VMware Workstation: AI assistant (LLM)

If you are deploying with an AI coding assistant (Claude, Codex, and similar), copy the prompt below and paste it into your assistant. It drives the same ovftool + vmrun flow as the CLI (ovftool + vmrun) guide, but written for the assistant to follow step by step, pausing for your confirmation and for the values only you can supply.

Before you paste

Give the assistant a session on the host that already has VMware Workstation Pro 17 installed, with ovftool and vmrun available (an agentic tool with shell access on that host, or paste the commands it returns into your own terminal). Have ready: the OVA path, the target VM directory (40 GB free), and, for bridged networking, the name of the host wired Ethernet adapter to bridge through. The assistant will ask for anything it is missing.

Deployment prompt

You are helping me deploy the Sophos Remote Testing Appliance (RTA) as a virtual
machine on VMware Workstation Pro, using ovftool and vmrun. Work through the steps
below in order. Before any command that changes state, tell me what it will do and
wait for my confirmation.

CONTEXT:
- The appliance is a prebuilt OVA my engagement lead shared out-of-band. It is
  customized for my engagement, so it boots already registered and connects to
  Sophos on its own, with nothing to install or set up inside it. The OVA already
  sets UEFI firmware with Secure Boot off and VM hardware version 13, and it bundles
  both the root disk and a small cidata seed disk, so a single import attaches
  everything. There is no inbound access.

WHAT I WILL PROVIDE (ask me for any you do not have; never guess these):
- <OVA_PATH>: the path to the .ova file my engagement lead shared.
- <DEST_DIR>: the target directory for the VM. It needs at least 40 GB free.
- <VM_NAME>: a descriptive VM name (for example Sophos-RTA).
- <BRIDGE_NIC> (for bridged networking): the host wired Ethernet adapter, or the
  VMnet mapped to it, to bridge through (for example VMnet0). Bridged mode needs a
  wired uplink; Workstation cannot bridge over Wi-Fi.

STEPS:
1. Confirm the tools are available:
   ovftool --version
   vmrun
   Both ship with Workstation Pro. If either is not found, add the Workstation
   installation directory to PATH or invoke the tools by full path, then tell me.
   Do not download anything.

2. Import the OVA into a .vmx VM:
   ovftool <OVA_PATH> <DEST_DIR>/<VM_NAME>.vmx
   This writes the .vmx descriptor and the disk files into <DEST_DIR>. The OVA
   already carries EFI firmware with Secure Boot off, and ovftool preserves that in
   the generated .vmx. Do NOT edit the firmware or boot type. If ovftool reports a
   conformance or manifest warning, show it to me; a successful import still writes
   the .vmx.

3. Set CPU and memory in <DEST_DIR>/<VM_NAME>.vmx. Update these lines, or append
   them if absent:
   numvcpus = "4"
   memsize = "8192"
   That is the recommended 4 vCPU / 8 GB; the minimum is 2 vCPU / 4 GB.

4. Set the network adapter in the same .vmx. For bridged mode (recommended, giving
   the appliance Layer-2 adjacency to the engagement LAN):
   ethernet0.connectionType = "bridged"
   ethernet0.vnet = "<BRIDGE_NIC>"
   Omit the vnet line to let Workstation auto-select the uplink. For an isolated lab
   instead, set ethernet0.connectionType = "nat". Bridged mode requires a wired
   uplink; Workstation cannot bridge over Wi-Fi.

5. Start the VM:
   vmrun start <DEST_DIR>/<VM_NAME>.vmx
   vmrun returns immediately and the VM runs in the background. Confirm it is
   running:
   vmrun list

VERIFY:
6. Open the VM console in the Workstation Pro UI. Because the image is customized,
   the appliance boots already registered: the console shows a live status and
   troubleshooting dashboard (network interface, VPN tunnel, connectivity health),
   and the outbound tunnel comes up on its own. You do not need to log in or enter
   anything. If the dashboard shows the tunnel down, the problem is on the outbound
   network path (see the rules below); do not reconfigure the appliance.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a command fails, returns something unexpected,
  or reality does not match what is written here, STOP and show me the exact output.
  Do not improvise, invent flags, or try alternative commands on your own.
- The appliance needs exactly ONE connection: an outbound tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. Never open, forward, or allow any INBOUND
  port to it. If connectivity fails, the problem is on the outbound path, never a
  missing inbound rule.
- Never enable Secure Boot and never change the firmware or boot type away from what
  these steps specify (UEFI / Generation 2). The appliance will not boot otherwise.
- Do not SSH into, log in to, or reconfigure the appliance. Once it boots it
  provisions itself; there is nothing to set up inside it.
- Every value in angle brackets (<LIKE_THIS>) must come from me. Never guess, invent,
  or reuse one. Ask me for any you do not have before running the step that needs it.
- Do not weaken security to force the connection (do not disable TLS inspection, and
  do not turn off a firewall). If something is blocked, tell me what and let me decide.
- Do only what these steps describe: deploy this one appliance. Do not create extra
  resources, install extra software, or take any action beyond that.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination

Destination	connect.remotetesting.secureworks.com
IP addresses	3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.