- About ASAv Deployment Using Hyper-V
- Guidelines and Limitations for ASAv and Hyper-V
- Prerequisites for the ASAv and Hyper-V
- Prepare the Day 0 Configuration File
- Deploy the ASAv with the Day 0 Configuration File Using the Hyper-V Manager
- Install the ASAv on Hyper-V Using the Command Line
- Install the ASAv on Hyper-V Using the Hyper-V Manager
- Add a Network Adapter from the Hyper-V Manager
- Modify the Network Adapter Name
- Configure MAC Address Spoofing
- Configuring SSH
Deploy the ASAv Using Hyper-V
You can deploy the ASAv using Microsoft Hyper-V.
- About ASAv Deployment Using Hyper-V
- Guidelines and Limitations for ASAv and Hyper-V
- Prerequisites for the ASAv and Hyper-V
- Prepare the Day 0 Configuration File
- Install the ASAv on Hyper-V Using the Command Line
- Install the ASAv on Hyper-V Using the Hyper-V Manager
- Add a Network Adapter from the Hyper-V Manager
- Modify the Network Adapter Name
- Configure MAC Address Spoofing
- Configuring SSH
About ASAv Deployment Using Hyper-V
You can deploy Hyper-V on a standalone Hyper-V server or through the Hyper-V Manager. For instructions to install using the Powershell CLI commands, see Install the ASAv on Hyper-V Using the Command Line. For instructions to install using the Hyper-V Manager, see Install the ASAv on Hyper-V Using the Hyper-V Manager. Hyper-V does not provide a serial console option. You can manage Hyper-V through SSH or ASDM over the management interface. See Configuring SSH for information to set up SSH.
Figure 1 shows the recommended topology for the ASAv in Routed Firewall Mode. There are three subnets set up in Hyper-V for the ASAv—management, inside, and outside.
Figure 1 Recommended Topology for the ASAv in Routed Firewall Mode
Guidelines and Limitations for ASAv and Hyper-V
–
Hewlett Packard Proliant DL160 Gen8
Note: The ASAv should run on most modern, 64-bit high-powered platforms used for virtualization today.
Supports the VHDX format for initial deployment of the ASAv on Hyper-V.
You create a text file that contains the ASA CLI configuration commands that you need. See Prepare the Day 0 Configuration File for the procedure.
The configuration line ‘firewall transparent’ must be at the top of the day 0 configuration file; if is appears anywhere else in the file, you could experience erratic behavior. See Prepare the Day 0 Configuration File for the procedure.
The ASAv on Hyper-V supports Active/Standby failover. For Active/Standby failover in both routed mode and transparent mode you must enable MAC Address spoofing on ALL virtual network adapters. See Configure MAC Address Spoofing. For transparent mode for the standalone ASAv, the management interface should NOT have MAC address spoofing enabled. Active/Active failover is NOT supported.
- Hyper-V supports up to eight interfaces. Management 0/0 and GigabitEthernet 0/0 through 0/6. You can use GigabitEthernet as a failover link.
- VLANs
Use the Set-VMNetworkAdapterVLan Hyper-V Powershell command to set VLANs on an interface in trunk mode. You can set the NativeVlanID for the management interface as a particular VLAN or ‘0’ for no VLAN. Trunk mode is not persistent across Hyper-V host reboots. You must reconfigure trunk mode after every reboot.
Prerequisites for the ASAv and Hyper-V
You must add the Day 0 configuration before the ASAv is deployed for the first time; otherwise, you must perform a write erase from the ASAv to use the Day 0 configuration. See Prepare the Day 0 Configuration File for the procedure.
http://www.cisco.com/go/asa-software
Note: A Cisco.com login and Cisco service contract are required.
- Hyper-V switch configured with at least three subnets/VLANs.
- For Hyper-V system requirements, see Cisco ASA Compatibility.
Prepare the Day 0 Configuration File
You can prepare a Day 0 configuration file before you launch the ASAv. This file is a text file that contains the ASAv configuration that will be applied when the ASAv is launched. This initial configuration is placed into a text file named “day0-config” in a working directory you chose, and is manipulated into a day0.iso file that is mounted and read on first boot. At the minimum, the Day 0 configuration file must contain commands that will activate the management interface and set up the SSH server for public key authentication, but it can also contain a complete ASA configuration. The day0.iso file (either your custom day0.iso or the default day0.iso) must be available during first boot.
Note: You must add the Day 0 configuration file before you boot the ASAv for the first time. If you decide you want to use a Day 0 configuration after you have initially booted the ASAv, you must execute a write erase command, apply the day 0 configuration file, and then boot the ASAv.
Note: To automatically license the ASAv during initial deployment, place the Smart Licensing Identity (ID) Token that you downloaded from the Cisco Smart Software Manager in a text file named ‘idtoken’ in the same directory as the Day 0 configuration file.
Note: If you want to deploy the ASAv in transparent mode, you must use a known running ASA config file in transparent mode as the Day 0 configuration file. This does not apply to a Day 0 configuration file for a routed firewall.
Note: We are using Linux in this example, but there are similar utilities for Windows.
1. Enter the CLI configuration for the ASAv in a text file called “day0-config”. Add interface configurations for the three interfaces and any other configuration you want.
The fist line should begin with the ASA version. The day0-config should be a valid ASA configuration. The best way to generate the day0-config is to copy the desired parts of a running config from an existing ASA or ASAv. The order of the lines in the day0-config is important and should match the order seen in an existing show run command output.
2. (Optional) Download the Smart License identity token file issued by the Cisco Smart Software Manager to your computer.
3. (Optional) Copy the ID token from the download file and put it a text file that only contains the ID token.
4. (Optional) For automated licensing during initial ASAv deployment, make sure the following information is in the day0-config file:
–Management interface IP address
–(Optional) HTTP proxy to use for Smart Licensing
–A route command that enables connectivity to the HTTP proxy (if specified) or to tools.cisco.com
–A DNS server that resolves tools.cisco.com to an IP address
–Smart Licensing configuration specifying the ASAv license you are requesting
–(Optional) A unique host name to make the ASAv easier to find in CSSM
5. Generate the virtual CD-ROM by converting the text file to an ISO file:
The Identity Token automatically registers the ASAv with the Smart Licensing server.
6. Repeat Steps 1 through 5 to create separate default configuration files with the appropriate IP addresses for each ASAv you want to deploy.
Deploy the ASAv with the Day 0 Configuration File Using the Hyper-V Manager
After you set up the Day 0 configuration file (Prepare the Day 0 Configuration File), you can deploy it using the Hyper-V Manager.
1. Go to Server Manager > Tools > Hyper-V Manager.
2. Click Settings on the right side of the Hyper-V Manager. The Settings dialog box opens. Under Hardware on the left, click IDE Controller 1.
3. Under Media in the right pane, select the Image file radio button, and then browse to the directory where you keep your Day 0 ISO configuration file, and then click Apply. When you boot up your ASAv for the first time, it will be configured based on what is in the Day 0 configuration file.
Install the ASAv on Hyper-V Using the Command Line
You can install the ASAv on Hyper-V through the Windows Powershell command line. If you are on a standalone Hyper-V server, you must use the command line to install Hyper-V.
3. Depending on your ASAv model, change the CPU count from the default of 1.
4. (Optional) Change the interface name to something that makes sense to you.
5. (Optional) Change the VLAN ID if your network requires it.
6. Refresh the interface so that Hyper-V picks up the changes.
Install the ASAv on Hyper-V Using the Hyper-V Manager
You can use the Hyper-V Manager to install the ASAv on Hyper-V.
1. Go to Server Manager > Tools > Hyper-V Manager.
2. The Hyper-V Manager appears.
3. From the list of hypervisors on the right, right-click the desired Hypervisor in the list and choose New > Virtual Machine.
4. The New Virtual Machine Wizard appears.
5. Working through the wizard, specify the following information:
–Name and location of your ASAv
The only Generation supported for the ASAv is Generation 1.
–Amount of memory for your ASAv (1024 MB for ASAv5, 2048 MB for ASAv 10, 8192 MB for ASAv30)
–Network adapter (connect to the virtual switch you have already set up)
–Virtual hard disk and location
Choose Use an existing virtual hard disk and browse to the location of your VHDX file.
6. Click Finish and a dialog box appears showing your ASAv configuration.
7. If your ASAv has four vCPUs, you must modify the vCPU value before starting up your ASAv. Click Settings on the right side of the Hyper-V Manager. The Settings dialog box opens. Under the Hardware menu on the left, click Processor to get to the Processor pane. Change the Number of virtual processors to 4.
The ASAv5 and ASAv10 have one vCPU, and the ASAv 30 have four vCPUs. The default is 1.
8. In the Virtual Machines menu, connect to your ASAv by right-clicking on the name of the ASAv in the list and clicking Connect. The console opens with the stopped ASAv.
9. In the Virtual Machine Connection console window, click the turquoise Start button to start the ASAv.
10. The boot progress of the ASAv is shown in the console.
Add a Network Adapter from the Hyper-V Manager
A newly deployed ASAv has only one network adapter. You need to add at least two more network adapters. In this example, we are adding the inside network adapter.
1. Click Settings on the right side of the Hyper-V Manager. The Settings dialog box opens. Under the Hardware menu on the left, click Add Hardware, and then click Network Adapter.
Note: Do NOT use the Legacy Network Adapter.
2. After the network adapter has been added, you can modify the virtual switch and other features. You can also set the VLAN ID here if needed.
Modify the Network Adapter Name
In Hyper-V, a generic network interface name is used, ‘Network Adapter.’ This can be confusing if the network interfaces all have the same name. You cannot modify the name using the Hyper-V Manager. You must modify it using the Windows Powershell commands.
Configure MAC Address Spoofing
For the ASAv to pass packets in transparent mode and for HA Active/Standby failover, you must turn on MAC address spoofing for ALL interfaces. You can do this in the Hyper-V Manager or using Powershell commands.
1. Click Settings on the right side of the Hyper-V Manager. The Settings dialog box opens. Under the Hardware menu on the left, click Inside, expand the menu, and then click Advanced Features to get to the MAC address option. Click the Enable MAC address spoofing radio button.
2. Repeat Step 1 for the outside interface.
Configuring SSH
You can configure the ASAv for SSH access over the management interface from the Virtual Machine Connection in the Hyper-V Manager. If you are using a Day 0 configuration file, you can add SSH access to it. See Prepare the Day 0 Configuration File for more information.
1. Verify that the RSA key pair is present:
2. If there is no RSA key pair, generate the RSA key pair:
3. Verify that you can access the ASAv using SSH from another PC.
Feedback