How to Set Up Firewalla Crystal on VMware ESXi (Beta)

In this guide, we'll walk through how to set up Firewalla Crystal on VMware ESXi.

• For Custom Hardware, see: How to Set Up Firewalla Crystal on Custom Hardware
• For Proxmox, see: How to Set Up Firewalla Crystal on Proxmox Virtual Environment (PVE)

What You'll Need:

• A Firewalla MSP account that owns a Crystal ready for provisioning.
• Firewalla MSP 2.12 or later.
• A VMware ESXi host.

"Crystal" Virtual Machine Minimum Requirements:

• 2 CPU cores
• 4 GB (4096 MB) memory
• 1 disk, 32 GB or more
• 2 network adapters
• 1 CD/DVD drive (used to mount the install ISO)

How to set up Crystal on VMware ESXi:

• STEP 0: Order a Firewalla Crystal
• STEP 1: Set Up Network Profile
• STEP 2: Download Software and Upload to ESXi
• STEP 3: Flash Device
  • Create the VM
  • Begin Flashing
• STEP 4: Go Live
• Troubleshooting
• Reset and Restore

STEP 0: Order a Firewalla Crystal

• If you are already an MSP owner, go to your MSP Portal and join MSP Early Access (MSP Settings → MSP Update → Release → Early Access). 
  • If your MSP is already in Early Access, click Update now on the banner of your MSP dashboard to update to version 2.12 or later.
• If you don't have an MSP plan, sign up at firewalla.net and sign in there. (No need to purchase an MSP plan first — we'll set up your MSP when you buy a Crystal.)
• Go to firewalla.net/crystal, select your Crystal Type and Billing Cycle, then check out. 
• After checkout, the page will show a Start Provisioning button. Click it to begin Zero-Touch Provisioning.
  
• From the MSP management UI, you can also click the Provision button on the banner to start.

STEP 1: Set Up Network Profile

From Firewalla MSP's Zero-Touch Provisioning, set up your network profile and hardware.

Select the hardware that closely matches your Device Type, then click Next. In this case, you'd want to choose VMware.

Select your WAN Connection and LAN IP address, then click Generate Personalized Software. 

STEP 2: Download Software and Upload to ESXi

Download the software image.

In the ESXi web UI, go to Storage, select your existing datastore (usually "datastore1"), and click Datastore browser. Click Create directory to make a directory named "crystal" inside that datastore, then use Upload to put the software image into it.

STEP 3: Flash Device

Create the VM

In the ESXi web UI, click Create / Register VM -> Create a new virtual machine. Here are some guidelines that we used:

Name and guest OS

• Guest OS family: Linux
• Guest OS version: Other 6.x or later Linux (64-bit)

Customize settings

• CPU: 2 or more
• Memory: 4096 MB or more
• Hard disk 1: This is the disk Firewalla Crystal will be installed on. Set to 40GB.
• Network Adapter 1: Connect it to your Internet-facing port group.
• Add a network adapter and connect it to your internal port group. The two adapters are used as follows:
  • Network Adapter 1 -> WAN
  • Network Adapter 2 -> LAN

• CD/DVD Drive 1: Select Datastore ISO file, then browse to the software image you uploaded in Step 2.
  • Make sure Connect and Connect at power on are both checked.

VM Options -> Boot Options

• Use either BIOS or EFI.
  • If you choose EFI, make sure Whether or not to enable UEFI secure boot for this VM is unchecked. 
  • Crystal will not boot with Secure Boot enabled.

Finish the wizard.

Begin Flashing

Start the VM, open the VM Console in ESXi, then open the Firewalla Zero-Touch Provisioning console (Step 3). 

The provisioner will wait for the VM to connect before it continues to flash the device. The firewalla-provisioner flash console will display the current progress.

While flashing the device, check the console on the VM. See Troubleshooting for more details.

STEP 4: Go Live

When the installation finishes:

1. Shut down the VM.
2. Edit the VM settings and, under CD/DVD Drive 1, uncheck Connect and Connect at power on (or remove the CD/DVD drive).
3. Start the VM again.

Your VM is now running Firewalla Crystal. In Firewalla MSP's Zero-Touch Provisioning, click Continue to finish the setup. After the Crystal is online, you can use your Firewalla App to scan the QR code on the screen to pair with the device. You can also do this later, or pair it with other phones in Inventory -> Mobile Access.

Click Get Started to begin managing your Firewalla on MSP.

Troubleshooting

The VM will not boot with EFI

• Secure Boot is still on. Go to VM Options -> Boot Options and uncheck "Enable UEFI secure boot", or switch back to BIOS.

"No bootable device" or the VM doesn't boot the installer

• Check that CD/DVD Drive 1 is set to Datastore ISO file, points to the uploaded image, and has Connect and Connect at power on checked.

The installer cannot download Firewalla Crystal

• Check that Network Adapter 1 is connected to a port group with Internet access.

Clients behind Crystal cannot reach the network

• The LAN port group needs Promiscuous mode and Forged transmits set to Accept in the vSwitch security settings.

Reset and Restore

If you wish to wipe out the existing device you've provisioned and move to a different VM or hardware, or if it has run into a problem you can't recover from, you can reset your Crystal via the MSP UI. 

Reset a Crystal:

1. In the MSP UI, go to Inventory and open the Crystal's Settings.
2. Scroll to the bottom and click Reset This Crystal.
3. Enter your email address to confirm.

Reset erases all configuration on the device. After a reset, no Firewalla controls or services will be available until it is provisioned again.

Provision again and restore:

Once the reset is complete, the Crystal is ready to be provisioned. In Inventory, click Provision, then follow the on-screen steps. Because this Crystal has been set up before, you'll be asked to choose:

• Restore from backup — restores the configuration and data from the previous setup.
• Set up as new — starts with a clean configuration.