Tag Archives: ESXi

08 Aug

Cisco Firepower NGIPSv on ESXi

Secure Your Network

Cisco Firepower NGIPS is available on multiple platforms. One of deployment option you have is virtual appliance running on top of ESXi hypervisor. This product is called NGIPSv in Cisco documentation.

Using a single physical machine with ESXi hypervisor in an isolated network is one of the best ways to perform Proof of Concept (PoC) labs for IPS solution. You cannot evaluate the product without testing it in a sandbox where you can try to hack it, infect it or do any other nasty things. This way, you can in single ESXi run NGIPSv, Firepower Management Center (FMCv) and one or more VMs in the back.

Here is a quick step-by-step guide how to deploy NGIPSv in transparent mode on single ESXi host. What we want to accomplish is having NGIPSv in front of other virtual machines. In this scenario, there is no firewall, just NGIPSv sensor. It is of course not the safest, the best practice and the most flexible way to deploy sensor. You should not use it just like that in your production network. I use this setup only for quick demo purposes when I want to show how Cisco Firepower NGIPS solution is working, get network discovery working, some IPS policy and get the end host infected by malware.

Read More →

27 Nov

ESXi 5.5 on VMWare Workstation and only one NIC visible

Something less strictly networking but I started setting up some lab environment on my home PC. It’s good that you can run hypervisors as virtual machines in virtualized environment. I installed two ESX 5.5 hypervisors. ESX by default creates four Ethernet interfaces. First interface is bridged to my LAN, others were supposed to be used for internal connections but it happened that hypervisor itself cannot see them. For some unknown reason only first interface was visible.

It happened that only first network interface is defined as e1000, rest had no interface type definition, therefor VM detected those as some AMD PCI cards and couldn’t use them. Fix for this simple – find .vmx configuration file and add device type manually

ethernet1.present = "TRUE"
ethernet1.virtualDev = "e1000"
ethernet1.vnet = "VMnet3"
ethernet1.connectionType = "custom"
ethernet1.wakeOnPcktRcv = "FALSE"
ethernet1.addressType = "generated"