Upgrading Physical S160 to Virtual.

[keithsauer507]

We have an S160 webfilter and I was toying around updating it since the performance is subpar after Async 8 releases.  We did get the pricing to upgrade to an S170 or S380 but the rep also said we can use virtual appliances for free.  We already have a nice vmware infrastructure in place, so I have a few questions on this.

How do you handle the L4 monitoring interface in the virtual world?

I found the downloads for the virtual appliance, but there are three versions.  Which one would I need?

S000V, S100V, S300V?  Any reason not to go to the S300V if it is the best?

[Ken Stieers]

When I beta'd the vms, I couldn't get anyone on the product management side to answer the "L4 in the VM world" question.  Its like they didn't understand at all...  I'm sure there's a way to do it, but I'd bet it requires a separate physical port, tied to the VM, etc.  You could just leave your HW in place and send L4 at that...

S000V is TINY... S100V is probably the right size... We've been happy with a S100V in place of a S170...

[keithsauer507]

Is this how you do it?  Send your L4 to a physical appliance and everything else virtual?  Wouldn't you need two licences, smartnets, update definitions, etc...?

[Ken Stieers · Accepted solution]

Yes, at the moment, though I'm probably going to go with something else for L4...  (Snort or Sourcefire...)

We smartnet the hardware, and you pay your license fee, just like normal.  Deploy 1000 vms, they don't care, as long as you're only serving the number of users your license covers, you're good to go.  

You jump through the hoops on the licensing site to get your license file, and apply it to each VM you deploy.

[keithsauer507]

We have Dell Secureworks IDS and Carbon Black endpoint security.  At this point I'm not 100% sure we would still need the L4 monitoring in the Cisco WSA at this point.