Two receive (Rx) queues and two transmit (Tx) queues must be defined for each data port of Network Security virtual appliances deployed on KVM servers. This enables the Port Mirroring and SSL Decryption Mirroring features. (See the Network Security User Guide for information about these features.)
If you are deploying a new virtual appliance using the bundled XML template, no configuration is needed because two Rx queues and two Tx queues are defined by default in the template. However, configuration is needed in the following cases, because the virtual appliance will come up with only one Rx queue and one Tx queue:
You are upgrading an existing virtual appliance from a release prior to Network Security release 8.3.2.
You are deploying a new virtual appliance using the KVM Virtual Machine Manager UI.
The queues must be manually defined in the XML template that is created for the virtual appliance when it is deployed. This configuration cannot be performed using the KVM Virtual Machine Manager UI.
Shut down the virtual appliance.
Add the following line to each
<interface>section that corresponds to a data port in the XML template for the virtual appliance:<driver name='vhost' queues='2'/>Start the virtual appliance.
The following example configures two Rx queues on a virtual appliance:
<interface type='direct' trustGuestRxFilters='yes'> <mac address='xx' /> <source dev='ensXX' mode='passthrough'/> <model type='virtio' /> <driver name='vhost' queues='2'/> </interface>