Troubleshooting Tip: Decoys on FortiDeceptor-VM are failing to start correctly with status 'failed to create clone'

This issue most commonly occurs when nested virtualization has not been enabled on the hypervisor for FortiDeceptor's virtual machine instance. As a reminder, FortiDeceptor can be run as a virtual machine on VMware ESXi/vSphere, Microsoft Hyper-V, or KVM. On top of that, it will run its own nested virtual machines to host the Decoys. This requires nested virtualization support to be present and enabled on the underlying hypervisor's CPU, as the Decoy VMs will otherwise be unable to start successfully.

With that in mind, ensure that the underlying CPU on the hypervisor host supports virtualization extensions (e.g. AMD SVM, Intel VT-X, etc.), confirm that these features are enabled in the BIOS/UEFI of the host, then ensure that these virtualization extensions have been enabled for the FortiDeceptor virtual machine itself. The following documents have guidance for checking and enabling this on supported platforms:

• FortiDeceptor KVM Deployment Guide - Creating the virtual machine
• FortiDeceptor Hyper-V Deployment Guide - Configure the hardware settings (see Step 8 onward).
• FortiDeceptor VMWare ESXi Deployment Guide - Minimum system requirements

As an example, the following is a sample output taken from a Linux KVM host using the lscpu command. This example uses an AMD EPYC processor, and so the expected flag indicating virtualization support is svm:

This next example is CLI output taken from a FortiDeceptor-VM directly using the hardware-info command, though note that this is running on a different host (in this case, Intel-based host CPU and the vmx flag). If the flag for a given CPU's virtualization functionality is present on FortiDeceptor-VM then it indicates that nested-virtualization support is also present:

Note:

This is a mandatory configuration and FortiDeceptor will not function without enabling the nested virtualization.