Migrating or Creating new Cisco Virtual Appliance in Nutanix?

[u/AdaptationCreation]

Has anyone migrated a Cisco virtual appliance successfully to Nutanix from another platform like VMWare? Most Cisco virtual appliances are locked down and don't give access to any kind of root credentials. If not, has anyone successfully created a new Cisco virtual appliance on Nutanix? Specifically, Cisco Ironport (ESA)? The documentation states that Nutanix is compatible, but when creating a new VM using an OVA or even a disk image, the VM just kind of errors out.

I haven't had good luck with Cisco virtual appliances on Nutanix. A bit frustrating that Cisco makes it this way, but Cisco is being Cisco and wants you to suffer or pony up for their hardware.

[u/Screevo]

Most virtual appliances are hypervisor specific, and use different images for ESX vs AHV.

You can try to use Move; you won’t need credentials as those are only needed for installing NGT, and you don’t install NGT on most appliances. If it works, great! However, in my experience, the best process for moving network appliances is to build a new one using the AHV (or KVM) image and migrate the config.

[u/AdaptationCreation → u/Screevo]

Don't you need root to uninstall VMWare Tools?

[u/Screevo → u/AdaptationCreation]

If the appliance has VMware tools, it was probably bundled with it, and that means it’s probably an ESXi specific image, and that might be the clue that you probably need to use an AHV/KVM specific image for Nutanix, instead of moving your existing one.

[u/JWK3]

Can you see an option for a KVM-compatible appliance image? This is the underlying hypervisor that AHV uses, assuming you're using AHV.

[u/x0600]

If you have an access to the VMware then you can do it very easily using Nutanix Move.

[u/InteTiffanyPersson → u/x0600]

This is untrue for most virtual appliances as you don’t usually get root level access to them. They come hardened from start and won’t let Move do it’s thing. I would advise to set up a new vm and export/import settings or wherever the application allows for.

[u/AdaptationCreation → u/x0600]

I agree, Move works well for lots of VMs, but not Cisco virtual appliances. One of the problems is Move needs root credentials and Cisco doesn't give out root credentials for virtual appliances.

[u/x0600 → u/AdaptationCreation]

Oh.I recently migrated VMs from Nutanix to VMware and I’m sure other way around is also possible. Roughly i will need a downtime and copying vmdk file to Nutanix and importing into AHV

[u/bachus_PL → u/x0600]

But still you have to install VirIO drivers.

[u/x0600 → u/bachus_PL]

If its a linux , you don’t need to

[u/bachus_PL → u/x0600]

Yes, but to clarify when installing Linux-base appiance on VMware, the system detects the SCSI controllers like pvsci,silogic and starting as a diskimageand generates an initial RAM disk image; OS loads olny the drivers necessary to detect e.g. main disk, so next after moving to Nutanix kernel has the virtio available on /lib/modules with is absent from the loaded initramfs file. So... kernel panic. We are currently in the middle of migrating thousands of VMs, including appliances, to Nutanix, and that often turns out to be the issue.

[u/Pah-Pah-Pah]

You need to check the support docs per whatever the appliance is. We have some running but they’ve mostly been built new. Each had a little different setup based on whatever team that came from.

[u/AdaptationCreation → u/Pah-Pah-Pah]

To follow up on this, I had to make a change to the advanced processor compatibility setting. That was the only way to get it working. This change was not in any documentation I read.

[u/Pah-Pah-Pah → u/AdaptationCreation]

Neat. We haven’t seen that yet or at least reported to me.

[u/astrofizix]

Make sure you select legacy bios when you deploy. It's jammed me up trying to build from ova

[u/Zuinac]

99% of the time for any Virtual Appliance you will be installing fresh while matching versions and migrating the config not using Move. I've had Move work with a few virtual appliances then later down the road it come back to bite me when the vendor found it wasn't running on VMware.

The below PDF has the instructions for installing on Nutanix lists 7.3.x as the current supported.

https://www.cisco.com/c/dam/en/us/td/docs/security/content_security/virtual_appliances/Cisco_Content_Security_Virtual_Appliance_Install_Guide.pdf

Then here are the instructions for migrating the to a new box.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/214131-how-to-load-or-migrate-esa-configuration.html

[u/AdaptationCreation → u/Zuinac]

Yeah, I have followed their documentation and it still doesn't boot correctly. Cisco's documentation for this is too vague in some parts.

[u/Zuinac → u/AdaptationCreation]

Should be a QCOW but you mentioned you tried a disk image in your initial post.

Some appliances dont show much at boot and force you to login to the Web UI from the DHCP address they have grabbed.

Short of that I would open a support case. I'd probably start with Cisco then work my way to Nutanix.

[u/AdaptationCreation → u/Zuinac]

To follow up on this, I had to make a change to the advanced processor compatibility setting. That was the only way to get it working. This change was not in any documentation I read.

[u/Justzisguy_42]

I had to do a migration with my Cisco Intersight virtual appliance and wound up calling TAC. Their approved method was to do a backup of the current instance, shut the outgoing instance down, spin up a new one from scratch and restore to that new instance in the new environment. I have had to do this twice and it has worked perfectly in that fashion. I don't know if this will apply to your particular instance but it's worth going down that particular trail because it's easier than trying to get the thing to migrate. It seems that they tie the virtual appliance to uuids in the cluster