Create an MVE — Megaport CLI

A Megaport Virtual Edge (MVE) is an on-demand virtual network function appliance hosted at the edge of the Megaport fabric. Instead of shipping a physical SD-WAN box to every branch, you spin up a virtual one in the metro closest to your users — fully integrated with vendor orchestrators like Cisco vManage, Fortinet FortiManager, and Palo Alto Panorama.

What you'll provision

🔎Find locationlocations list

📦Choose imagemve list-images

📏Pick sizemve list-sizes

🛒Buy MVEmve buy

✅Verifymve get

How it works

The MVE runs the vendor's virtual appliance image (e.g. Cisco Catalyst 8000V, Fortinet FortiGate-VM, Palo Alto VM-Series) on Megaport's fabric. After provisioning, the appliance auto-registers with the vendor's central orchestrator and you manage it through the same console you'd use for any virtual or physical SD-WAN node.

Step 1 — Find a location

MVEs are hosted at specific Megaport metros. Pick one near your users or branch sites to minimise latency.

bash

# Browse locations
megaport-cli locations list --metro "Sydney"

# Get the numeric ID
megaport-cli locations list --metro "Sydney" --output json | jq '.[] | {id, name}'

ℹ️

MVE locations differ from Port locations

Not every Megaport DC supports MVE. The full list is published at docs.megaport.com/mve/locations. If your preferred DC isn't supported, use the nearest MVE-enabled metro.

Step 2 — Choose a vendor image

Each vendor publishes one or more images on the Megaport fabric. List what's available and copy the image ID for the version you want.

bash

# List all images
megaport-cli mve list-images

# Filter to a specific vendor
megaport-cli mve list-images --vendor "Cisco"
megaport-cli mve list-images --vendor "Fortinet"

# Show only release (production-grade) images
megaport-cli mve list-images --vendor "Palo Alto" --release-image

Example output:

text

ID    VENDOR        PRODUCT                  VERSION   RELEASE  SIZES
123   Cisco         Catalyst 8000V           17.13.01  true     SMALL,MEDIUM,LARGE
124   Fortinet      FortiGate-VM             7.4.3     true     SMALL,MEDIUM,LARGE,X_LARGE_12
125   Palo Alto     VM-Series                11.1.2    true     MEDIUM,LARGE,X_LARGE_12

Supported vendors

The MVE platform is integrated with: 6WIND, Aruba EdgeConnect, Aviatrix, Check Point CloudGuard, Cisco, Fortinet, Juniper, Palo Alto Networks, Peplink FusionHub, Versa, VMware SD-WAN, Cisco Meraki. Each vendor exposes vendor-specific configuration fields — the common shape is below; full schema is in Step 4.

Step 3 — Pick an instance size

The instance size determines vCPU, RAM, and how many concurrent connections the MVE can support.

bash

megaport-cli mve list-sizes

Size	vCPU	RAM	Typical use
`SMALL`	2	8 GB	Lab, POC, low-throughput branch
`MEDIUM`	4	16 GB	Mid-size branch with SD-WAN + basic NGFW
`LARGE`	8	32 GB	Regional hub, heavier inspection
`X_LARGE_12`	12	48 GB	Hub with deep packet inspection at scale

⚠️

Not all sizes work for all images

Each vendor image lists which sizes it supports. Check the SIZES column in mve list-images output — picking an unsupported size returns a validation error at buy time.

Step 4 — Buy the MVE

Interactive mode

bash

megaport-cli mve buy --interactive

The CLI prompts for name, location, term, vendor, image, size, vNICs, and SSH keys.

Flag mode

bash

megaport-cli mve buy \
  --name "Branch SD-WAN Sydney" \
  --location-id 3 \
  --term 12 \
  --vendor-config '{"vendor":"cisco","imageId":123,"productSize":"MEDIUM","sshPublicKey":"ssh-rsa AAAA..."}' \
  --vnics '[{"description":"Data Plane","vlan":100},{"description":"Management","vlan":200}]'

JSON file (recommended for production)

bash

megaport-cli mve buy --json-file ./mve-config.json

Example: Cisco Catalyst 8000V

json

{
  "name": "Branch SD-WAN Sydney",
  "term": 12,
  "locationId": 3,
  "diversityZone": "blue",
  "vendorConfig": {
    "vendor": "cisco",
    "imageId": 123,
    "productSize": "MEDIUM",
    "mveLabel": "syd-branch-01",
    "manageLocally": false,
    "adminSshPublicKey": "ssh-rsa AAAA... admin@example.com",
    "sshPublicKey": "ssh-rsa AAAA... ops@example.com",
    "cloudInit": "#cloud-config\nhostname: syd-branch-01\n"
  },
  "vnics": [
    { "description": "Data Plane", "vlan": 100 },
    { "description": "Management", "vlan": 200 }
  ],
  "resourceTags": {
    "environment": "production",
    "owner": "network-ops"
  }
}

Example: Fortinet FortiGate-VM

json

{
  "name": "Branch FortiGate Sydney",
  "term": 12,
  "locationId": 3,
  "vendorConfig": {
    "vendor": "fortinet",
    "imageId": 124,
    "productSize": "MEDIUM",
    "adminSshPublicKey": "ssh-rsa AAAA... admin@example.com",
    "licenseData": "<base64-encoded-license-blob>"
  },
  "vnics": [
    { "description": "WAN", "vlan": 100 },
    { "description": "LAN", "vlan": 200 }
  ]
}

Example: Palo Alto VM-Series

json

{
  "name": "Branch Palo Sydney",
  "term": 12,
  "locationId": 3,
  "vendorConfig": {
    "vendor": "palo_alto",
    "imageId": 125,
    "productSize": "LARGE",
    "adminSshPublicKey": "ssh-rsa AAAA... admin@example.com",
    "adminPasswordHash": "$5$<sha256-hash>",
    "licenseData": "<panorama-auth-code>"
  },
  "vnics": [
    { "description": "Untrust", "vlan": 100 },
    { "description": "Trust", "vlan": 200 },
    { "description": "Management", "vlan": 300 }
  ]
}

Required fields

Flag	JSON key	Notes
`--name`	`name`	MVE display name
`--location-id`	`locationId`	From `locations list`
`--term`	`term`	`1`, `12`, `24`, `36` months
`--vendor-config`	`vendorConfig`	Vendor-specific JSON object (see below)
`--vnics`	`vnics`	JSON array of network interfaces

Common vendor-config keys

Key	Required	Description
`vendor`	Yes	Lowercase vendor identifier — `cisco`, `fortinet`, `palo_alto`, `aruba`, `versa`, `vmware`, `meraki`, `aviatrix`, `prisma`, `6wind`
`imageId`	Yes	From `mve list-images`
`productSize`	Yes	`SMALL`, `MEDIUM`, `LARGE`, `X_LARGE_12`
`mveLabel`	No	Short label embedded in vendor metadata
`adminSshPublicKey`	Most	SSH key for admin access
`sshPublicKey`	Some	Secondary SSH key (Cisco, VMware)
`licenseData`	Vendor-dependent	License blob — Fortinet, Palo Alto, Aviatrix
`cloudInit`	Cisco	`#cloud-config` user-data string
`manageLocally`	Cisco	`false` to register with vManage; `true` for standalone

💡

Vendor-specific fields differ

Cisco wants cloudInit and manageLocally. Fortinet wants licenseData. Palo Alto wants adminPasswordHash and licenseData. Versa wants directorAddress and controllerAddress. Run mve buy --help and consult your vendor's deployment guide on docs.megaport.com/mve for the full per-vendor schema.

vNIC configuration

Every MVE needs at least one vNIC. Each vNIC is a logical interface that can carry one or more VXCs.

json

"vnics": [
  { "description": "Data Plane", "vlan": 100 },
  { "description": "Management", "vlan": 200 }
]

You can have up to 5 vNICs per MVE. The vlan value is the inner VLAN tag; pick anything in the range 2–4093 (1 is reserved). VXCs attached later will reference these by vnicIndex.

Step 5 — Verify the MVE is live

bash

# Full details
megaport-cli mve get <MVE-UID>

# Status only
megaport-cli mve get <MVE-UID> --output json | jq '.provisioningStatus'

# List your MVEs
megaport-cli mve list

Status transitions: CONFIGURED → LIVE. Once LIVE, the appliance boots and begins reaching out to its vendor orchestrator.

Step 6 — Connect the MVE to the internet

Most SD-WAN deployments need an upstream internet connection so the appliance can register with its vendor controller (vManage, FortiManager, Panorama, etc.).

The standard pattern is a Megaport Internet VXC from one of the MVE's vNICs to a TRANSIT partner port. See Create a Megaport Internet VXC for the full walkthrough.

bash

# Quick example — Megaport Internet from MVE vNIC 0
megaport-cli vxc buy \
  --name "MVE Internet - Sydney" \
  --a-end-uid <MVE-UID> \
  --a-end-vnic-index 0 \
  --a-end-vlan 100 \
  --b-end-uid <TRANSIT-PARTNER-PORT-UID> \
  --b-end-vlan 0 \
  --rate-limit 1000 \
  --term 12 \
  --b-end-partner-config '{"connectType":"TRANSIT"}'

Step 7 — Configure the appliance

Once the MVE is LIVE, log in to the vendor's orchestrator to complete configuration:

Cisco — vManage discovers the MVE automatically once it can reach the controller. Add it to the SD-WAN overlay and push templates.
Fortinet — register the FortiGate-VM in FortiManager / FortiCloud using the licence and serial number from the deployment.
Palo Alto — Panorama claims the VM-Series via the auth code in licenseData. Push device groups and templates.

Vendor-specific deployment guides: docs.megaport.com/mve/.

Clean up (optional)

bash

# Soft delete (removes at end of billing period)
megaport-cli mve delete <MVE-UID>

# Immediate deletion (irreversible)
megaport-cli mve delete <MVE-UID> --now

⚠️

Delete attached VXCs first

An MVE with attached VXCs cannot be soft-deleted cleanly. Either remove the VXCs first, or use --now to force-delete (which removes the VXCs along with the MVE).

What's next?

Create a Megaport Internet VXC — bring the MVE online with public internet upstream
Connect to AWS — extend the MVE into AWS via Direct Connect
Connect to Azure — extend the MVE into Azure via ExpressRoute
MCR Routing — sit an MCR alongside the MVE for L3 transit between clouds

💡

For Sales demos

A virtual Cisco or Fortinet appliance running in a Sydney data centre, fifteen minutes after the command runs — without shipping hardware, racking it, or cabling cross-connects. This is the headline value proposition of MVE; show it live.