Deploy the VM-Series Firewall
Learn how to deploy the VM-Series firewall on VMware NSX-T.
After completing the configuration on Panorama, perform the following procedure to launch the VM-Series firewall in your NSX-T Data Center.
When deploying the VM-Series firewall on NSX-T in high availability, both firewalls are deployed to the same Device Group and Template Stack.
To complete your VM-Series on AVS deployment, there are additional steps required to establish connectivity between Panorama and managed firewalls.
- Log in to NSX-T Manager.
- (VM-Series firewall on Azure VMware Solution only) Create a network overlay segment for the VM-Series firewall.If you are deploying the VM-Series firewall on Azure VMware Solution (AVS), you must create a network overlay segment to allow your deployed firewalls to connect with Panorama. This is required to manage your firewalls from Panorama and push configuration and licenses.
- In NSX-T Manager, selectand clickNetworkingSegmentsAdd Segment.
- Enter a descriptiveNamefor your segment.
- Select the tier-1 router from the drop-down underConnected Gateway & Type.
- Create a subnet for your overlay segment.
- Click.Set SubnetAdd Subnet
- Enter the CIDR for the subnet. The CIDR you enter must be outside the CIDR where NSX-T Manager is located.
- ClickAddand then clickAddto save and close the subnet configuration.
- Select the overlay from theTransport Zonedrop-down.
- ClickSaveto complete the overlay configuration.
- Select.SystemService DeploymentsDeployment
- Select your service definition from thePartner Servicedrop-down.
- ClickDeploy Service.
- Enter a descriptiveService Deployment Namefor your VM-Series firewall.
- Select a tier-0 or tier-1 router underAttachment Points. NSX-T Manager attaches the VM-Series firewall to the selected router and redirects traffic passing through that router to the VM-Series firewall for inspection. You must select a router with no service insertion attached.
- (VM-Series firewall on NSX-T) Select a tier-0 or tier-1 router. NSX-T Manager attaches the VM-Series firewall to the selected router and redirects traffic passing through that router to the VM-Series firewall for inspection. You must select a router with no service insertion attached.
- (VM-Series firewall on Azure VMware Solution only) Select the same tier-1 router you selected for the overlay segment.
- Select aCompute Manager. The compute manager is the vCenter server managing your datacenter.
- Select aCluster. You can deploy the VM-Series firewall on any cluster that does not include any Edge Transport Nodes.
- Select aDatastore.
- Configure your network settings.
- ClickEdit Detailsin theNetworkscolumn.
- Select thePrimary Interface Network.
- Enter thePrimary Interface IP.
- Enter thePrimary Gateway Address.
- Enter thePrimary Subnet Mask.
- ClickSave.(VM-Series firewall on Azure VMware Solution only) When deploying the VM-Series firewall on AVS, the management IP address you enter must be in the same IP range you used when configuring your overlay segment. Additionally, the gateway must be the gateway of the overlay segment you created.
- NSX-T Manager prepopulates theDeployment SpecificationandDeployment Templatebased on the Partner Service you selected.
- Set theFailure Policyto Allow or Block. The failure policy defines how NSX-T Manager handles traffic that is directed to the VM-Series firewall if the firewall becomes unavailable.
- Select theDeployment Modefor your VM-Series firewall—Standalone or High Availability. If you have an edge node cluster and select High Availability, NSX-T Manager will deploy an additional VM-Series firewall on the standby edge node in addition to the firewall deployed on the active edge node.
- ClickSaveto deploy the VM-Series firewall.
- (VM-Series firewall on Azure VMware Solution only) Attach the deployed firewalls to the overlay segment.When deployed in an AVS environment, VM-Series firewalls do not have an assigned network adapter. Therefore, you must manually add an adapter (the overlay segment).
- Log in to your vSphere web client.
- Select your firewall and click the edit settings icon.
- On theVirtual Hardwaretab, clickBrowsein theNetwork Adapter 1drop-down.
- Select the overlay networks segment you created and clickOK.
- ClickOKto close the Edit Settings window.
Recommended For You
Recommended videos not found.