Installing a virtual Network Security appliance using the KVM UI

This section describes how to install a virtual Network Security appliance on a KVM server using the KVM Virtual Machine Manager UI.

Important

This procedure uses KVM version libvert 4.5 on Ubuntu 18.04. The navigation instructions and user interface may vary if you are using CentOS or a different version of Ubuntu.

Note

This procedure covers the required settings for a Trellix virtual appliance. You can accept the default values for the other settings, or specify values that are appropriate for your setup.

Before starting the virtual appliance installation, ensure you have the required prerequisite software installed. See KVM requirements .

In the following procedure, you will create the virtual appliance and configure its management, OOB, and data ports.

Important

A virtual Network Security appliance supports ten NICs: one management interface, one out-of-band interface, and eight monitoring (data) interfaces. You must provision a NIC for each interface. This is because KVM needs to know the total number of interfaces, even if some of those interfaces are not used.

To install a virtual appliance using the KVM Virtual Machine Manager UI:

Screen	Action
Step 1 of 4	Select Import existing disk image. Click Forward.
Step 2 of 4	Browse to and select the folder to which you extracted the `.zip` file in the first step. Select the `.qcow2` file, such as `image-wmps-fireeyenx4500v.qcow2`, and click Choose Volume. Select OS type Linux and in Version select your version of CentOS or Ubuntu. Click Forward.
Step 3 of 4	Set Memory and CPU settings to the values for your virtual Network Security model. The base platform must have the required amount of disk space, memory, and CPU cores to support the specific virtual Network Security model. For example, for model NX 4500V, enter 32GB (32768MB) for Memory (RAM) and 8 for CPUs. Click Forward.
Step 4 of 4	Enter a name, such as `Fireeye-NX-4500V`. Click Customize configuration before install and select Network selection `Bridge br0`. This software bridge is the management (ether1) connection to the virtual Network Security appliance. The bridge must already exist in the host OS, as described in KVM Requirements. Click Finish. The KVM installation page opens.

Tab	Action
Overview	Enter a domain name, such as `Fireeye-NX-4500V`, for the virtual Network Security appliance in Name and optionally enter a Title and Description. Click Apply.
VirtIO Disk 1	Click Advanced options. Select `SCSI` in the Disk bus field. Click Apply.

Tab	Action
Controller	InType, select SCSI. In Model, select VirtIO SCSI. Click Finish.
Network (for OOB)	Add the OOB (ether2) port for the virtual Network Security appliance. In Network source, to use the management bridge that you created in the Create a new virtual machine wizard, select the existing software bridge, such as `br0`. Otherwise, you can select another software bridge that is associated with a non-management physical interface, such as `br1`. If the base OS has an equivalent NIC that corresponds to the virtual Network Security appliance NIC, associate them accordingly. Otherwise, use the Dummy software bridge. In Device mode, select `virtio`. Click Finish.
Network (for data ports)	Repeat the following steps to configure each of the data ports required for your virtual Network Security appliance. In Network source, if the base OS has an equivalent NIC that matches the virtual Network Security appliance NIC, associate them accordingly. IMPORTANT: Set the network source to `macvtap` and set the source mode to `Passthrough`. If the base OS does not have an equivalent NIC, use the Dummy software bridge. Click Finish.

Download the Network Security KVM deployment .zip file from the Trellix DTI network to a KVM server and extract the files within it. The .zip file name is based on your appliance model. For example, the .zip file for NX 4500 is image-wmps-fireeyenx4500v.zip.
In KVM Virtual Machine Manager, select File > New Virtual Machine.
Complete the Create a new virtual machine screens:
In the KVM installation page, configure the basic information and disk IO for the virtual Network Security appliance:
In the KVM installation page, add the virtual hardware for the controller and networks:
1. At the bottom left of the KVM installation page, click Add Hardware.
2. In the Add New Virtual Hardware page, select the tab for the type of hardware to add and enter the values according to the following table.
  You must click Finish after adding each hardware entry and click Add Hardware again to select the next type of hardware to add.
After adding the data ports, click Begin installation.
Check the console for the virtual Network Security appliance boot status.
Continue with Performing the initial Network Security configuration for the virtual appliance.