VMware Workstation: CLI (ovftool + vmrun)¶

Import and start the RTA from the terminal using ovftool and vmrun. Both tools ship with VMware Workstation Pro 17; no separate download is required.

Before you start

Review the VMware Workstation overview. You will need the OVA file provided by your engagement lead and VMware Workstation Pro 17 installed on Windows or Linux.

Quick deploy¶

Experienced operators can run the sequence below straight through; each step is explained in the sections that follow.

ovftool <OVA_PATH> <DEST_DIR>/Sophos-RTA.vmx          # import to a .vmx VM
# In <DEST_DIR>/Sophos-RTA.vmx set: numvcpus = "4", memsize = "8192",
#   ethernet0.connectionType = "bridged"  (wired uplink for L2 to targets)
vmrun start <DEST_DIR>/Sophos-RTA.vmx                 # boots pre-registered

The OVA already carries UEFI, Secure Boot off, hardware version 13, so there is nothing to reconfigure and no activation step.

Tool locations¶

ovftool and vmrun are installed alongside Workstation Pro:

# Windows (default)
C:\Program Files (x86)\VMware\VMware Workstation\ovftool\ovftool.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe

# Linux (default)
/usr/bin/ovftool
/usr/bin/vmrun

Add the Workstation installation directory to your PATH if the commands are not found, or invoke them by full path.

1. Import the OVA¶

Use ovftool to convert the OVA into a .vmx VM directory:

ovftool <OVA_PATH> <DEST_DIR>/<VM_NAME>.vmx

Replace <OVA_PATH> with the path to the OVA provided by your engagement lead, <DEST_DIR> with a folder that has at least 40 GB free, and <VM_NAME> with a descriptive name (e.g. Sophos-RTA).

Example (Linux):

ovftool ~/Downloads/rta-generic-latest.ova ~/vmware/Sophos-RTA/Sophos-RTA.vmx

Example (Windows, run in PowerShell or cmd):

ovftool.exe "C:\Users\you\Downloads\rta-generic-latest.ova" "C:\VMs\Sophos-RTA\Sophos-RTA.vmx"

ovftool creates the .vmx descriptor and one or more .vmdk disk files in the destination directory. The OVA descriptor already specifies EFI firmware with Secure Boot off, and ovftool carries that into the generated .vmx: there are no firmware or boot settings to edit.

2. Set CPU and memory in the .vmx¶

The OVA descriptor sets hardware defaults that may be below the recommended sizing. Edit the .vmx to set 4 vCPU and 8 GB:

numvcpus = "4"
memsize = "8192"

Check for existing numvcpus and memsize lines and update them, or append if absent.

3. Set the network adapter in the .vmx¶

Locate the ethernet0.connectionType line (or add it) and set it to match your use case:

# Bridged: Layer-2 adjacency to the engagement LAN (recommended)
ethernet0.connectionType = "bridged"

# NAT: isolated lab or dev use
ethernet0.connectionType = "nat"

For Bridged mode, also specify the host NIC to bridge through (optional, omit to let Workstation auto-select):

ethernet0.vnet = "VMnet0"

Bridged requires a wired uplink

VMware Workstation cannot bridge over Wi-Fi. The host must have a wired Ethernet adapter on the engagement network.

4. Start the VM¶

vmrun start <DEST_DIR>/<VM_NAME>.vmx

Example:

vmrun start ~/vmware/Sophos-RTA/Sophos-RTA.vmx

On Windows:

vmrun.exe start "C:\VMs\Sophos-RTA\Sophos-RTA.vmx"

vmrun returns immediately; the VM runs in the background. Open the Workstation Pro UI to view the console, or use vmrun list to confirm it is running:

vmrun list

Verify¶

This image is customized for your engagement before you receive it, so the appliance boots already registered and connects to the Sophos headend over its outbound VPN tunnel automatically. There is no activation step. The console shows a live status and troubleshooting dashboard (network interface, VPN tunnel, and connectivity health); you do not normally need to log in.

Open the VM console in the Workstation Pro UI to check the dashboard. To stop the VM cleanly:

vmrun stop <DEST_DIR>/<VM_NAME>.vmx soft

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.