How to Set Up Firewalla Crystal on Proxmox Virtual Environment (PVE)

In this guide, we'll walk through how to set up Firewalla Crystal on Proxmox Virtual Environment (PVE).

• For VMware ESXi, see: How to Set Up Firewalla Crystal on VMware ESXi
• For Custom Hardware, see: How to Set Up Firewalla Crystal on Custom Hardware

What You'll Need:

• A Firewalla MSP account that owns a Crystal ready for provisioning.
• Firewalla MSP 2.12 or later.
• A Proxmox VE host.

"Crystal" Virtual Machine Minimum Requirements:

• 2 CPU cores
• 4 GB (4096 MB) memory
• 1 disk, 32 GB or more
• 2 network devices (See Network Cards Supported by Firewalla Crystal)
• 1 CD/DVD drive (used to mount the install ISO)

How to set up Crystal on PVE:

• STEP 0: Order a Firewalla Crystal
• STEP 1: Set Up Network Profile
• STEP 2: Download Software and Upload to PVE
• STEP 3: Flash Device
  • Create the VM
  • Begin Flashing
• STEP 4: Go Live
• Troubleshooting
• Reset and Restore

STEP 0: Order a Firewalla Crystal

• If you are already an MSP owner, go to your MSP Portal and join MSP Early Access (MSP Settings → MSP Update → Release → Early Access). 
  • If your MSP is already in Early Access, click Update now on the banner of your MSP dashboard to update to version 2.12 or later.
• If you don't have an MSP plan, sign up at firewalla.net and sign in there. (No need to purchase an MSP plan first — we'll set up your MSP when you buy a Crystal.)
• Go to firewalla.net/crystal, select your Crystal Type and Billing Cycle, then check out. 
• After checkout, the page will show a Start Provisioning button. Click it to begin Zero-Touch Provisioning.
  
• From the MSP management UI, you can also click the Provision button on the banner to start.

STEP 1: Set Up Network Profile

From Firewalla MSP's Zero-Touch Provisioning, set up your network profile and hardware.

Select the hardware that closely matches your Device Type, then click Next. In this case, you'd want to choose Proxmox.

Select your WAN Connection and LAN IP address, then click Generate Personalized Software. 

STEP 2: Download Software and Upload to PVE

Download the software image.

In the Proxmox web UI, select the storage that holds ISO images (usually "local"), go to ISO Images, and click Upload to put the software image into it.

STEP 3: Flash Device

Create the VM

In the Proxmox web UI, click Create VM. Here are some guidelines that we used:

OS

• Select Use CD/DVD disc image file (iso), then choose the storage and the software image you uploaded in Step 2.
• Guest OS Type: Linux
• Guest OS Version: 6.x - 2.6 Kernel

System

• Use either SeaBIOS (legacy mode) or OVMF (UEFI).
  • If you choose OVMF (UEFI), uncheck Pre-Enroll keys to disable Secure Boot.
  • Crystal will not boot with Secure Boot enabled.

Disks

• 40GB or more. This is the disk Firewalla Crystal will be installed onto.

CPU / Memory

• 2 cores or more, 4096 MB or more.

Network

• Add one network device, connected to your Internet-facing bridge.

Confirm

• Finish the wizard, but do not start the VM yet.

Then, in the VM's Hardware tab, click Add -> Network Device and connect it to your internal network bridge. The two network devices are used as follows:

• net0 -> WAN
• net1 -> LAN

Begin Flashing

Start the VM, open the VM Console in Proxmox, then open the Firewalla Zero-Touch Provisioning console (Step 3). 

The provisioner will wait for the VM to connect before it continues to flash the device. The firewalla-provisioner flash console will display the current progress.

While flashing the device, check the console on the VM. See Troubleshooting for more details.

STEP 4: Go Live

When the installation finishes:

1. Shut down the VM.
2. In the VM's Hardware tab, edit the CD/DVD Drive and select Do not use any media (or remove the CD/DVD drive).
3. Start the VM again.

Your VM is now running Firewalla Crystal. In Firewalla MSP's Zero-Touch Provisioning, click Continue to finish the setup. After the Crystal is online, you can use your Firewalla App to scan the QR code on the screen to pair with the device. You can also do this later, or pair it with other phones in Inventory -> Mobile Access.

Click Get Started to begin managing your Firewalla on MSP.

Troubleshooting

The VM will not boot with OVMF (UEFI)

• Secure Boot is still on. Recreate the EFI disk with "Pre-Enroll keys" unchecked, or switch to SeaBIOS.

"No bootable device" or the VM doesn't boot the installer

• Check that the CD/DVD Drive in the Hardware tab points to the uploaded image, and that it is enabled in Options -> Boot Order.

The installer cannot download Firewalla Crystal

• Check that net0 is connected to a bridge with Internet access.

Reset and Restore

If you wish to wipe out the existing device you've provisioned and move to a different VM or hardware, or if it has run into a problem you can't recover from, you can reset your Crystal via the MSP UI. 

Reset a Crystal:

1. In the MSP UI, go to Inventory and open the Crystal's Settings.
2. Scroll to the bottom and click Reset This Crystal.
3. Enter your email address to confirm.

Reset erases all configuration on the device. After a reset, no Firewalla controls or services will be available until it is provisioned again.

Provision again and restore:

Once the reset is complete, the Crystal is ready to be provisioned. In Inventory, click Provision, then follow the on-screen steps. Because this Crystal has been set up before, you'll be asked to choose:

• Restore from backup — restores the configuration and data from the previous setup.
• Set up as new — starts with a clean configuration.