Specify or select values for the following parameters:
a. Enter a name for the Firefly Host VM.
b. Select the Firefly Host VM security management interface addressing mode. The Firefly Host Dashboard communicates with the Firefly Host VM management interface based on this addressing mode. This interface must be reachable by the management interface of the Firefly Host Dashboard.
Firefly Host supports both IPv4 and IPv6 address types. As such, the Installation Wizard for Firefly Host VMs allows you to enter information for both types.
Select values for:
• IPv4
• DHCP (Default): To obtain an IPv4 address, by default the Firefly Host VM is configured to use DHCP. You do not need to specify additional information.
• Static IP. If you select Static IP, you must specify a static IPv4 address and its network mask routing prefix, and the default gateway to assign to the Firefly Host VM.
• IPv6
• DHCPv6 ( Default): To obtain an IPv6 address, by default the Firefly Host VM is configured to use DHCPv6. You do not need to specify additional information.
• Autoconfiguration. If you select Autoconfiguration, stateless address
autoconfiguration is used to obtain the IPv6 address. It allows network devices attached to an IPv6 network to automatically acquire IP addresses and connect to the Internet without intermediate interaction with a DHCPv6 server.
• Static IP. If you select Static IP, you must specify a static IPv6 address, including the IPv6 address prefix (the initial bits of the address that denote the network address, akin to a netmask), and the default gateway to use for it.
By default, a dual stack Firefly Host Dashboard communicates with a Firefly Host VM using the IPv4 protocol. However, you can use the Firefly Host CLI to change the default IP protocol used by setting the
center.dual.stack.default.communication.ipv4 parameter to false.
center.dual.stack.default.communication.ipv4=false
By default, this parameter is set to true. This parameter is relevant only if the Firefly Host Dashboard is configured for dual stack and one or more Firefly Host VMs is also configured for dual stack. In all other cases, the protocol used is the one that is common to both the Firefly Host Dashboard and the Firefly Host VM, and this parameter is irrelevant.
You can configure the Firefly Host VM not to use dual stack in the following way:
• To use only IPv4 for Firefly Host Dashboard management communication with this Firefly Host VM, disable IPv6. On the displayed list for the IPv6: box, select Disabled.
• To use only IPv6 for Firefly Host Dashboard management communication with this Firefly Host VM, disable IPv4. On the displayed list for the IPv4: box, select Disabled.
How you configure addressing for the Firefly Host VM affects its communication with the Firefly Host Dashboard management center. In an environment in which neither the Firefly Host Dashboard nor the Firefly Host VM is configured for dual stack and the IP address types of their management interfaces are not the same, communication problems will occur. (For example, one interface might have an IPv6 address and the other might have an IPv4 address.) The Firefly Host Dashboard will not be able to connect to the Firefly Host VM to carry out any procedures.
c. Specify the port group to use to connect the Firefly Host VM to the Firefly Host Dashboard.
d. Specify the data store for the Firefly Host VM.
e. Specify if the hypervisor communication console should be monitored and if IDS should be used.
The dialog box allows you to enable console (hypervisor) monitoring or console monitoring and IDS.
• If you enable console monitoring, Firefly Host monitors network traffic to the hypervisor console vNIC to ensure that inappropriate activity is not occurring.
• If you enable both console monitoring and IDS traffic monitoring, network traffic to the hypervisor console is monitored and IDS traffic is mirrored to the IDS engine.
WARNING: To use this option, you must first install an IDS license.
If at this point you do not enable console monitoring and IDS, you can do so later after you install a Firefly Host VM. In that case, you use the Settings module Security Settings > Firefly Host VM Settings Network Monitoring tab and the IDS tab for a particular VM.
f. Click Secure.
After you click Secure, the Firefly Host associates all virtual NICs (vNICs) for the relevant VMs with the Firefly Host module.
VMware requires that the vNICS be disconnected and reconnected through a suspend and resume process. (VMs do not have access to the network during the few seconds that this process takes.) However, you can avoid the suspend and resume process by following the instructions covered in“Disabling the Firefly Host Suspend-Resume Process Enacted After a VM Is Unsecured” on page 74.
After you complete the installation, you might want to refine the configuration pertain to policy in the following ways:
• By default, each vNIC has a restrictive default security policy. You can use the Firewall module’s Manage Policy tab to make the policy less restrictive.
• You can use the Policy per vNIC feature to configure separate firewall policies for individual vNICs on the same VM. For details on the feature, see Understanding the Firefly Host Policy per vNIC Feature and Configuring the Firefly Host Policy per vNIC Feature.
After you define the Firefly Host VM, Firefly Host begins the Firefly Host VM firewall installation on the selected host. It displays a progress report as it completes each task.
If problems occur during the installation process, Firefly Host displays messages describing them.
When the installation process is finished, Firefly Host displays the list of completed tasks and the successful completion notice, as shown inFigure 25 on page 40. Notice that in this case, as reported, it was not necessary to reboot the host.