Use the VMware vSphere Client to log into the vCenter server.

Choose the host on which to deploy the Cisco PNSC VM.

From the File menu, choose Deploy OVF Template.

In the Source window, choose the Cisco PNSC OVA, then click Next.

In the OVF Template Details window, review the details of the Cisco PNSC template, and then click Next.

In the End User License Agreement window, click Accept after reviewing the End User License Agreement, and then click Next.

In the Name and Location window, provide the required information, and then click Next.

In the Deployment Configuration window, choose Installer from the Configuration drop-down list, then click Next.

In the Datastore window, select the data store for the VM, and then click Next.

In the Disk Format window, click either Thin provisioned format or Thick provisioned format to store the VM vdisks, and then click Next.

In the Network Mapping window, select the management network port group for the VM, then click Next.

In the Properties window, provide the required information, address any errors described in the red text messages below the selection box, and then click Next. If needed, you can enter placeholder information as long as your entry meets the field requirements.

In the Ready to Complete window, review the deployment settings information, and then click Finish.

After Cisco PNSC is successfully deployed, click Close.

Power on the Cisco VSG VM.

On the VSM, enter the following commands:

vsm# configure terminal
vsm(config)# nsc-policy-agent
vsm(config-nsc-policy-agent)# registration-ip 10.193.75.95
vsm(config-nsc-policy-agent)# shared-secret Example_Secret123
vsm(config-nsc-policy-agent)# policy-agent-image vsmcpa.3.2.3a.bin
vsm(config-nsc-policy-agent)# exit
vsm(config)# copy running-config startup-config
vsm(config)# exit

Check the status of the NSC policy agent configuration to verify that you have installed the Cisco PNSC correctly and it is reachable by entering the show nsc-pa status command. This example shows that the Cisco PNSC is reachable and the installation is correct:

vsm# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 3.4(2)-vsm
vsm

On the VSM, create the VLANs by first entering global configuration mode using the following command:

vsm# configure

Enter the following configuration commands:

vsm(config)# vlan 100
vsm(config-vlan)# no shutdown
vsm(config-vlan)# exit
vsm(config)# vlan 200
vsm(config-vlan)# no shutdown
vsm(config-vlan)# exit
vsm(config)# exit
vsm# configure
vsm(config)# copy running-config startup-config
vsm(config)# exit

Press Ctrl-Z to exit.

Create a Cisco VSG data port profile and a Cisco VSG-ha port profile by first enabling the Cisco VSG data port-profile configuration mode. Use the configure command to enter global configuration mode.

vsm# configure

Enter the following configuration commands:

vsm(config)# port-profile VSG-Data
vsm(config-port-prof)# vmware port-group
vsm(config-port-prof)# switchport mode access
vsm(config-port-prof)# switchport access vlan 100
vsm(config-port-prof)# no shutdown
vsm(config-port-prof)# state enabled
vsm(config-port-prof)# exit
vsm(config)#
vsm(config)# copy running-config startup-config
vsm(config)# exit

Press Ctrl-Z to end the session.

Enable the Cisco VSG-ha port profile configuration mode.

vsm# configure

Enter the following configuration commands:

vsm(config)# port-profile VSG-HA
vsm(config-port-prof)# vmware port-group
vsm(config-port-prof)# switchport mode access
vsm(config-port-prof)# switchport access vlan 200
vsm(config-port-prof)# no shutdown
vsm(config-port-prof)# state enabled
vsm(config-port-prof)# exit
vsm(config)# copy running-config startup-config
vsm(config)# exit

Add the VLANs created for the Cisco VSG data and Cisco VSG-ha interfaces as part of the allowed VLANs into the uplink port profile. Use the configure command to enter global configuration mode.

vsm# configure

Enter the following configuration commands:

vsm(config)# port-profile type ethernet uplink
vsm(config-port-prof)# switchport trunk allowed vlan add 100, 200
vsm(config-port-prof)# exit
vsm(config)#

Press Ctrl-Z to end the session.

Choose the host on which to deploy the Cisco VSG VM.

Choose File > Deploy OVF Template.

In the Deploy OVF Template—Source window, browse to the path to the Cisco VSG OVA file, and then click Next.

In the Deploy OVF Template—OVF Template Details window, review the product information including the size of the file and the VM disk, and then click Next.

In the Deploy OVF Template—End User License Agreement window, click Accept after reviewing the end user license agreement and then click Next.

In the Deploy OVF Template—Name and Location window, do the following:

1. In the Name field, enter a name for the Cisco VSG that is unique within the inventory folder and has up to 80 characters.

2. In the Inventory Location pane, choose the location that you would like to use for hosting the Cisco VSG.

3. Click Next.

In the Deploy OVF Template—Deployment Configuration window, from the Configuration drop-down list, choose Deploy medium VSG, and then click Next.

In the Deploy OVF Template—Datastore window, choose the data store for the VM and click Next.

In the Deploy OVF Template—Disk Format window, do the following:

1. Click either Thin provisioned format or Thick provisioned format to store the VM vdisks.

   The default is thick provisioned. If you do not want to allocate the storage immediately, use thin provisioned. Ignore the red text in the window.

2. Click Next.

In the Deploy OVF Template—Network Mapping window, do the following:

1. Choose VSG Data for the data interface port profile.

2. Choose Management for the management interface port profile.

3. Choose VSG-ha for the HA interface port profile .

4. Click Next.

In the Deploy OVF Template—Properties window, do the following:

1. In the OvfDeployment field, select ovf to continue the configuration. Select ignore for manual configuration.

2. From the HARole drop-down list, choose HA role.

3. In the HAid field, enter the high-availability identification number for a Cisco VSG pair (value from 1 through 4095).

4. In the Password field, enter a password that contains at least one uppercase letter, one lowercase letter, and one number.

5. In the ManagementIpV4 field, enter the IP address for the Cisco VSG.

6. In the ManagementIpV4 Subnet field, enter the subnet mask.

7. In the Gateway field, enter the gateway name.

8. In the VnmcIpV4 field, enter the IP address of the Cisco PNSC.

9. In the SharedSecret field, enter the shared secret password defined during the Cisco PNSC installation.

10. Click Next.

    Note	For the shared secret password guidelines, see Shared Secret Pasword section.

In the Ready to Complete window, review the deployment settings information .

Click Finish. The Deploying Nexus 1000VSG dialog box opens.

Wait and click Close after the progress indicator shows that the deployment is completed successfully.

From your virtual machines, do one of the following:

1. Right click and choose Edit Settings.

2. Click the Getting Started tab from the menu bar and then click the link Edit Virtual Machine Settings.

In the Virtual Machine Properties window, do the following:

1. From the CPUs drop-down list, choose the appropriate vCPU number.

   For older version of ESXi hosts, you can directly select a number for the vCPUs.

2. From the Number of Virtual Sockets drop down list, choose the appropriate socket with cores.

   For the latest version of ESXi hosts, you can directly select a number for the vCPUs.

Power on the Cisco VSG VM.

Log in to the Cisco VSG.

Check the status of NSC-PA configuration by entering the following command:

vsg# show nsc-pa status
NSC Policy-Agent status is - Installed Successfully. Version 2.1(3i)-vsg
vsg#

Log in to the Cisco PNSC.

Choose Resource Management > Resources > VSG.

Confirm that the table in the Clients window contains the registered value in the Oper State column for the Cisco VSG and VSM entries.

In your browser, enter https://server-ip-address where server-ip-address is the Cisco PNSC IP address.

In the Website Security Certificate window, choose Continue to this website.

In the Cisco PNSC login window, enter the username admin and the admin user password.

In the Cisco PNSC main window, choose Resource Management > Resources to check the Cisco VSG and VSM registration in the Cisco PNSC.

Log in to the Cisco PNSC.

Choose Resource Management > Resources > Images.

Click Import Service Image.

In the Import Service Image dialog box, do the following:

1. Enter a name and description for the image you are importing.

2. In the Type field, select VSG.

3. In the Version field, enter a version to assign to the image.

4. In the Protocol field, choose a protocol.

5. In the Hostname / IP Address field, enter the hostname or IP address of the remote host to which you downloaded the images.

6. In the User Name field, enter the account username for the remote host.

7. In the Password field, enter the account password for the remote host.

8. In the Remote File field, enter the absolute path and filename of the service image, starting with a slash, such as /mnt/nexus-1000v.5.2.1.VSG2.2.1.ova.

Log in to the Cisco PNSC.

Choose Resource Management > Managed Resources > root > tenant > Network Services.

From the Actions drop-down list, select Add Compute Firewall.

In the Properties window, supply the information as described in the Properties Window, and then click Next.

In the Service Device window, select the required VSG service device as described in the Service Device Window, and then click Next.

(Instantiate option only) If you instantiate a VSG service device from an image, do one or both of the following in the Placement screen, then click Next:

• Navigate to and choose the host or resource pool to use for the VSG instance.
• If you enabled high availability, either check the Same as Primary check box, or navigate to and choose the host or resource pool to use for the secondary VSG instance.

In the Interfaces window, configure interfaces as follows, and then click Next:

• If you assigned a VSG, enter the data IP address and subnet mask.
• If you assigned a VSG pool, enter the data IP address and subnet mask.
• If you instantiated a VSG service device without high availability, add management and data interfaces.
• If you instantiated a VSG service device with high availability, add management, data, and HA interfaces.

In the Summary window, confirm that the information is correct, and then click Finish.

Log in to the Cisco PNSC.

In the Cisco PNSC window, choose Policy Management > Service Profiles.

In the Service Profile window, choose root > tenant > Compute Security-Profiles > SP1.

In the right pane, click Add ACL Policy Set.

In the Add ACL Policy Set dialog box, enter a name and description for the policy set, and then click Add ACL Policy.

In the Add ACL Policy dialog box, enter a name and description for the policy, and then click Add Rule above the Name column.

In the Add ACL Policy Rule dialog box, do the following:

1. In the Name field, enter the rule name.

2. In the Description field, enter a description for the rule.

3. In the Action To Take area, choose permit.

4. In the Condition Match Criteria field, select a matching condition.

5. In the Source Conditions field, enter the source condition of the rule.

6. In the Destination Conditions field, enter the destination condition of the rule.

7. In the Service field, enter the service expression.

8. In the Protocol tab, select a protocol for the rule.

9. In the Ether Type tab, specify the ether type for the rule.

10. Click OK.

In the Add ACL Policy dialog box, click OK.

In the Add ACL Policy Set dialog box, click OK.

In the Security Profile window, click Save.