Import the OVA into VMware, VirtualBox, or Proxmox, or boot the ISO on bare metal. Size it from the table below. Everything else is asked for on first boot — see the setup guide. Downloads need a free account, and the same account holds your activation code — one typed code at setup enrolls the appliance for CVE/KEV and threat-intelligence feed data.
eafa86996adf89a2f678341e4006c52d46acc50855fbc05ccd6e5aa4e29a382a02e9e7e8b4b69e7e5d734d187756f14b6212f17ad47a6140bd87d22086f01cadLab, branch or single site · up to ~250 managed devices · ~25 admins
Multi-site · up to ~2,000 devices · ~100 admins · 802.1X/NAC for a campus
2,000+ devices · NAC across many campuses · long session-recording retention
The OVA ships at the Small shape — raise vCPU, RAM and disk in the hypervisor before first power-on for larger tiers. Session recordings and NAC accounting are the main drivers of disk growth.
The appliance generates its own cryptographic identity, then asks you a handful of things on the console — network, name, certificate — before the web interface starts.
DHCP out of the box, on whatever the hypervisor names the NIC. Or choose static at the console and the wizard asks for the address, gateway and DNS servers, validates them, applies them, and verifies the link before moving on.
The DNS name you will reach the appliance by. It has to be a real name rather than an IP address, because it also becomes the WebAuthn relying-party ID — and an IP literal cannot be one.
By default the appliance issues its own from a private CA it generates, which lands in ADMIN > PKI where it can later be replaced with one imported from your organization's CA. Let's Encrypt is also built in. This is not optional hardening: browsers only expose the passkey and security-key APIs on an HTTPS origin, so FIDO2 login does not work without it.
Deploying more than one? Both answers can be pre-seeded from a kickstart, cloud-init, or an OVF property, and the console wizard is skipped entirely.