Deploy the Trellix DLP Network Monitor appliance in Nutanix environment

You can manually deploy the Trellix DLP Network Monitor virtual appliance in Nutanix environment.

Tip
Creating a cluster of Trellix DLP Network Monitor appliances is not supported on the Nutanix platform.

These steps are applicable to Nutanix AVH version 6.5.

Download the Trellix-MS-<version_number>.iso file and save the file on your local system.

You can use these steps to create a Standard VM. Use the same steps with appropriate VM size to create other types of VM.

Log in to the Nutanix Prism Central web console with administrator privileges.
Add an appliance image file.
1. Go to Main Menu → Images and click Add Image. Click + Add File and browse to select the .iso file downloaded on your system.
2. In the Image Source section, Image file and Type (ISO) are selected by default. Add the image source with these default options and click Next.
3. In the Select Location section, the Placement Method is selected as Place image directly on clusters, by default. Proceed with these default options and click Save.
After the import of image file is successful, the newly created appliance image is shown in the list of images.

Create a Virtual Machine for deploying the appliance.

Use these recommended values to configure the CPU, memory, and disks as needed to create an appliance:

	CPU	Memory	Disk1 in GB	Disk2 in GB	Disk3 in GB	Disk4 in GB
Standard VM	4	32	10	300	4	—
Standard VM - Capture	4	32	10	300	4	4000
Small VM*	1	4	10	150	4	—
Small VM - Capture*	1	4	10	150	4	500
Large VM	16	64	10	300	4	—
Large VM - Capture	16	64	10	300	4	8000

Note
* Use the Small VM and Small VM - Capture options only for evaluation purpose.

Go to Main Menu → VMs and click Create VM.
Configuration — To configure the VM, enter a name for the virtual machine. In the VM Properties, enter the values for CPU and Memory as needed. Click Next.
Resources — Add all needed disks, CD ROM, and attach the appliance to the subnet. For example, to create a Standard VM appliance, attach 3 disks (10 GB, 300 GB, 4 GB) using the Attach Disk option in the same order.
Click Attach Disk and select the Type as Disk, Operation as Allocate on Storage Container, and the Bus Type as SCSI. Click Save.
To use the capture feature, add the fourth disk of size 4000 GB.
To create a CD-ROM, click Attach Disk again. Select the Type as CD-ROM, Operation as Clone from Image, and select the image that was added as an image in Step 2. Click Save.
Click Attach to Subnet and select the switch in Subnet and click Save to create the network interfaces. Trellix DLP Network Monitor requires three network interfaces to function as required. In this step, you can create two network interfaces to connect the appliance to the configured switch in your network. These network details are required while updating the Setup Wizard.
The first interface is the network interface and the second interface is the Out of Band (OOB), which is the management interface.
The third network interface is the Capture interface. Create the third network before turning on the appliance. To create the third network interface, follow one of these steps:
- If Nutanix FLOW/Network Manager is disabled, follow Step 4 mentioned below to create the third network. As a prerequisite, create and configure a network function provider using the Nutanix REST API before creating the virtual appliance. This helps to provide the service chain required to redirect all network traffic from a virtual switch to the appliance. For information about creating the network function provider, see 000014057.
- If Nutanix FLOW/Network Manager is enabled follow steps in the article 000015385 to create and configure the capture port.
Select the boot Configuration as Legacy BIOS Mode and click Next.
Management — In Categories, select the network function provider that you have created and click Next.
Review — Verify the appliance configuration details and click Create VM.

Before turning on the appliance create the third network interface explicitly, kNetworkFunction NIC from the Nutanix acli (command line interface).
1. Log in to the Nutanix cluster Controller Virtual Machine (Controller VM) using the ADMIN credentials:
  $ ssh admin@<system IP>
2. Open the Nutanix command line interface:
  $ acli
3. Create a kTap network function nic interface explicitly using:
  <acropolis> vm.nic_create <appliance name> type=kNetworkFunctionNic network_function_nic_type=kTap
  Make sure that all three networks are available using the command:
  <acropolis> vm.nic_get <appliance name>
Note
After adding the NIC of type kTap interface, appliance configuration can't be modified from the Nutanix user interface. Any changes to appliance VM can only be made from the acli console.
Click the deployed virtual machine, and then click More → Power on to turn on the appliance and choose to boot from virtual CD.
Click Launch Console.
The virtual appliance console opens and you can continue with the installation of the appliance. For more information about installing the appliance software, see Install the appliance software in Nutanix environment.