewall Mode is changed to routed. This is the only supported mode when using Firepower Device Manager.

    Note	You must manage this virtual appliance using VMware vCenter.

• If you deploy using an ESXi OVF template, you must configure Firepower System-required settings after installation. You manage this FTDv as a standalone appliance on ESXi; see Deploy the Firepower Threat Defense Virtual to a vSphere ESXi Host for more information.

Unable to Save Virtual Machine (VM) Configuration in vSphere 7.0.2

If you are using vSphere 7.0.2, you may not be allowed to save the VM configuration.

Note	You can resolve this issue by following the instructions in VMware knowledge base article: https://kb.vmware.com/s/article/83898.

vMotion Support

We recommend that you only use shared storage if you plan to use vMotion. During deployment, if you have a host cluster you can either provision storage locally (on a specific host) or on a shared host. However, if you try to vMotion the Firepower Management Center Virtual to another host, using local storage will produce an error.

Hyperthreading Not Recommended

Hyperthreading technology allows a single physical processor core to behave like two logical processors. We recommend that you disable hyperthreading for your systems that run the FTDv. The Snort process already maximizes the processing resources in a CPU core. When you attempt to push two CPU utilization threads through each processor you do not receive any improvement in performance. You may actually see a decrease in performance because of the overhead required for the hyperthreading process.

INIT Respawning Error Messages Symptom

You may see the following error message on the FTDv console running on ESXi 6 and ESXi 6.5:

"INIT: Id "ftdv" respawning too fast: disabled for 5 minutes"

Workaround—Edit the virtual machine settings in vSphere to add a serial port while the device is powered off.

1. Right-click the virtual machine and select Edit Settings.

2. On the Virtual Hardware tab, select Serial port from the New device drop-down menu, and click Add.

   The serial port appears at the bottom of the virtual device list.

3. On the Virtual Hardware tab, expand Serial port, and select connection type Use physical serial port.

4. Uncheck the Connect at power on checkbox.

   Click OK to save settings.

Exclude Virtual Machines from Firewall Protection

In a vSphere enviroment where the vCenter Server is integrated with VMware NSX Manager, a Distributed Firewall (DFW) runs in the kernel as a VIB package on all the ESXi host clusters that are prepared for NSX. Host preparation automatically activates DFW on the ESXi host clusters.

The FTDv uses promiscuous mode to operate, and the performance of virtual machines that require promiscuous mode may be adversely affected if these virtual machines are protected by a distributed firewall. VMware recommends that you exclude virtual machines that require promiscuous mode from distributed firewall protection.

1. Navigate to Exclusion List settings.

   • In NSX 6.4.1 and later, navigate to .

   • In NSX 6.4.0, navigate to .

2. Click Add.

3. Move the VMs that you want to exclude to Selected Objects.

4. Click OK.

If a virtual machine has multiple vNICs, all of them are excluded from protection. If you add vNICs to a virtual machine after it has been added to the Exclusion List, Firewall is automatically deployed on the newly added vNICs. To exclude the new vNICs from firewall protection, you must remove the virtual machine from the Exclusion List and then add it back to the Exclusion List. An alternative workaround is to power cycle (power off and then power on) the virtual machine, but the first option is less disruptive.

Modify the Security Policy Settings for a vSphere Standard Switch

For a vSphere standard switch, the three elements of the Layer 2 Security policy are promiscuous mode, MAC address changes, and forged transmits. Firepower Threat Defense Virtual uses promiscuous mode to operate, and Firepower Threat Defense Virtual high availability depends on switching the MAC address between the active and the standby to operate correctly.

The default settings will block correct operation of Firepower Threat Defense Virtual. See the following required settings: