Deploy the VM-Series Firewall
Learn how to deploy the VM-Series firewall on VMware
NSX-T.
After completing the configuration on Panorama,
perform the following procedure to launch the VM-Series firewall
in your NSX-T Data Center.
When deploying the VM-Series firewall
on NSX-T in high availability, both firewalls are deployed to the
same Device Group and Template Stack.
- Log in to NSX-T Manager.
- Select.Advanced Networking & SecurityPartner ServicesCatalog
- Select theRegistered Servicethat matches the service definition to be deployed.
- Select the VM-Series firewall image from the drop-down in the Registered Service entry.
- ClickDeployunder the registered service for the service definition you want to use to launch the firewall.
- ClickProceed.
- Enter the Partner Service details. This information tells NSX-T Manager which Partner Service and logical router to use when deploying the VM-Series firewall.
- Enter a descriptiveInstance Namefor your VM-Series firewall.
- NSX-T Manager prepopulates thePartner Servicefield. Selecting a Partner Service populates theDeployment Specificationfield.
- Select theLogical Router. Select a tier-0 or tier-1 router. NSX-T Manager attaches the VM-Series firewall to the selected router and redirects traffic passing through that router to the VM-Series firewall for inspection. You must select a router with no service insertion attached.
- ClickNext.
- Configure resource and storage settings.
- Select aCompute Manager. The compute manager is the vCenter server managing your datacenter.
- Select aCluster. You can deploy the VM-Series firewall on any cluster that does not include any Edge Transport Nodes.
- (Optional) Select the Resource Pool if you have created any on vCenter server.
- Select aDatastore.
- Select theDeployment Modefor your VM-Series firewall—Standalone or High Availability.
- Set theFailure Policyto Allow or Block. The failure policy defines how NSX-T Manager handles traffic that is directed to the VM-Series firewall if the firewall becomes unavailable.
- Enter theIP Address,Gateway,Subnet Mask, andNetwork IDfor the VM-Series firewall management port.
- If you are deploying the VM-Series firewall in HA mode, repeat the previous step for secondary firewall instance.
- ClickNext.
- Click on theDeployment Templatefield and select a deployment template. Choosing a deployment template automatically populates the template properties.Do not edit the Template Property settings.
- ClickFinishto deploy the VM-Series firewall.
- Access the Panorama web interface to make sure that the VM-Series firewalls are connected and synchronized with Panorama.
- Selectto verify that the firewalls are connected and synchronized.PanoramaManaged DevicesIf the firewall gets its IP address from an IP Pool, theDisplay Namefor the firewall includes the hostname of the ESXi server on which it is deployed, for example PA-VM:ESX1.Sydney. If the firewall gets a DHCP assigned IP address, the hostname of the ESXi server does not display.If the ESXi server hostname is longer than 32 characters, the hostname will not be displayed in Panorama. Instead, onlyPA-VMis displayed.
- Click Commit, and select Commit Type asPanorama.A periodic Panorama commit is required to ensure that Panorama saves the device serial numbers to configuration. If you reboot Panorama without committing the changes, the managed devices will not connect back to Panorama; although the Device Group will display the list of devices, the devices will not display in.PanoramaManaged Devices
- Verify that the capacity license is applied and apply any additional licenses that you have purchased. At a minimum, you must activate the support license on each firewall.When Panorama does not have internet access (Offline), you must manually license each firewall, and then add the serial number of the firewall to Panorama so that it is registered as a managed device, and can receive the template stack and device group settings from Panorama. See Activate the License for the VM-Series Firewall for VMware NSX for more information.
- Selectto verify that the VM-Series capacity license is applied.PanoramaDevice DeploymentLicenses
- To apply additional licenses on the VM-Series firewalls:
- ClickActivateon.PanoramaDevice DeploymentLicenses
- Find or filter for the firewall, and in theAuth Codecolumn, enter the authorization code for the license to activate. Only one authorization code can be entered at a time, for each firewall.
- ClickActivate, and verify that the result of the license activation was successful.
Recommended For You
Recommended Videos
Recommended videos not found.