topic Re: Cisco FTDv on ESXI8 in Network Security

Cisco FTDv on ESXI8

Alexey Leshko — Fri, 05 May 2023 08:39:59 GMT

Hello!

I instlled FTDv (7.3.1-19) on ESXI 8.

All interfaces down, instead Managemet. On ESXI it configured as VMXNET3.

On ESXI side its attach and connected, but on FTDv side its in DOWN status!

ESXiFTDv

> show interface ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 192.168.10.114 YES CONFIG down down
GigabitEthernet0/1 unassigned YES DHCP down down
GigabitEthernet0/2 unassigned YES unset administratively down down
GigabitEthernet0/3 unassigned YES unset administratively down down
GigabitEthernet0/4 unassigned YES unset administratively down down
GigabitEthernet0/5 unassigned YES unset administratively down down
GigabitEthernet0/6 unassigned YES unset administratively down down
GigabitEthernet0/7 unassigned YES unset administratively down down
Internal-Control0/0 127.0.1.1 YES unset up up
Internal-Control0/1 unassigned YES unset up up
Internal-Data0/0 unassigned YES unset down down
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 169.254.1.1 YES unset up up
Internal-Data0/2 unassigned YES unset up up
Management0/0 unassigned YES unset down down

Does anybody solve this promlem?

Re: Cisco FTDv on ESXI8

Rob Ingram — Fri, 05 May 2023 09:15:24 GMT

@Alexey Leshko I assume you deployed the policy to the FTD once you enabled the data interfaces?

The release notes for FTD 7.3 only states that VMware vSphere/VMware ESXi 6.5, 6.7, or 7.0 is supported. I would imagine ESX 8.0 is not currently supported, perhaps log a call with TAC.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/730/threat-defense-release-notes-73/requirements.html

Re: Cisco FTDv on ESXI8

Alexey Leshko — Fri, 05 May 2023 09:29:50 GMT

Hi! Thank you for reply!

I known about what ESXI8 is unsupported and search for solution this case.

Re: Cisco FTDv on ESXI8

Marvin Rhoads — Fri, 05 May 2023 13:31:15 GMT

As @Rob Ingram noted, ESXi 8 is not currently supported (even with the upcoming FTD 7.4). Not only is it not supported (= not tested and verified), but it also does not work - same symptoms as you observed.

I have verified with TAC and raised an enhancement (ENH) bug for this feature. CSCwe44306 applies (not currently publicly viewable).

I was able to get it to work in my lab by building a nested ESXi 7 hypervisor on my ESXi 8 server.

Re: Cisco FTDv on ESXI8

Alexey Leshko — Fri, 05 May 2023 14:08:51 GMT

Thank you!

Re: Cisco FTDv on ESXI8

takiadeen — Sat, 29 Jul 2023 10:42:50 GMT

Thanks for Clarification - Just installed ESXi 8 and I was hit by this. Guess stick to ESXi 7 for now.

Re: Cisco FTDv on ESXI8

OliverFueckert46911 — Mon, 28 Aug 2023 19:56:22 GMT

There is workaround:

After you deploy the OVA, remove all 10 network interfaces from the VM configuration and recreate them as 10 x E1000 interfaces. This will make the interfaces work on ESXI 8. The problem seems to be related to the vmxnet3 drivers.

Re: Cisco FTDv on ESXI8

Marvin Rhoads — Tue, 29 Aug 2023 13:56:25 GMT

@OliverFueckert46911 thanks for the tip! I confirmed that worked for me in my lab.

I just had to make sure I accounted for the different mapping of FTDv interfaces when using E1000 vs. vmxnet3 type.

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/consolidated_ftdv_gsg/ftdv-gsg/m-ftdv-vmware-gsg.html#id_107352

Re: Cisco FTDv on ESXI8

Himanshu_Dwivedi — Mon, 11 Dec 2023 13:34:45 GMT

After recreating new interfaces with E1000, I believe you might have faced this error during deployment. How did you resolved?

Re: Cisco FTDv on ESXI8

OliverFueckert46911 — Mon, 11 Dec 2023 20:41:56 GMT

You can re-read the interfaces from the devices page. I don't have an instance running right now, so can't show you a screenshot.

best regards,

Oliver.

RE: Cisco FTDv on ESXI8

FoW — Wed, 03 Jan 2024 05:25:14 GMT

It shouldn't be outside of the vendor's coverage, but it works well in my environment. Working normally on vSphere 8.

Re: Cisco FTDv on ESXI8

tyshawn76 — Sat, 24 Feb 2024 13:02:05 GMT

I just wanted to add a data point on this topic. I had an FTDv/FMCv that was on 7.2.4 with ESXi 8 U2. Like everyone else the ports were in a down state. I tried deleting all 10 NICs and recreating them as E1000 NICs but that placed all the NICs including the management port into a downstate. After reverting to the latest snapshot and rebooting the FTDv I gained control of the device again. Just for kicks, I updated the FMC and FTD to 7.4.1 and the NICs came back in an upstate with the vmxnet3 type.

I am not saying this is the magic bullet, but the latest release worked for me.