Cisco Secure Access Help

PDF

Cisco Secure Access Help

Deploy VAs in KVM

Updated: September 15, 2026

Want to summarize with AI?

Log in

Describes Deploy VAs in KVM in Cisco Secure Access and explains Prerequisites and Configure Authentication for the Virtual Appliances. It summarizes the behavior, configuration context, and operational considerations presented throughout the topic.

Deploy Cisco Secure Access Virtual Appliances (VAs) in KVM.

Note
You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site. It is critical that these VAs are not cloned or copied in any way. Configure and set up each VA manually.

Prerequisites

  • Full Admin user role. For more information, see Manage Accounts.
  • For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.
  • A Linux system with qemu-utils package installed.
  • Only VAs running 2.5 or above can be deployed in KVM.
  • Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.
    • KVM on Ubuntu Linux (supported LTS versions)
    • KVM on Red Hat Linux (supported versions)

Configure Authentication for the Virtual Appliances

Before you can download the Virtual Appliance images in Secure Access, you must configure your Secure Access API keys for the Virtual Appliances in your organization. Secure Access enables the Download Components only after the API keys for the VAs are configured. For more information, see Configure Authentication for Virtual Appliances.

Procedure for Deploying VAs in KVM

Prerequisites

  • Full Admin user role. For more information, see Manage Accounts.

  • For information about the network requirements for deploying VAs, see Prerequisites for Virtual Appliances.

  • A Linux system with qemu-utils package installed.

  • Only VAs running 2.5 or above can be deployed in KVM.

  • Virtual Appliance deployments in KVM are supported with specific Red Hat Linux and Ubuntu Linux versions only.

    • KVM on Ubuntu Linux (supported LTS versions)

    • KVM on Red Hat Linux (supported versions)

To successfully deploy a virtual appliance in a KVM environment, follow the steps as they are listed below:

  1. Step 1 – Download and Extract the KVM Installer

  2. Step 2 – Launch the Virtual Appliance on KVM

Step 1 – Download and Extract the KVM Installer

Procedure

  1. Navigate to Connect > DNS Forwarders and click Download Components.

    DNS Forwarders section with an option to download components

  2. Click Download next to VA for KVM.

    Download Components section with an option to download a virtual machine

    Secure Access generates and downloads a .tar file unique to your deployment.

    This tar file includes:

    • A zip file containing the KVM-compatible virtual hard disk images (.qcow2 format) and configuration files

    • A signature file

    • A Cisco public certificate to validate the signature

    • A readme file

  3. Extract the contents of the tar file using the tar –xvf <tar filename> -C <Destination folder> command.

  4. Verify the integrity of the downloaded file by following the signature validation instructions in the readme file. On a successful verification, the message Verified OK is displayed.

  5. Extract the .zip file.

    The extracted contents include the Virtual Hard Disks folder, the Virtual Machines folder, and a configuration file.

    Folder displaying the extracted contents of a zip file

    The Virtual Hard Disks folder contains the KVM-compatible .qcow2 files (namely, dynamic.qcow2 and forwarder-va.qcow2).

Step 2 – Launch the Virtual Appliance on KVM

Procedure

  1. Open the Virtual Machine Manager on your Linux system running KVM and click Create a new virtual machine.


    Virtual Machine Manager screen with an option to create a new virtual machine on a Linux system running KVM

  2. In the first step of the wizard, choose Import existing disk image.


    New VM screen with an option to install the operating system by importing existing disk image

  3. Provide the existing storage path to your forwarder-va.qcow2. Set the OS type to Linux and click Forward.

    New VM screen with an option to provide storage path and select the type of operating system

  4. Set the memory and CPU settings to at least 1 CPU and 1 GB RAM and click Forward.


    New VM screen with an option to choose Memory and CPU settings

  5. In the last step of the wizard, select Customize configuration before install and then click Finish.


    New VM screen with an option to enable customize configuration before install

  6. Select Add Hardware. Adding a new hardware component

  7. Select Storage, add or create custom storage, add the dynamic disk, and then click Finish.

    You should then see two disks.


    Add New Virtual Hardware screen with an option to add or create custom storage

  8. Click Begin installation to create the VA.


    Screen displaying an option to begin the installation

  9. If your network supports DHCP, the VA will get auto-configured with a DHCP IP address and will register to Umbrella using this IP. You can configure the VA on KVM through two mechanisms:

    • Press Ctrl+B on the VA console and entering the Configuration mode.

      Or

    • Initiate an SSH connection to the DHCP IP—this IP can be retrieved in Secure Access—and enter Configuration mode.

What to do next

You can now configure the VA. For information about configuring VAs, see Configure Virtual Appliances.