: Deploy the VM-Series Firewall
Focus
Focus

Deploy the VM-Series Firewall

Table of Contents

Deploy the VM-Series Firewall

Learn how to deploy the VM-Series firewall on VMware NSX-T.
After completing the configuration on Panorama, perform the following procedure to launch the VM-Series firewall in your NSX-T Data Center.
When deploying the VM-Series firewall on NSX-T in high availability, both firewalls are deployed to the same Device Group and Template Stack.
  1. Log in to NSX-T Manager.
  2. Select
    Advanced Networking & Security
    Partner Services
    Catalog
    .
  3. Select the
    Registered Service
    that matches the service definition to be deployed.
  4. Select the VM-Series firewall image from the drop-down in the Registered Service entry.
  5. Click
    Deploy
    under the registered service for the service definition you want to use to launch the firewall.
  6. Click
    Proceed
    .
  7. Enter the Partner Service details. This information tells NSX-T Manager which Partner Service and logical router to use when deploying the VM-Series firewall.
    1. Enter a descriptive
      Instance Name
      for your VM-Series firewall.
    2. NSX-T Manager prepopulates the
      Partner Service
      field. Selecting a Partner Service populates the
      Deployment Specification
      field.
    3. Select the
      Logical Router
      . Select a tier-0 or tier-1 router. NSX-T Manager attaches the VM-Series firewall to the selected router and redirects traffic passing through that router to the VM-Series firewall for inspection. You must select a router with no service insertion attached.
    4. Click
      Next
      .
  8. Configure resource and storage settings.
    1. Select a
      Compute Manager
      . The compute manager is the vCenter server managing your datacenter.
    2. Select a
      Cluster
      . You can deploy the VM-Series firewall on any cluster that does not include any Edge Transport Nodes.
    3. (
      Optional
      ) Select the Resource Pool if you have created any on vCenter server.
    4. Select a
      Datastore
      .
    5. Select the
      Deployment Mode
      for your VM-Series firewall—Standalone or High Availability.
    6. Set the
      Failure Policy
      to Allow or Block. The failure policy defines how NSX-T Manager handles traffic that is directed to the VM-Series firewall if the firewall becomes unavailable.
    7. Enter the
      IP Address
      ,
      Gateway
      ,
      Subnet Mask
      , and
      Network ID
      for the VM-Series firewall management port.
    8. If you are deploying the VM-Series firewall in HA mode, repeat the previous step for secondary firewall instance.
    9. Click
      Next
      .
  9. Click on the
    Deployment Template
    field and select a deployment template. Choosing a deployment template automatically populates the template properties.
    Do not edit the Template Property settings
    .
  10. Click
    Finish
    to deploy the VM-Series firewall.
  11. Access the Panorama web interface to make sure that the VM-Series firewalls are connected and synchronized with Panorama.
    1. Select
      Panorama
      Managed Devices
      Summary
      to verify that the firewalls are connected and synchronized.
      The Device Name for the VM-Series firewall is displayed on Panorama as
      PA-VM:<nsx.clusterid>
      for NSX-T (N-S) deployment and as
      PA-VM:<nsx.servicevmid>
      for NSX-T (E-W) deployment
      If the ESXi server hostname is longer than 32 characters, the hostname will not be displayed in Panorama. Instead, only
      PA-VM
      is displayed.
    2. Click Commit, and select Commit Type as
      Panorama
      .
      A periodic Panorama commit is required to ensure that Panorama saves the device serial numbers to configuration. If you reboot Panorama without committing the changes, the managed devices will not connect back to Panorama; although the Device Group will display the list of devices, the devices will not display in
      Panorama
      Managed Devices
      .
  12. Verify that the capacity license is applied and apply any additional licenses that you have purchased. At a minimum, you must activate the support license on each firewall.
    When Panorama does not have internet access (Offline), you must manually license each firewall, and then add the serial number of the firewall to Panorama so that it is registered as a managed device, and can receive the template stack and device group settings from Panorama. See Activate the License for the VM-Series Firewall for VMware NSX for more information.
    1. Select
      Panorama
      Device Deployment
      Licenses
      to verify that the VM-Series capacity license is applied.
    2. To apply additional licenses on the VM-Series firewalls:
      • Click
        Activate
        on
        Panorama
        Device Deployment
        Licenses
        .
      • Find or filter for the firewall, and in the
        Auth Code
        column, enter the authorization code for the license to activate. Only one authorization code can be entered at a time, for each firewall.
    3. Click
      Activate
      , and verify that the result of the license activation was successful.
  13. Set a secure password for the admin account on your VM-Series firewalls.
    Each VM-Series firewall uses a default username and password (admin/admin), which is used for initial login. Upon logging in for the first time, you are prompted to set a new, more secure password. The new password must be a minimum of eight characters and include a minimum of one lowercase and one uppercase character, as well as one number or special character.
    You can update the password on each firewall individually or all at once through Panorama.
    • Panorama
      —on Panorama, you can change the default password for all firewalls in a template or delete the admin user and create a new username and password.
      1. Log in to Panorama
      2. Select
        Device
        Administrators
        and select the
        admin
        user.
      3. Delete
        the user or click the user and enter a new password.
      4. If you changed the password, click
        OK
        .
      5. Select
        Commit
        Push to Devices
        Edit Selections
        Force Template Values
        .
      6. Click
        OK
        .
    • Firewall
      —this procedure must be repeated on each VM-Series firewall.
      1. Log in to the VM-Series firewall using the default username and password.
      2. Follow the prompts to reset the password.

Recommended For You