Deployment · Topic 5 of 5

Virtual Appliances and Management Options

Learn where FTD Virtual and FMC Virtual run on premises and in the cloud, and how the manager and the device register with each other using a key.

  • 4 min
In a nutshell
  • FTDv and FMCv are the virtual forms of the firewall and the manager.
  • Supported platforms include VMware, KVM and the main public clouds.
  • FTDv is licensed in performance tiers, and tier names vary by release.

What it is

Secure Firewall can run as a virtual machine, and it can be managed from on premises or from the cloud.

Secure Firewall Threat Defense Virtual (FTDv) is the firewall software in virtual machine form. Secure Firewall Management Center Virtual (FMCv) is the manager in virtual machine form.

You can use virtual appliances in a data centre or in a public cloud. The management choice is separate from the place where the firewall runs.

FTDvin a hypervisor or public cloudregisters withFMCon premises hardware or virtualpushesPolicydeployed to FTDv

How it works

A virtual deployment has a platform, a licence, a management path and a registration step.

Where they run

Virtual appliances run on common hypervisors and on public cloud platforms.

TypeExamples
On premises hypervisorsVMware ESXi, KVM
Public cloudAWS, Microsoft Azure, Google Cloud

Check the release notes for the exact list on each version. Not every platform is offered with every release.

FTDv is licensed by performance tier, such as FTDv10 or FTDv30, and the tier names vary with the release. The tier sets the licensed throughput and guides the virtual CPU and memory you size for.

Management choices

The firewall can be managed in three ways:

  • FMC, hardware or virtual, on premises.
  • Cloud-delivered FMC, which is hosted by Cisco and is now offered under the Security Cloud Control name.
  • Secure Firewall Device Manager (FDM), a local web interface on the device.

FMC and cloud-delivered FMC manage many devices with shared policy. FDM manages the single device it runs on. A device uses one manager at a time.

Registering a device to the FMC

The device is told where its manager is, and the manager is told about the device. A shared registration key proves that they belong together.

> configure manager add 192.0.2.10 MYKEY
Manager successfully configured.
> show managers

In the FMC, you add the device by giving its IP address and the same registration key. If one side cannot be reached by its own address, for example because of NAT, a NAT ID is added on both sides so the two can find each other.

The management channel then forms between the device and the FMC. If only the device has a reachable address, you can enter DONTRESOLVE as the manager address on the device together with a NAT ID.

Management over a data interface

A device normally uses its dedicated management interface. In cloud and branch designs, a device may be managed over a data interface instead.

The configure network management-data-interface command on the device sets this up. It is useful when the device has no separate management network, as in some cloud deployments.

Day zero configuration in the cloud

Cloud virtual machines are often given a bootstrap configuration when they are created. It can supply an admin password, a hostname and the manager address with the registration key.

The device then boots ready to register, without anyone logging in. This suits automated deployment.

Deploy VMfrom cloud imagebootstrap dataFTDvknows manager and keyregistersFMCadds the device

What to remember for the exam

Seven facts cover the usual questions.

  • FTDv and FMCv are the virtual forms of the firewall and the manager.
  • Supported platforms include VMware, KVM and the main public clouds.
  • FTDv is licensed in performance tiers, and tier names vary by release.
  • A device registers to the FMC with a registration key.
  • A NAT ID is used when one side cannot be reached by its address, such as behind NAT.
  • configure manager add on the device sets the manager, and show managers checks it.
  • Management can be on premises with FMC, in the cloud with cloud-delivered FMC, or local with FDM.
Exam tip

The registration key must be the same on the device and in the FMC. A key mismatch is a common reason for failed registration.

Common mistakes

These four mistakes are common when you work with virtual appliances.

Forgetting NAT ID. If NAT hides the address of one side, registration needs a NAT ID on both sides.

Assuming every platform is supported. The list changes with each release, so check before you plan.

Managing a device from two managers. A device has one manager at a time.

Choosing a tier by price only. The tier limits throughput, so size it for the traffic you expect.

Watch out

Management traffic must be able to reach the other side before registration can finish. Check routing and any filtering on the path first.

Check yourself

Work through these three questions.

  • What do the device and the FMC need to share to register?

    They share a registration key, and a NAT ID is added on both sides when NAT hides the address of one side.

  • Which command on the device sets the manager address?

    configure manager add, followed by the manager address and registration key.

  • Which management options can a virtual FTD use?

    It can be managed by the on premises FMC or cloud-delivered FMC, or locally with Secure Firewall Device Manager.

Topic 5 of 5 in Deployment

Test yourself on Deployment

The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.