VMware / ESXi

VMware / ESXi Deployment

ARROW ships an OVA (Open Virtualization Appliance) for VMware, so the same image imports into Workstation on your desk, Fusion on a Mac, or vSphere/ESXi in your datacenter. The two workflows below cover the desktop products and the server products; pick the one that matches where you are deploying.

VM Credentials

Credentials are randomly generated during the build. Retrieve them from the ARROW Portal on your device’s details page.

---

VMware Workstation / Fusion

Open Workstation (Windows or Linux) or Fusion (macOS), go to File > Open (or Import), select the .ova from your extracted ARROW build ZIP, give the VM a name and location, and click Import.

Before powering on, give it room to work: 4 processors (2 minimum) and 16 GB of memory (8 GB minimum), with the network set to Bridged or NAT depending on whether you want the VM on your network or isolated from it. Enable 3D acceleration if you plan to use the desktop. Adjust these under Settings (right-click the VM), then click Power On and log in with the credentials from the ARROW Portal.

---

vSphere / ESXi

From the vSphere Client, right-click your target host or cluster and choose Deploy OVF Template. Pick Local file, select the .ova, and work through the wizard: a descriptive name and folder, the compute resource to run on, a datastore with enough space, and the port group to map the VM’s network to. Review and click Finish.

To deploy from the command line instead, use ovftool:

ovftool \
  --name="kali-arrow-client" \
  --datastore="<datastore_name>" \
  --network="<port_group>" \
  --acceptAllEulas \
  kali-arrow-client.ova \
  "vi://<username>:<password>@<esxi_host>"

For sizing, 2 vCPU and 8 GB is the floor, 4 vCPU and 16 GB is comfortable for most work, and 8 vCPU and 32 GB is for heavier engagements. Plan on 120 GB of disk in every case.

---

Older ESXi (6.7 and earlier)

The standard ARROW OVA is built at VMware hardware version 19, whose floor is ESXi 7.0 Update 2. Older hosts cannot run it natively:

Host	Maximum VM hardware version
ESXi 6.5	13
ESXi 6.7	14
ESXi 6.7 Update 2	15
ESXi 7.0	17

On ESXi 6.7 the stock OVA either refuses to import or has to be force-upgraded, and a force-fit leaves some virtual devices (the NIC among them) in a half-emulated state that surfaces later as flaky networking. Do not force it. Request the image at a hardware version your host supports instead.

Request the right hardware version

When you create the device request, set the target VMware hardware version to 14 for ESXi 6.7 (or 13 for 6.5, 15 for 6.7 Update 2). ARROW downconverts the OVA during the build with ovftool, so it imports and boots natively. ovftool only ever downconverts, so the build has to be at or above your target; you cannot raise a lower image after the fact.

Network adapter and VMware Tools

ARROW’s VMware images ship with a VMXNET3 adapter. Its driver is built into the image’s kernel, so the NIC comes up as eth0 on its own. If, after you have confirmed the port group and VLAN are correct (see Troubleshooting), the adapter still will not pass traffic on an older host, switch it to E1000e under Edit Settings > Network Adapter. ARROW images pin the interface name to eth0 regardless of adapter type, so nothing inside the guest needs to change.

open-vm-tools is already installed and enabled in ARROW’s Linux VMware images, so you do not need to add it. If you are debugging guest integration (time sync, graceful shutdown, guest IP reporting), confirm the service is running rather than reinstalling:

systemctl status open-vm-tools
vmware-toolbox-cmd -v

Guest tools are not a fix for an unreachable gateway; that is a port group or VLAN problem, covered below.

---

Troubleshooting

The OVA import fails with “unsupported hardware” or a minimum-version error. The host is older than the OVA’s hardware version. On ESXi 7.0 and newer you can bump the VM’s compatibility, but on ESXi 6.7 and earlier you cannot; request the image at a supported hardware version instead (see Older ESXi).

The VM boots to a black screen. Enable UEFI boot under Options > Advanced > Firmware type > UEFI.

No network connectivity, or a static IP is set but the gateway is unreachable. If ping to the gateway returns “Destination Host Unreachable” from the VM’s own address, the guest cannot ARP its gateway, which means the virtual NIC is not on the subnet you think it is. In Edit Settings > Network Adapter, confirm the adapter is Connected (and “Connect at power on”), then confirm its port group’s VLAN ID matches the target subnet and that the vSwitch uplink trunks that VLAN. This, not the guest IP settings, is the usual cause. See the full walk-through in Static IP (Standalone VMs). If the port group is correct and traffic still does not pass on an older host, try the E1000e adapter (see above).

Performance is slow. Confirm open-vm-tools is running (systemctl status open-vm-tools; it is installed at build time) and that 3D acceleration is enabled.

The password does not work. Credentials are generated at build time. Retrieve them from the ARROW Portal on your device’s details page.