Creating an MVE with Cisco Secure Firewall Threat Defense Virtual
This topic describes how to create and configure a Megaport Virtual Edge (MVE) with Cisco Secure Firewall Threat Defense Virtual.
Before you begin, you need user accounts with ordering permissions that provide access to the Megaport Portal. You also need a Cisco Smart account for licensing.
For details on setting up a Megaport account, see Creating an Account.
Tip
Cisco provides documentation in the Cisco Secure Firewall Threat Defense Virtual Getting Started Guide.
Basic steps
This section summarizes the configuration steps using the Megaport Portal. Detailed procedures follow this basic step summary.
The basic steps are:
- Obtain an FMC Registration Key and FMC IP address from Cisco.
- Enter the MVE details.
- Create the Cisco MVE in the Megaport Portal.
Licensing
Before you create an MVE in the Megaport Portal, you need a valid FMC Registration Key from Cisco. You can place the order for your FMC Registration Key in the Cisco Portal.
Creating an MVE in the Megaport Portal
Before you create an MVE, you need to determine the best location - one that supports MVE and one that is in the most compatible metro area. You can connect multiple locations to an individual MVE. For more information about location details, see Planning Your Deployment.
You can deploy multiple MVEs within the same metropolitan area for redundancy or capacity reasons. As part of the MVE creation process, you will also create a Megaport Internet connection.
To create an MVE
- In the Megaport Portal, go to the Services page.
-
Click Create MVE.
-
Select the MVE location.
Select a location geographically close to your target branch and/or on-premises locations.
The country you choose must be a market in which you have already registered.
If you haven’t registered a billing market in the location where you will deploy the MVE, follow the procedure in Enabling Billing Markets.
To search for your local market in the list, enter a country in the Country Filter or a metro region detail in the Search filter.
-
Select a diversity zone.
You can select either Red or Blue, or select Auto and have Megaport select the zone for you. The selected or allocated diversity zone will be displayed on the location details through the rest of the provisioning, and on the summary page at the end.
For more information, see MVE Diversity. -
Click Next.
-
Select Cisco Secure Firewall Threat Defense Virtual.
-
Specify the MVE details:
-
Version – Select the software version. The MVE will be configured to be compatible with that version of Cisco Secure Firewall Threat Defense Virtual.
-
MVE Name – Enter a name for the MVE that is easily identifiable, particularly if you plan on provisioning more than one. This name appears in the Megaport Portal.
-
Size – Select a size from the drop-down list. The list displays all sizes that match the CPU capacity at the selected location. The sizes support varying numbers of concurrent connections, and individual partner product metrics vary slightly. For more information, see Planning Your Deployment.
Note
If the MVE size you want is not in the list, then there is not enough capacity at the selected location. You can either select another location with enough capacity or contact your Account Manager to discuss requirements.
-
Service Level Reference (optional) – Specify a unique identifying number for the MVE to be used for billing purposes, such as a cost center number or a unique customer ID. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.
-
Admin Password – Specify a plain text password for administrator access. Prohibited characters are ” CR LF.
-
Manage Locally – Select the check box to manage the MVE connection locally. Leave clear to make the MVE connect to the Firewall Management Center (FMC).
-
FMC IP Address – The IP address of the FMC. Required when Manage Locally is not selected. You can provide input in the following formats:
- IPv4 address
- IPv6 address
- domain name
-
FMC Registration Key – This is required when Manage Locally is not selected and FMC IP address is provided.
-
NAT ID (optional) – Add an alphanumeric string that is used during the registration process between the FMC and the device. Used when Manage Locally is not selected.
For more information, see Cisco Secure Firewall Threat Defense Virtual Configuration Guide. -
Virtual Interfaces (vNICs) – Each MVE for Cisco Secure Firewall Threat Defense Virtual is configured with four vNICs by default. The vNICS are:
0: Management
1: Diagnostic
2: Data1
3: Data2An MVE can have a total of five vNICs, including those added by default. For more information, see Types of vNIC Connections.
To add a vNIC:
-
Click + Add.
-
Enter a name for the vNIC.
Note
If you want to increase or decrease the number of vNICs on this MVE after it has been deployed, you will have to delete the entire MVE and recreate it. You can’t add or delete vNICs on a deployed MVE.
-
-
Megaport Marketplace Visibility – By default, each service is private to your enterprise and consumes services from the Megaport network for your own internal company, team, and resources. When set to private, the service is not searchable in the Megaport Marketplace, however, others can still connect to you using a service key. Megaport Marketplace visibility is controlled on your Megaport Marketplace profile. For more information about how to make your service visible to the Megaport Marketplace, see Adding services to your profile.
-
Minimum Term – Select No Minimum Term, 12 Months, 24 Months, or 36 Months. Longer terms result in a lower monthly rate. 12 Months is selected by default. For more information, see MVE Pricing and Contract Terms.
Note
Partner and partner-managed accounts select MVE subscriptions instead of MVE contract terms.
-
-
Click Next to view the Summary page.
The monthly rate is based on location and size. -
Confirm the configuration and pricing then click Add MVE.
You are prompted to create a Megaport Internet connection. A Megaport Internet connection provides connectivity and allows MVE to register and communicate with Cisco Secure Firewall Threat Defense Virtual SD-WAN.
To create the Megaport Internet connection
-
Click Create Megaport Internet to proceed (recommended), or click Not now to provision internet access at a later time.
Note
MVE requires connectivity to the internet onto the management plane virtual interface. You can either provision a Megaport Internet connection or configure a third-party internet connection using a private VXC. We strongly recommend that you create a Megaport Internet connection for the initial MVE startup and deployment to ensure that the MVE is provisioned and functioning correctly.
-
Select the target Port (the internet router).
The B-End of a Megaport Internet connection can be anywhere that Megaport Internet is available.
You can filter by diversity zone, or select to view all. -
Click Next.
-
Specify the connection details:
-
Connection Name – The name of your Megaport Internet connection to be shown in the Megaport Portal.
-
Service Level Reference (optional) – Specify a unique identifying number for the Megaport Internet connection to be used for billing purposes, such as a cost center number or a unique customer ID. The service level reference number appears for each service under the Product section of the invoice.
Tip
Use the same Service Level Reference numbers for the Megaport Internet connection and MVE to help identify the matching pair in your invoice.
-
Rate Limit – The speed of your connection in Mbps. The speed is adjustable from 20 Mbps to 10 Gbps in increments of 1 Mbps. You can change the speed as needed after you create the Megaport Internet connection. Monthly billing details appear based on location and rate limit.
-
VXC State – Select Enabled or Shut Down to define the initial state of the connection. For more information, see Shutting Down a VXC for Failover Testing.
Note
If you select Shut Down, traffic will not flow through this service and it will behave as if it was down on the Megaport network. Billing for this service will remain active and you will still be charged for this connection.
-
A-End vNIC - Specify a vNIC from the drop-down list. The list shows the vNICs that were created with the MVE.
-
Preferred A-End VLAN (optional) – Specify an unused VLAN ID for this connection. This must be a unique VLAN ID on this MVE and can range from 2 to 4093. If you specify a VLAN ID that is already in use, the system displays the next available VLAN number. The VLAN ID must be unique to proceed with the order. If you don’t specify a value, Megaport will assign one.
Alternatively, you can click Untag. This selection removes the VLAN tagging for this connection and it will be configured without a VLAN ID. -
Minimum Term – Select No Minimum Term, 12 Months, 24 Months, or 36 Months. Longer terms result in a lower monthly rate. 12 Months is selected by default.
Take note of the information on the screen to avoid early termination fees (ETF). For more information, see Megaport Internet Pricing and Contract Terms and VXC, Megaport Internet, and IX Billing.
-
-
Click Next to proceed to the connection detail summary.
-
Click Add VXC to order the connection.
-
Click Order in the Configured Services area.
-
If you have a promotional code, click Add Promo Code, enter it, then click Add Code.
-
Click Order Now.
Ordering MVE provisions the appliance and assigns IP addresses from the Megaport SDN. The MVE provisioning takes only a few minutes to complete. The provisioning process spins up a Cisco Secure Firewall Threat Defense Virtual.
Next steps
Once the MVE is provisioned with an Active status, the next step is to connect a VXC to a CSP, a local port, or a third-party network. You can optionally connect a physical Port to the MVE through a private VXC or connect to a service provider in the Megaport Marketplace.
For more information, see Creating a VXC.