You can deploy the Access Point appliance by logging in to vCenter Server and using the Deploy OVF Template wizard.

Note: If you use the vSphere Web Client to deploy the OVF, you can also specify the DNS server, gateway, and netmask addresses for each network. If you use the native vSphere Client, verify that you have assigned an IP pool to each network. To add an IP pool in vCenter Server using the native vSphere Client, go to the IP Pools tab of the data center. Alternatively, if you are using the vSphere Web Client, you can create a network protocol profile. Go to the Manage tab of the data center and select the Network Protocol Profiles tab.



  1. Use the native vSphere Client or the vSphere Web Client to log in to a vCenter Server instance.
    For an IPv4 network, use the native vSphere Client or the vSphere Web Client. For an IPv6 network, use the vSphere Web Client.
  2. Select a menu command for launching the Deploy OVF Template wizard.
    Option Menu Command
    vSphere Client Select File > Deploy OVF Template.
    vSphere Web Client Select any inventory object that is a valid parent object of a virtual machine, such as a data center, folder, cluster, resource pool, or host, and from the Actions menu, select Deploy OVF Template.
  3. On the Select Source page of the wizard, browse to the location of the .ova file that you downloaded or enter a URL and click Next.
    A details page appears. Review the product details, version, and size requirements.
  4. Follow the wizard prompts, and take the following guidelines into consideration as you complete the wizard.
    Option Description
    Select a deployment configuration For an IPv4 network, you can use one, two, or three network interfaces (NICs). For an IPv6 network, use three NICs. Access Point requires a separate static IP address for each NIC. Many DMZ implementations use separated networks to secure the different traffic types. Configure Access Point according to the network design of the DMZ in which it is deployed.
    Disk format For evaluation and testing environments, select the Thin Provision format. For production environments, select one of the Thick Provision formats. Thick Provision Eager Zeroed is a type of thick virtual disk format that supports clustering features such as fault tolerance but takes much longer to create than other types of virtual disks.
    VM storage policy (vSphere Web Client only) This option is available if storage policies are enabled on the destination resource.
    Setup Networks/Network Mapping If you are using vSphere Web Client, the Setup Networks page allows you to map each NIC to a network and specify protocol settings.
    1. Select IPv4 or IPv6 from the IP protocol drop-down list.
    2. Select the first row in the table Internet and then click the down arrow to select the destination network. If you select IPv6 as the IP protocol, you must select the network that has IPv6 capabilities.

      After you select the row, you can also enter IP addresses for the DNS server, gateway, and netmask in the lower portion of the window.

    3. If you are using more than one NIC, select the next row ManagementNetwork, select the destination network, and then you can enter the IP addresses for the DNS server, gateway, and netmask for that network.

      If you are using only one NIC, all the rows are mapped to the same network.

    4. If you have a third NIC, also select the third row and complete the settings.

      If you are using only two NICs, for this third row BackendNetwork, select the same network that you used for ManagementNetwork.

    With the vSphere Web Client, a network protocol profile is automatically created after you complete the wizard if one does not exist.

    If you use the native vSphere Client (rather than the Web Client), the Network Mapping page allows you to map each NIC to a network, but there are no fields for specifying the DNS server, gateway, and netmask addresses. As described in the prerequisites, you must already have assigned an IP pool to each network or created a network protocol profile.

    Customize Properties template The text boxes on the Properties page are specific to Access Point and might not be required for other types of virtual appliances. Text in the wizard page explains each setting. If the text is truncated on the right side of the wizard, resize the window by dragging from the lower-right corner. You must enter values in the following text boxes:
    • IPMode:STATICV4/STATICV6. If you enter STATICV4, you must enter the IPv4 address for the NIC. If you enter STATICV6, you must enter the IPv6 address for the NIC.
    • Comma separated list of forward rules in the form {tcp|udp}/listening-port-number/destination-ip-address:destination-port-nu
    • NIC 1 (ETH0) IPv4 address. Enter the IPv4 address for the NIC if you entered STATICV4 for the NIC mode.
    • Comma separated list of IPv4 custom routes for NIC 1 (eth0) in the form ipv4-network-address/bits.ipv4-gateway-address
    • IPv6 address. Enter the IPv6 address for the NIC if you entered STATICV6 for the NIC mode.
    • DNS server addresses. Enter space-separated IPv4 or IPv6 addresses of the domain name servers for the VM.
    • Management network IP address if you specified 2 NICs, and Backend network IP address if you specified 3 NICs
    • Password options. Enter the password for the root user of this VM and the password for the administrator user who access the administration console and enables REST API access.

    All other settings are either optional or already have a default setting entered. Note the password requirements listed on the wizard page. For a description of all deployment properties, see Access Point Deployment Properties.

  5. On the Ready to Complete page, select Power on after deployment, and click Finish.
    A Deploy OVF Template task appears in the vCenter Server status area so that you can monitor deployment. You can also open a console on the virtual machine to view the console messages that are displayed during system boot. A log of these messages is also available in the file /var/log/boot.msg.
  6. When deployment is complete, verify that end users can connect to the appliance by opening a browser and entering the following URL:

    In this URL, FQDN-of-AP-appliance is the DNS-resolvable, fully qualified domain name of the Access Point appliance.

    If deployment was successful, you see the Web page provided by the server that Access Point is pointing to. If deployment was not successful, you can delete the appliance virtual machine and deploy the appliance again. The most common error is not entering certificate thumbprints correctly.


The Access Point appliance is deployed and starts automatically.

What to do next

Log in to the Access Point admin user interface (UI) and configure the desktop and application resources to allow remote access from the Internet through Access Point and the authentication methods to use in the DMZ. The administration console URL is in the format https://<