Verify that you have set up the networking infrastructure for steering traffic
between the guests and the VM-Series firewall and ensure you have connectivity
to an external server or the internet. The VM-Series firewall can connect using
a Linux bridge, the Open vSwitch, PCI pass-through, or SR-IOV capable network
card.
Make sure that the link state for each interface you plan to use is
Up—sometimes you have to manually bring up the interface.
If using a Linux bridge or OVS, verify that you have set up the bridges
required to send or receive traffic to/from the firewall. If not, create
bridges and verify that they are up before you begin installing the
firewall.
If using SR-IOV or PCI-pass-through, verify the PCI ID of all the
interfaces. To view the list, use the following command:
Virsh nodedev-list –tree
If using SR-IOV or PCI-pass-through, verify that the virtualization
extensions (VT-d/IOMMU) are enabled in the BIOS. For example, to enable
IOMMU, intel_iommu=on must be defined in
/etc/grub.conf. Refer to the documentation
provided by your system vendor for instructions.
If using PCI-pass-through, ensure that the VM-Series firewall has
exclusive access to one or more interfaces that you plan to attach to
it.
To allow exclusive access, you must manually detach one or more
interfaces from the Linux server.
Virsh nodedev-detach <pci id of
interface>
For example:
Virsh nodedev-detach pci_0000_07_10_0
In some cases, you might need to edit
/etc/libvirt/qemu.conf and uncomment
relaxed_acs_check = 1.
If using SR-IOV, verify that the virtual function capability is enabled
for each port that you plan to use on the network card. With SR-IOV, a
single Ethernet port (physical function) can be split into multiple
virtual functions. A guest can be mapped to one or more virtual
functions.
Enable virtual functions as follows:
Create a new file in this location:
/etc/modprobe.d/
Use vi to edit the file to make the functions persistent:
vim /etc/modprobe.d/igb.conf
Enable the number of virtual functions required:
options igb max_vfs=4
In the above example, after you save the changes and reboot the
Linux server, each interface (or physical function) will have 4
virtual functions.
Refer to the documentation provided by your network vendor for details on
the actual number of virtual functions supported, and instructions to
enable virtual functions.
