Deploying the OVA appliance
The OVA appliance gives you an always-on Connector that survives reboots without a service for you to manage. It runs the same Connector application as a background service on a minimal, hardened Ubuntu Linux VM.
Before you start
Deploy the appliance through vCenter. Its deploy-time settings (registration code, connector name, hostname, environment, static IP) are delivered as OVF vApp properties: the hypervisor injects them at deploy time and the appliance reads them through VMware Tools on first boot. vCenter's Deploy OVF Template wizard reliably prompts for these properties and passes them in; use it when available.
Other deployment paths often drop the properties. Deploying directly to a standalone ESXi host through the host client can skip the vApp property page, and desktop hypervisors (VirtualBox, VMware Workstation) import and boot the OVA but don't pass properties through at all.
If the properties don't arrive, the appliance comes up on DHCP and you pair it from the console wizard on the VM console. The wizard has no network settings, so a static IP has to come from the properties. See If the appliance didn't pair itself.
You'll also need:
- A network for the appliance that can reach both the internet and the on-prem systems you're integrating with. If egress is restricted, provision the firewall rules in Network Requirements first.
- Access to Settings > Connectors in Connect, to download the OVA and create a registration code.
VM specifications
| Property | Value |
|---|---|
| OS | Ubuntu 24.04 LTS x86_64 |
| vCPU | 1 |
| RAM | 2 GB |
| Disk | 10 GB, thin-provisioned |
| NIC | one adapter (see the network prerequisite above) |
| VMware hardware version | vmx-19 (vSphere 7.0+) |
1. Get the OVA
The Download the Connector app step on Settings > Connectors in Connect (the same page used to download the native binary) also lists an .ova file. Download it.
2. Deploy and configure
-
In vCenter, Deploy OVF Template, point it at the downloaded
.ova, then choose a name, host/cluster, datastore, and the network the appliance should use. -
On the Customize template page, fill in the appliance properties. All are optional:
Property Purpose Registration Code A code from Settings > Connectors in Connect. If set, the appliance pairs itself automatically on first boot with no console interaction. Leave it blank to pair from the console wizard instead. Connector Name Display name in Connect. Defaults to the hostname. IP Address / Subnet Mask / Default Gateway / DNS Servers Leave all blank for DHCP. If you set IP Address, the other three become required. Hostname Optional system hostname. Environment Leave this set to prod. The other values are for internal testing. -
Finish the wizard and power on the VM.
If you set a registration code, the appliance pairs itself on first boot with no console interaction, on DHCP or on the static IP you set. Without one, the console wizard on the VM's console (tty1) opens so you can pair it there.
3. Pair from the console (if you left the registration code blank)
Open the VM console in vSphere. The FireMon Connector wizard shows the appliance's network status, then a menu. Choose Register connector and enter:
- Environment: leave this at
prod(see the property table above). - Connector name: defaults to the hostname.
- Registration code: a code from Settings > Connectors in Connect.
On success it prints Registration successful! and starts the service.
The pairing menu
Until the appliance is paired, the console menu offers:
| Option | What it does |
|---|---|
| Register connector | Pair the appliance with a registration code (above) |
| Test cloud connectivity | Run DNS + connectivity checks against every Connect endpoint the appliance needs; see Network Requirements |
| View network status | Show the appliance's interfaces and addresses, its DNS servers, and its default route |
| View first-boot logs | Show the first-boot service's log: what the appliance did with the vApp properties it was given, including any hostname, static-IP, or auto-pair failure |
| View OVF environment (vSphere properties) | Print the raw OVF environment the hypervisor handed the appliance |
| Drop to shell | Drop to a root shell on the appliance |
The diagnostic options are covered in If the appliance didn't pair itself.
4. Confirm the appliance is online
Same check as the native binary: Settings > Connectors > Connectors in Connect shows it with a green status dot. On the VM console, the wizard now shows a status menu; see The console wizard.
If the appliance didn't pair itself
If you filled in a registration code at deploy time and the appliance still came up asking to be paired, start with View OVF environment in the pairing menu. It prints the XML the hypervisor actually passed in, so you can tell whether your deploy-time values reached the VM at all:
| What you see | What it means |
|---|---|
| The XML, with your properties in it | The properties arrived. If the appliance still didn't auto-pair or take its static IP, check View first-boot logs for the reason; expired registration codes and invalid network configurations are both reported there. |
(no OVF environment available) | VMware Tools is running but the hypervisor passed nothing. Typical of a deploy path that skipped the vApp property page; see Before you start. |
vmtoolsd not installed | The guest tools aren't present, so no properties can ever be read. Expected on a non-VMware hypervisor; pair from the console menu instead. |
An unpaired appliance re-reads its vApp properties on every boot, so a property that didn't arrive or was set incorrectly can be corrected in place: power the VM off, correct it in vCenter under Edit Settings > vApp Options, and power it back on. The appliance re-applies the hostname, static IP, and registration code from the corrected values. Once it pairs successfully, the first-boot step is skipped and the properties are ignored from then on; after that, use the console menu (including Re-pair connector) instead.
For other symptoms, see Troubleshooting: OVA appliance.
The console wizard
Once paired, opening the VM's console shows a status menu:
| Option | What it does |
|---|---|
| View logs | Follow the service journal (startup and service messages). The Connector's own log is at /var/log/firemon-connector/connector.log; open Shell to read it |
| Restart service | Restart the Connector systemd service |
| Test cloud connectivity | Run the same DNS + connectivity checks as the pairing menu |
| Re-pair connector | Discard the appliance's local credentials and pair again with a fresh registration code. Use this to move an appliance to a different account, or to recover after its Connector was removed in Connect |
| Shell | Drop to a root shell on the appliance |
Restrict who can open the VM console. With no default password and SSH disabled, the console is the appliance's only administrative path, and opening it is equivalent to root access. Scope the vCenter Console Interaction privilege accordingly; see Security & Data Protection for the appliance's full security posture.
One appliance per Connector identity
Don't clone a paired appliance. The clone would share the original's Connector ID, and the two would compete for the same work (see Installation). To run a second Connector, deploy another appliance from the OVA and pair it with its own registration code.
Decommissioning
To retire an appliance, see Decommissioning an appliance in Security & Data Protection.