topic Re: vFMC on HyperV. Are we there yet? in Network Security

vFMC on HyperV. Are we there yet?

itsupport — Tue, 12 Mar 2019 14:13:38 GMT

I administer a site with several FTDs, controlled by a vFMC. At the time of installation, around a year ago, I heard rumours from various sources that support for HyperV was "Roadmapped". Since we use HyperV exclusivly as a virtualisation host, I purchased an "Office PC", threw the free version of ESX 6.5 on it, and used that just to host the vFMC. It sits in the rack with the "real" servers. Has worked fine, but is of course just a PC, so no redundant hard drives, fans, enviromental monitoring, out of band management or any of that nice stuff. Plan was to move the vFMC to a HyperV machine once supported, and use the office PC for something else.

I notice now that the vFMC is supported on Azure. Azure basically IS HyperV, with a few extra bells and whistles. Hence, I would guess there is a good chance that the vFMC would run just fine on HyperV. Target I have in mind is a new server we are purchasing, which will be running Server 2019.

Has anyone tried this? Anyone know of any "solid rumours" about HyperV support in the near future?

Re: vFMC on HyperV. Are we there yet?

Francesco Molino — Tue, 15 Jan 2019 05:13:03 GMT

Hi

Unless there's something new I'm not aware of, FMCv isn't supported in Azure neither on Hyper-V.
On Azure, you can have the firewall itself which is managed by FMC but this FMC runs out of Azure.
Here a documentation:
https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/azure/ftdv-azure-qsg.html

FMCv is supported on ESXi, KVM and AWS Cloud.

Re: vFMC on HyperV. Are we there yet?

hoffa2000 — Mon, 11 Feb 2019 08:04:15 GMT

Hi all

FMC support in Azure has been on the top of my Cisco wish list for over a year. Mostly because of architectural reasons, we are moving our datacenters to Azure and in doing so there isn't much investment done into performance for our VMware anymore. For me as security...manager, it's got to the point I cannot expand my FTD/ASA-Firepower platform anymore because of performance issues with our vFMC.

/Fredrik

Re: vFMC on HyperV. Are we there yet?

ajc — Wed, 28 Aug 2019 14:54:28 GMT

Hi everyone,

I am facing the same issue, all our virtualization environment is based on Hyper-V and I need to install a virtual FMC. Is it still not supported?

thanks

Re: vFMC on HyperV. Are we there yet?

Marvin Rhoads — Thu, 29 Aug 2019 04:04:39 GMT

It is still not supported as of FMC 6.4.0.4.

I've been asking for it on behalf of my customers for about 3 years. No joy so far.

Re: vFMC on HyperV. Are we there yet?

Michael Braun — Tue, 11 Feb 2020 23:31:32 GMT

Hi guys, just for everyone to know, since 6.5 (technically 6.4 but with that one i had issues) there is an Azure version and (while its is not officially supported) it runs on Hyper-V. I have it running smooth on a Win10 OS (experimental stage) no issues, just make sure you run 6.5 with a fresh install and latest updates.

Just one more thing, i could not import the config from the VMWare version - it says it is not possible due to version conflict.

Re: vFMC on HyperV. Are we there yet?

Michael Braun — Thu, 13 Feb 2020 18:17:14 GMT

Additional info:

The zipped file is around 2GB, keep in mind, unzipped it is the virtual HD (250GB).

Just make a new VM Gen 1 , add the existing drive - GO

It works with one network card, but you can add more, i tried with 4 and they showed up under configuration.

I gave it 4 virtual CPU's and 16384 MB.

The installation took A VERY LONG TIME, (pretending to do nothing unless you watch drive access, it is doing a lot)

but i did not have the fastest drives available, so your experience my differ.

From what i can tell, after first boot it creates all the database tables and such, so it will take a while in any case.

In the end you should end up at the setup prompt (if you watch the console window)

Funny thing, it seems to run with better performance compared to the VMWare install.

Re: vFMC on HyperV. Are we there yet?

jocke9292 — Thu, 27 Feb 2020 19:15:49 GMT

Crap, we are doing a hyper-v migration and now I don't have high hopes on converting our firepower management center to hyper-v. I'd forgot about this limitation in the firepower VM and just randomly thought that I should google how to do it to be prepared.

Re: vFMC on HyperV. Are we there yet?

cmonterr — Tue, 26 May 2020 03:12:27 GMT

Update as of May 2020,

Talking about virtualization environments, Cisco FMCv is available for Amazon Web Services (AWS), Kernel-based Virtual Machine (KVM), Microsoft Azure, and VMware vSphere environments.

"The FMCv is supported on Microsoft Azure starting with Cisco Firepower software version 6.4 and later"

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fmcv/fpmc-virtual/fpmc-virtual-azure.html

Re: vFMC on HyperV. Are we there yet?

chris.kelly — Mon, 15 Jun 2020 13:24:04 GMT

Found this post whilst trying to migrate our own FMC to Hyper-V. Hopefully it'll help somebody else out as we've just managed to migrate the FMC from a standalone ESXi server into our Hyper-V environment. I doubt this method is officially supported but it works!

- Download and deploy the 6.5.0 FMC for Azure into Hyper-V environment (might want to convert the fixed vhd to a dynamic vhdx while you're at it). Login and set the admin password etc and set it to another IP address for now.

- The existing FMC and the new FMC versions must match for this to work, so either upgrade the existing FMC to 6.5.0 or upgrade the Azure version to whatever version the existing FMC is on. (Why are the FMC upgrades soooo slow.....)

- Once they are on the same version install the latest Vulnerability And Fingerprint Database Updates on both FMCs. These must match for the restore to work.

- Backup the existing FMC via the system>tools menu. You want a Firepower Management backup with both Backup Configuration and Backup Events selected. Download the tar file you created.

- Open the tar file using your favourite compression utility (7zip works fine for this) and edit this file: etc/sf/ims.conf

- Edit the following two lines to match this: MODEL="Cisco Firepower Management Center for Azure" and PRODUCT_ID=FS-AZU-SW-K9 and save the file back to the tar.

- Shutdown the existing FMC.

- In Hyper-V set the MAC address of the new FMC VM to match the MAC address of the old FMC VM. This is to avoid licensing problems post restore.

- Restore the tar file using the restore function in the system>tools menu on the new FMC. Again this will take ages....

Once the restore is complete the FMC will reboot onto the old FMC IP address and function normally. Because of the source of the backup it will report that it is a Cisco Firepower Management Center for VMWare install but this does not seem to have any bearing on the function or updates. I have patched the system up to 6.5.0.4-57 without any issues (haven't tried 6.6 yet as this has taken long enough!).

Hope this helps.

Re: vFMC on HyperV. Are we there yet?

Michael Braun — Mon, 15 Jun 2020 14:40:29 GMT

Nice, although sad that we have to run in circles to accomplish something that Cisco should provide in first place.

Maybe there is a file somewhere on the system where you can change the ID to Azure instead of the "wrong" VMWare idendity.

Not sure if that would cause a license issue???

There may be no errors now, but who knows with the next major update.

Cisco software = Box of chocolate - never know what you are gonna get....

Re: vFMC on HyperV. Are we there yet?

Alexander Proskurnin — Mon, 21 Sep 2020 08:25:58 GMT

Hi, Chris! Thanks for your sharing.

Have you updated version to 6.6? Are you having any issues while using it on HyperV?

Re: vFMC on HyperV. Are we there yet?

Michael Braun — Thu, 15 Oct 2020 16:12:32 GMT

Hi community,

for the sake of updates, I have been running the (Azure) Hyper-V FMC for quite some time now, even updated to latest 6.6.1.

Everything smooth so far, no issues at all.

Re: vFMC on HyperV. Are we there yet?

Barrett Cowan — Thu, 29 Oct 2020 20:14:06 GMT

Although I haven't tried Michael's route on getting it into Hyper-V, I do know ISE can run on Hyper-V and they're built on similar platforms. Also, here's another working option to get FMC in Hyper-V using the KVM version ...

https://www.linkedin.com/pulse/vftd-vfmc-hyper-v-nikolaj-pabst-nielsen/

Re: vFMC on HyperV. Are we there yet?

Aref Alsouqi — Thu, 29 Oct 2020 22:18:47 GMT

The big question is, would Cisco support it if Hyper-V is not officially supported yet?!

Re: vFMC on HyperV. Are we there yet?

DMel — Mon, 29 Mar 2021 17:08:18 GMT

Re: vFMC on HyperV. Are we there yet?

DMel — Mon, 29 Mar 2021 17:08:32 GMT

Do we know if this is Legacy boot or UEFI?

We are about to attempt this from KVM to Hyper-V/Azure with v6.7

Re: vFMC on HyperV. Are we there yet?

chris.kelly — Tue, 30 Mar 2021 08:36:52 GMT

Generation 1 VM under Legacy boot

Re: vFMC on HyperV. Are we there yet?

chris.kelly — Tue, 30 Mar 2021 08:37:27 GMT

Have been running 6.6 for a little while now with no issues at all related to it being in Hyper-V

Re: vFMC on HyperV. Are we there yet?

DMel — Tue, 30 Mar 2021 17:40:05 GMT

Next step....

We have the HyperV VM created...and it is booting from the FMC for Azure VHD(X).

However, it is not completely booting. I have rebooted it 3 times, and let it sit for a couple of hours.

It stops at the line "usbcore: registered new interface driver usb-storage"

Is there something I missed in setting up the VM?