NSv on Proxmox: Deployment Model

Deploying a professional‑grade virtual firewall such as NSv on Proxmox VE requires disciplined, intentional resource allocation. The NSv XS (1 core), NSv S (2 cores), NSv M (4 cores), and NSv L (8 cores) subscription tiers define the baseline compute profile for each deployment.

Virtual Machine Configuration

Proper virtual machine provisioning is critical to maintaining deterministic behavior for security workloads.

• CPU allocation

  Assign vCPUs according to the selected NSv subscription tier (1, 2, 4, or 8 vCPUs) and configure the CPU type as Host. This enables direct access to hardware‑assisted instructions, improving encryption and packet‑processing efficiency.

• Memory allocation

  Allocate fixed memory according to the requirements for the selected NSv model (see Product Matrix and Requirements). Memory ballooning should be avoided to preserve predictable buffering behavior during traffic inspection.

• Storage configuration

  Use virtio‑scsi for optimized disk I/O, ensuring efficient handling of logging operations, signature updates, and system writes.

Network Design

A clean and intentional network design is foundational for effective policy enforcement.

At a minimum, configure two virtual bridges (vmbr):

• WAN Bridge

  Mapped to a physical NIC connected to upstream networks or Internet access.

• LAN Bridge

  An isolated bridge for protected workloads or downstream switching infrastructure.

This logical separation enforces correct traffic flow and ensures inspection integrity.

• Single‑Core vs Multi‑Core