Install vSRX Virtual Firewall in KVM | 19 Prepare Your Server for vSRX Virtual
Firewall Installation | 19
Enable Nested Virtualization | 19 Upgrade the Linux Kernel on Ubuntu | 21
Install vSRX Virtual Firewall with KVM | 21 Install vSRX Virtual Firewall with
virt-manager | 22 Install vSRX Virtual Firewall with virt-install | 24
Example: Install and Launch vSRX Virtual Firewall on Ubuntu | 27
Requirements | 28 Overview | 28 Quick Configuration – Install and Launch a
vSRX Virtual Firewall VM on Ubuntu | 29 | 32 Step by Step Configuration | 32
Load an Initial Configuration on a vSRX Virtual Firewall with KVM | 45 Create
a vSRX Virtual Firewall Bootstrap ISO Image | 46 Provision vSRX Virtual
Firewall with an ISO Bootstrap Image on KVM | 47
Use Cloud-Init in an OpenStack Environment to Automate the Initialization of
vSRX Virtual Firewall Instances | 48
Perform Automatic Setup of a vSRX Virtual Firewall Instance Using an OpenStack
CommandLine Interface | 52
Perform Automatic Setup of a vSRX Virtual Firewall Instance from the OpenStack
Dashboard (Horizon) | 54
vSRX Virtual Firewall VM Management with KVM | 62
iv
Configure vSRX Virtual Firewall Using the CLI | 62
Connect to the vSRX Virtual Firewall Management Console on KVM | 64
Add a Virtual Network to a vSRX Virtual Firewall VM with KVM | 65
Add a Virtio Virtual Interface to a vSRX Virtual Firewall VM with KVM | 67
SR-IOV and PCI | 69 SR-IOV Overview | 69 SR-IOV HA Support with Trust Mode
Disabled (KVM only) | 70 Understand SR-IOV HA Support with Trust Mode Disabled
(KVM only) | 70 Configure SR-IOV support with Trust Mode Disabled (KVM only) |
72 Limitations | 73 Configure an SR-IOV Interface on KVM | 74
Upgrade a Multi-core vSRX Virtual Firewall | 78 Configure the Queue Value for
vSRX Virtual Firewall VM with KVM | 78 Shutdown the vSRX Virtual Firewall
Instance with virt-manager | 79 Upgrade vSRX Virtual Firewall with virt-
manager | 79
Monitor the vSRX Virtual Firewall VM in KVM | 81
Manage the vSRX Virtual Firewall Instance on KVM | 82 Power On the vSRX
Virtual Firewall Instance with virt-manager | 82 Power On the vSRX Virtual
Firewall Instance with virsh | 82 Pause the vSRX Virtual Firewall Instance
with virt-manager | 83 Pause the vSRX Virtual Firewall Instance with virsh |
83 Rebooting the vSRX Virtual Firewall Instance with virt-manager | 83 Reboot
the vSRX Virtual Firewall Instance with virsh | 83 Power Off the vSRX Virtual
Firewall Instance with virt-manager | 84 Power Off the vSRX Virtual Firewall
Instance with virsh | 84 Shutdown the vSRX Virtual Firewall Instance with
virt-manager | 85 Shutdown the vSRX Virtual Firewall Instance with virsh | 85
Remove the vSRX Virtual Firewall Instance with virsh | 86
Recover the Root Password for vSRX Virtual Firewall in a KVM Environment | 87
Configure vSRX Virtual Firewall Chassis Clusters on KVM | 89 vSRX Virtual
Firewall Cluster Staging and Provisioning for KVM | 89
v
Chassis Cluster Provisioning on vSRX Virtual Firewall | 89 Creating the
Chassis Cluster Virtual Networks with virt-manager | 91 Creating the Chassis
Cluster Virtual Networks with virsh | 91 Configuring the Control and Fabric
Interfaces with virt-manager | 93 Configuring the Control and Fabric
Interfaces with virsh | 93 Configuring Chassis Cluster Fabric Ports | 93
Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS | 94 Chassis
Cluster Overview | 95 Enable Chassis Cluster Formation | 96 Chassis Cluster
Quick Setup with J-Web | 97 Manually Configure a Chassis Cluster with J-Web |
98
Verify the Chassis Cluster Configuration | 105
2
vSRX Virtual Firewall Deployment for VMware
Overview | 107
Understand vSRX Virtual Firewall with VMware | 107
Requirements for vSRX Virtual Firewall on VMware | 115
Install vSRX Virtual Firewall in VMware | 124 Install vSRX Virtual Firewall
with VMware vSphere Web Client | 124
Load an Initial Configuration on a vSRX Virtual Firewall with VMware | 128
Create a vSRX Virtual Firewall Bootstrap ISO Image | 132 Upload an ISO Image
to a VMWare Datastore | 133 Provision vSRX Virtual Firewall with an ISO
Bootstrap Image on VMWare | 134
Validate the vSRX Virtual Firewall .ova File for VMware | 135
Upgrade a Multicore vSRX Virtual Firewall with VMware | 142 Power Down vSRX
Virtual Firewall VM with VMware vSphere Web Client | 143 Upgrade a Multicore
vSRX Virtual Firewall with VMware vSphere Web Client | 143 Optimize
Performance of vSRX Virtual Firewall | 144
vi
Automate the Initialization of vSRX Virtual Firewall 3.0 Instances on VMware
Hypervisor using VMware Tools | 145 Overview | 145 Provision VMware Tools for
Autoconfiguration | 146
Configure vSRX Virtual Firewall Chassis Clusters in VMware | 150 vSRX Virtual
Firewall Cluster Staging and Provisioning for VMware | 150
Deploying the VMs and Additional Network Interfaces | 150 Creating the Control
Link Connection Using VMware | 151 Creating the Fabric Link Connection Using
VMware | 155 Creating the Data Interfaces Using VMware | 158 Prestaging the
Configuration from the Console | 159 Connecting and Installing the Staging
Configuration | 160
Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS | 161 Chassis
Cluster Overview | 161 Enable Chassis Cluster Formation | 162 Chassis Cluster
Quick Setup with J-Web | 167 Manually Configure a Chassis Cluster with J-Web |
168
Deploy vSRX Virtual Firewall Chassis Cluster Nodes Across Different ESXi Hosts
Using dvSwitch | 174
3
vSRX Virtual Firewall Deployment for Microsoft Hyper-V
Overview | 179
Understand vSRX Virtual Firewall with Microsoft Hyper-V | 179
Requirements for vSRX Virtual Firewall on Microsoft Hyper-V | 181
Install vSRX Virtual Firewall in Microsoft Hyper-V | 188 Prepare for vSRX
Virtual Firewall Deployment in Microsoft Hyper-V | 188
Deploy vSRX Virtual Firewall in a Hyper-V Host Using the Hyper-V Manager | 189
Deploy vSRX Virtual Firewall in a Hyper-V Host Using Windows PowerShell | 200
vSRX Virtual Firewall VM Management with Microsoft Hyper-V | 205 Configure
vSRX Virtual Firewall Using the CLI | 205
Configure vSRX Virtual Firewall Using the J-Web Interface | 207 Access the
J-Web Interface and Configuring vSRX Virtual Firewall | 207
Add vSRX Virtual Firewall Interfaces | 211 Add Virtual Switches | 212
Configure the vSRX Virtual Firewall to Use a VLAN | 219
Power Down a vSRX Virtual Firewall VM with Hyper-V | 221
Configure vSRX Virtual Firewall Chassis Clusters | 222 vSRX Virtual Firewall
Cluster Staging and Provisioning in Hyper-V | 222
Deploying the VMs and Additional Network Adapters in Hyper-V | 223 Creating
the Control Link Connection in Hyper-V | 223 Creating the Fabric Link
Connection in Hyper-V | 226 Creating the Data Interfaces Using Hyper-V | 227
Prestaging the Configuration from the Console | 228 Connecting and Installing
the Staging Configuration | 229
Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS | 230 Chassis
Cluster Overview | 230 Enable Chassis Cluster Formation | 231 Chassis Cluster
Quick Setup with J-Web | 237 Manually Configure a Chassis Cluster with J-Web |
237
4
vSRX Virtual Firewall Deployment for Contrail
Overview of vSRX Virtual Firewall Service Chains in Contrail | 245
Understand vSRX Virtual Firewall with Contrail | 245
Requirements for vSRX Virtual Firewall on Contrail | 247
Overview of Service Chains with vSRX Virtual Firewall | 256
Spawn vSRX Virtual Firewall in a Contrail Service Chain | 259 Create a Service
Template | 259 Create Left and Right Virtual Networks | 262 Create a vSRX
Virtual Firewall Service Instance | 263 Create a Network Policy | 263 Add a
Network Policy to a Virtual Network | 264
Install vSRX Virtual Firewall in Contrail | 267
viii
Enable Nested Virtualization | 267
Create an Image Flavor with OpenStack | 269 Create an Image Flavor for vSRX
Virtual Firewall with Horizon | 269 Create an Image Flavor for vSRX Virtual
Firewall with the Nova CLI | 272
Upload the vSRX Virtual Firewall Image | 273 Upload the vSRX Virtual Firewall
Image with OpenStack Horizon | 273 Upload the vSRX Virtual Firewall Image with
the OpenStack Glance CLI | 276
Use Cloud-Init in an OpenStack Environment to Automate the Initialization of
vSRX Virtual Firewall Instances | 277
Perform Automatic Setup of a vSRX Virtual Firewall Instance Using an OpenStack
CommandLine Interface | 280
Perform Automatic Setup of a vSRX Virtual Firewall Instance from the OpenStack
Dashboard (Horizon) | 282
vSRX Virtual Firewall VM Management with Contrail | 291 Connect to the vSRX
Virtual Firewall Management Console | 291
Connect to the vSRX Virtual Firewall Management Console with Horizon | 291
Connect to the vSRX Virtual Firewall Management Console with Contrail | 291
Manage the vSRX Virtual Firewall VM | 292
Power On the VM from OpenStack | 292 Pause the VM | 293 Restart the VM | 293
Power Off the VM from OpenStack | 293 Delete the vSRX Virtual Firewall VM from
Contrail | 293
Upgrade Multicore vSRX Virtual Firewall with Contrail | 294 Configure Multi-
queue Virtio Interface for vSRX Virtual Firewall VM with OpenStack | 294
Modify an Image Flavor for vSRX Virtual Firewall with the Dashboard | 295
Update a Service Template | 296
Monitor vSRX Virtual Firewall with Contrail | 297
5
vSRX Virtual Firewall Deployment for Nutanix
Overview | 299
Understand vSRX Virtual Firewall Deployment with Nutanix | 299
Nutanix Platform Overview | 299
ix
vSRX Virtual Firewall Deployment with Nutanix Overview | 302 Understand vSRX
Virtual Firewall Deployment with Nutanix AHV | 304 Sample vSRX Virtual
Firewall Deployment Using Nutanix AHV | 306
Requirements for vSRX Virtual Firewall on Nutanix | 307 System Requirements
for Nutanix | 307 Reference Requirements | 310
Install vSRX Virtual Firewall in Nutanix | 312 Launch and Deploy vSRX Virtual
Firewall in Nutanix AHV Cluster | 312
Log In to Nutanix Setup | 312 Adding a vSRX Virtual Firewall Image | 314
Network Creation | 314 Create and Deploy a vSRX Virtual Firewall VM | 315
Power on the vSRX Virtual Firewall VMs | 322 Launch vSRX Virtual Firewall VM
Console | 323
Upgrade the Junos OS for vSRX Virtual Firewall Software Release | 324
6
vSRX Virtual Firewall Deployment for AWS
Overview | 326
Understand vSRX Virtual Firewall with AWS | 326
Requirements for vSRX Virtual Firewall on AWS | 332
Configure and Manage Virtual Firewall in AWS | 337 Configure an Amazon Virtual
Private Cloud for vSRX Virtual Firewall | 337
Step 1: Create an Amazon VPC and Internet Gateway | 338 Step 2: Add Subnets
for vSRX Virtual Firewall | 340 Step 3: Attach an interface to a Subnet | 341
Step 4: Add Route Tables for vSRX Virtual Firewall | 344 Step 5: Add Security
Groups for vSRX Virtual Firewall | 345
Launch a vSRX Virtual Firewall Instance on an Amazon Virtual Private Cloud |
348
Step 1: Create an SSH Key Pair | 348 Step 2: Launch a vSRX Virtual Firewall
Instance | 350 Step 3: View the AWS System Logs | 354 Step 4: Add Network
Interfaces for vSRX Virtual Firewall | 354 Step 5: Allocate Elastic IP
Addresses | 356
x
Step 6: Add the vSRX Virtual Firewall Private Interfaces to the Route Tables |
356 Step 7: Reboot the vSRX Virtual Firewall Instance | 357 Step 8: Log in to
a vSRX Virtual Firewall Instance | 357
Enroll a vSRX Virtual Firewall on AWS with Juniper ATP Cloud | 359
Using Cloud-Init to Automate the Initialization of vSRX Virtual Firewall
Instances in AWS | 364
AWS Elastic Load Balancing and Elastic Network Adapter | 366 Overview of AWS
Elastic Load Balancing | 367 Overview of Application Load Balancer | 369
Deployment of AWS Application Load Balancer | 370 Invoking Cloud Formation
Template (CFT) Stack Creation for vSRX Virtual Firewall Behind AWS Application
Load Balancer Deployment | 374 Overview of AWS Elastic Network Adapter (ENA)
for vSRX Virtual Firewall Instances | 383
Multi-Core Scaling Support on AWS with SWRSS and ENA | 384
Centralized Monitoring and Troubleshooting using AWS Features | 385
Understanding Centralized Monitoring Using Cloudwatch | 385 Integration of
vSRX Virtual Firewall with AWS Monitoring and Troubleshooting Features | 393
Grant Permission for vSRX Virtual Firewall to access AWS CloudWatch and
Security Hub | 393 Enable Monitoring of vSRX Virtual Firewall Instances with
AWS CloudWatch Metric | 395 Collect, Store, and View vSRX Virtual Firewall
Logs to AWS CloudWatch | 396 Enable and Configure Security Hub on vSRX Virtual
Firewall | 397
Deploying vSRX Virtual Firewall 3.0 for Securing Data using AWS KMS | 398
Integrate AWS KMS with vSRX Virtual Firewall 3.0 | 398 AWS Cloud Formation
Templates | 402
Configure vSRX Virtual Firewall Using the CLI | 406 Understand vSRX Virtual
Firewall on AWS Preconfiguration and Factory Defaults | 406 Add a Basic vSRX
Virtual Firewall Configuration | 407 Add DNS Servers | 410 Add vSRX Virtual
Firewall Feature Licenses | 410
Configure vSRX Virtual Firewall Using the J-Web Interface | 411 Access the
J-Web Interface and Configure vSRX Virtual Firewall | 411 Apply the
Configuration Settings for vSRX Virtual Firewall | 413 Add vSRX Virtual
Firewall Feature Licenses | 414
xi
Upgrade Junos OS Software on a vSRX Virtual Firewall Instance | 414 Upgrade
the Junos OS for vSRX Virtual Firewall Software Release | 414 Replace the vSRX
Virtual Firewall Instance on AWS | 415
Remove a vSRX Virtual Firewall Instance on AWS | 416
AWS Gateway Load Balancing with Geneve | 433 Overview of AWS Gateway Load
Balancer | 433 AWS GWLB with Geneve vSRX Virtual Firewall 3.0 Deployment | 435
Virtual Firewall in AWS Use Cases | 437 Example: Configuring NAT for vSRX
Virtual Firewall | 437
Before You Begin | 437 Overview | 437 Configuration | 438 Configuring NAT |
438
Example: Configure VPN on vSRX Virtual Firewall Between Amazon VPCs | 439
Before You Begin | 440 Overview | 440 vSRX1 VPN Configuration | 440
Verification | 444
Example: Configure Juniper ATP Cloud for vSRX Virtual Firewall | 445 Before
You Begin | 445 Overview | 445 Juniper ATP Cloud Configuration | 445
7
vSRX Virtual Firewall Deployment for Microsoft Azure
Overview | 449
Understand vSRX Virtual Firewall with Microsoft Azure Cloud | 449
xii
Requirements for vSRX Virtual Firewall on Microsoft Azure | 453 Deploy vSRX
Virtual Firewall from the Azure Portal | 461 Before You Deploy vSRX Virtual
Firewall from the Azure Portal | 461 Create a Resource Group | 462 Create a
Storage Account | 466 Create a Virtual Network | 471 Deploy the vSRX Virtual
Firewall Image from Azure Marketplace | 476
Deploy the vSRX Virtual Firewall Image | 476 Verify Deployment of vSRX Virtual
Firewall to Microsoft Azure | 489 Log In to a vSRX Virtual Firewall VM | 490
Deploy vSRX Virtual Firewall from the Azure CLI | 493 Before You Deploy vSRX
Virtual Firewall Using the Azure CLI | 493 Deploy vSRX Virtual Firewall from
the Azure CLI | 495 Install the Microsoft Azure CLI | 496 Download the vSRX
Virtual Firewall Deployment Tools | 497 Change Parameter Values in the vSRX
Virtual Firewall.parameter.json File | 498 Deploy the vSRX Virtual Firewall
Using the Shell Script | 502 Verify Deployment of vSRX Virtual Firewall to
Microsoft Azure | 504 Log In to a vSRX Virtual Firewall Instance | 507
Configure and Manage vSRX Virtual Firewall for Microsoft Azure | 509 Configure
vSRX Virtual Firewall Using the CLI | 509 Configure vSRX Virtual Firewall
Using the J-Web Interface | 511 Access the J-Web Interface and Configuring
vSRX Virtual Firewall | 512 Apply the Configuration | 514 Add vSRX Virtual
Firewall Feature Licenses | 515 Remove a vSRX Virtual Firewall Instance from
Microsoft Azure | 515 Upgrade Junos OS Software on a vSRX Virtual Firewall
Instance | 515 Upgrade the Junos OS for vSRX Virtual Firewall Software Release
| 516 Replace the vSRX Virtual Firewall Instance on Azure | 516 Configure
Azure Features on vSRX Virtual Firewall and Use Cases | 518
xiii
Deployment of Microsoft Azure Hardware Security Module on vSRX Virtual
Firewall 3.0 | 518
Microsoft Azure Key Vault Hardware Security Module Integration Overview | 519
Configure Microsoft Azure Key Vault HSM on vSRX Virtual Firewall 3.0 | 520
Change the Master Encryption Password | 524 Verify the Status of the HSM | 524
request security hsm master-encryption-password | 525 show security hsm status
| 526 Understanding VPN Functionality with Microsoft Azure Key Vault HSM
Service | 529 CLI Behavior With and Without HSM | 533 request security pki
local-certificate enroll scep | 534
Example: Configure an IPsec VPN Between Two vSRX Virtual Firewall Instances |
538 Before You Begin | 538 Overview | 538 vSRX Virtual Firewall IPsec VPN
Configuration | 539 Verification | 542
Example: Configure an IPsec VPN Between a vSRX Virtual Firewall and Virtual
Network Gateway in Microsoft Azure | 543
Before You Begin | 544 Overview | 544 vSRX Virtual Firewall IPsec VPN
Configuration | 544 Microsoft Azure Virtual Network Gateway Configuration |
546
Example: Configure Juniper ATP Cloud for vSRX Virtual Firewall | 548 Before
You Begin | 548 Overview | 548 Juniper ATP Cloud Configuration | 548
8
vSRX Virtual Firewall Deployment for Google Cloud Platform
Overview | 552
Understand vSRX Virtual Firewall Deployment with Google Cloud | 552
Understand vSRX Virtual Firewall Deployment with Google Cloud Platform | 552
Requirements for vSRX Virtual Firewall on Google Cloud Platform | 555 Google
Compute Engine Instance Types | 555 vSRX Virtual Firewall Support for Google
Cloud | 556 vSRX Virtual Firewall Specifications for GCP | 557
xiv
Install vSRX Virtual Firewall in Google Cloud | 560 Prepare to setup vSRX
Virtual Firewall Deployment on GCP | 560
Step 1: Google Cloud Platform Account Planning | 562 Step 2: Define Network
Attributes and Generate SSH Key Pair for Authentication | 563 Step 3: Plan
Google Virtual Private Cloud (VPC) Network | 565
Deploy vSRX Virtual Firewall in Google Cloud Platform | 566
Deploy the vSRX Virtual Firewall Firewall from Marketplace Launcher | 566
Deploy the vSRX Virtual Firewall Instance from GCP Portal Using Custom Private
Image | 574
Upload vSRX Virtual Firewall Image to Google Cloud Storage | 574 Create vSRX
Virtual Firewall Image | 576 Deploy the vSRX Virtual Firewall Firewall from
GCP Portal | 578 Deploy the vSRX Virtual Firewall Firewall Using Cloud-init |
580
Upgrade the Junos OS for vSRX Virtual Firewall Software Release | 583
Secure Data with vSRX Virtual Firewall 3.0 Using GCP KMS (HSM) | 584 Overview
| 584 Integrate GCP KMS with vSRX Virtual Firewall 3.0 | 586 Verify the Status
of the HSM | 589 show security hsm status | 590 | 592 request security hsm
master-encryption-password | 592
9
vSRX Virtual Firewall Deployment for IBM Cloud
Overview | 595
vSRX Virtual Firewall Overview | 595
Getting Started with Juniper vSRX Virtual Firewall on IBM Cloud | 598 Overview
of vSRX Virtual Firewall in IBM Cloud | 598 Choosing a vSRX Virtual Firewall
license | 600 Ordering a vSRX Virtual Firewall | 602
Junos OS Features Supported on vSRX Virtual Firewall | 604
Installing and Configuring vSRX Virtual Firewall in IBM | 618 Performing vSRX
Virtual Firewall Basics in IBM Cloud | 618
Viewing all gateway appliances | 619
xv
Viewing gateway appliance details | 619 Renaming a gateway appliance | 619
Canceling a gateway appliance | 620 Performing additional vSRX Virtual
Firewall tasks | 620
vSRX Virtual Firewall Readiness Checks in IBM Cloud | 623 Checking vSRX
Virtual Firewall readiness | 623 Readiness status | 624 Correcting readiness
errors | 624
Managing VLANs with a gateway appliance | 626 Associating a VLAN to a gateway
appliance | 626 Routing an associated VLAN | 626 Bypassing gateway appliance
routing for a VLAN | 627 Disassociating a VLAN from a gateway appliance | 627
Working with the vSRX Virtual Firewall Default Configurations | 628
Understanding the vSRX Virtual Firewall default configuration | 628 Importing
and Exporting a vSRX Virtual Firewall Configuration | 629 Exporting part of
the vSRX Virtual Firewall configuration | 630 Importing the entire vSRX
Virtual Firewall configuration | 631 Importing part of the vSRX Virtual
Firewall configuration | 631
Migrating Legacy Configurations to the Current vSRX Virtual Firewall
Architecture | 633 Migrating 1G vSRX Virtual Firewall Standalone
Configurations | 633 Migrating 1G vSRX Virtual Firewall High Availability
configurations | 641
Allowing SSH and Ping to a Public Subnet | 642 Allowing SSH and Ping to a
Public Subnet | 642
Performing vSRX Virtual Firewall Advanced Tasks in IBM Cloud | 643 Working
with Firewalls | 643 Zone Policies | 644 Firewall Filters | 645 Working with
sNAT | 645 Working with Failover | 645 Working with Routing | 647 Working with
VPN | 648
xvi
Securing the Host Operating System | 654 Configuring the Management Interfaces
| 656
Upgrading the vSRX Virtual Firewall in IBM Cloud | 657 Upgrading | 657 General
Upgrade Considerations | 660 Upgrading using OS Reload | 663 Rollback Options
| 664 Unsupported Upgrades | 664
Managing vSRX Virtual Firewall in IBM Cloud | 666 vSRX Virtual Firewall
Configuration and Management Tools | 666
Managing Security Policies for Virtual Machines Using Junos Space Security
Director | 667
xvii
About This Guide
vSRX Virtual Firewall is the virtualized form of the Juniper Networks next-
generation firewall. It is positioned for use in a virtualized or cloud
environment where it can protect and secure east-west and north-south traffic.
This guide provides you details on deployment of vSRX Virtual Firewall on
various private and public cloud platforms.
1 PART
vSRX Virtual Firewall Deployment for KVM
Overview | 2 Install vSRX Virtual Firewall in KVM | 19 vSRX Virtual Firewall
VM Management with KVM | 62 Configure vSRX Virtual Firewall Chassis Clusters
on KVM | 89
2
CHAPTER 1
Overview
IN THIS CHAPTER Understand vSRX Virtual Firewall with KVM | 2 Requirements for
vSRX Virtual Firewall on KVM | 7
Understand vSRX Virtual Firewall with KVM
IN THIS SECTION vSRX Virtual Firewall on KVM | 2 vSRX Virtual Firewall Scale
Up Performance | 3
This section presents an overview of vSRX Virtual Firewall on KVM.
vSRX Virtual Firewall on KVM
The Linux kernel uses the kernel-based virtual machine (KVM) as a
virtualization infrastructure. KVM is open source software that you can use to
create multiple virtual machines (VMs) and to install security and networking
appliances. The basic components of KVM include: · A loadable kernel module
included in the Linux kernel that provides the basic virtualization
infrastructure · A processor-specific module When loaded into the Linux
kernel, the KVM software acts as a hypervisor. KVM supports multitenancy and
allows you to run multiple vSRX Virtual Firewall VMs on the host OS. KVM
manages and shares the system resources between the host OS and the multiple
vSRX Virtual Firewall VMs.
3
NOTE: vSRX Virtual Firewall requires you to enable hardware-based
virtualization on a host OS that contains an Intel Virtualization Technology
(VT) capable processor. Figure 1 on page 3 illustrates the basic structure of
a vSRX Virtual Firewall VM on an Ubuntu server. Figure 1: vSRX Virtual
Firewall VM on Ubuntu
vSRX Virtual Firewall Scale Up Performance
Table 1 on page 3 shows the vSRX Virtual Firewall scale up performance when
deployed on KVM, based on the number of vCPUs and vRAM applied to a vSRX
Virtual Firewall VM along with the Junos OS release in which a particular vSRX
Virtual Firewall software specification was introduced.
Table 1: vSRX Virtual Firewall Scale Up Performance
vCPUs
vRAM
NICs
Release Introduced
2 vCPUs
4 GB
· Virtio
· SR-IOV (Intel 82599, X520/540)
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1
4
Table 1: vSRX Virtual Firewall Scale Up Performance (Continued)
vCPUs
vRAM
NICs
Release Introduced
5 vCPUs
8 GB
· Virtio
· SR-IOV (Intel 82599, X520/540)
Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1
5 vCPUs
8 GB
· SR-IOV (Intel X710/ XL710)
Junos OS Release 15.1X49-D90 and Junos OS Release 17.3R1
1 vCPU 4 vCPUs
4 GB 8 GB
SR-IOV on the Mellanox ConnectX-4 and ConnectX-5 family adapters.
Junos OS Release 21.2R1
SR-IOV on the Mellanox ConnectX-4 and ConnectX-5 family adapters.
Junos OS Release 21.2R1
8 vCPUs
16GB
SR-IOV on the Mellanox ConnectX-4 and ConnectX-5 family adapters.
Junos OS Release 21.2R1
16 vCPUs
32 GB
SR-IOV on the Mellanox ConnectX-4 and ConnectX-5 family adapters.
Junos OS Release 21.2R1
You can scale the performance and capacity of a vSRX Virtual Firewall instance
by increasing the number of vCPUs and the amount of vRAM allocated to the vSRX
Virtual Firewall. The multi-core vSRX Virtual Firewall automatically selects
the appropriate vCPUs and vRAM values at boot time, as well as the number of
Receive Side Scaling (RSS) queues in the NIC. If the vCPU and vRAM settings
allocated to a vSRX Virtual Firewall VM do not match what is currently
available, the vSRX Virtual Firewall scales down to the closest supported
value for the instance. For example, if a vSRX Virtual Firewall VM has 3 vCPUs
and 8 GB of vRAM, vSRX Virtual Firewall boots to the smaller vCPU size, which
requires a minimum of 2 vCPUs. You can scale up a vSRX Virtual Firewall
instance to a higher number of vCPUs
5
and amount of vRAM, but you cannot scale down an existing vSRX Virtual
Firewall instance to a smaller setting.
NOTE: The number of RSS queues typically matches with the number of data plane
vCPUs of a vSRX Virtual Firewall instance. For example, a vSRX Virtual
Firewall with 4 data plane vCPUs should have 4 RSS queues.
vSRX Virtual Firewall Session Capacity Increase
vSRX Virtual Firewall solution is optimized to increase the session numbers by
increasing the memory.
With the ability to increase the session numbers by increasing the memory, you
can enable vSRX Virtual Firewall to:
· Provide highly scalable, flexible and high-performance security at strategic
locations in the mobile network.
· Deliver the performance that service providers require to scale and protect
their networks. Run the show security flow session summary | grep maximum
command to view the maximum number of sessions.
Starting in Junos OS Release 18.4R1, the number of flow sessions supported on
a vSRX Virtual Firewall instance is increased based on the vRAM size used.
Starting in Junos OS Release 19.2R1, the number of flow sessions supported on
a vSRX Virtual Firewall 3.0 instance is increased based on the vRAM size used.
NOTE: Maximum of 28M sessions are supported on vSRX Virtual Firewall 3.0. You
can deploy vSRX Virtual Firewall 3.0 with more than 64G memory, but the
maximum flow sessions can still be only 28M.
Table 2 on page 5 lists the flow session capacity. Table 2: vSRX Virtual
Firewall and vSRX Virtual Firewall 3.0 Flow Session Capacity Details
Starting in Junos OS Release 19.2R1, the number of flow sessions supported on
a vSRX Virtual Firewall 3.0 instance is increased based on the vRAM size used.
18.4R1
Starting in Junos OS Release 18.4R1, the number of flow sessions supported on
a vSRX Virtual Firewall instance is increased based on the vRAM size used.
RELATED DOCUMENTATION Requirements for vSRX Virtual Firewall on KVM | 7
Upgrade a Multi-core vSRX Virtual Firewall | 78 Install vSRX Virtual Firewall
with KVM | 21
Requirements for vSRX Virtual Firewall on KVM
IN THIS SECTION Software Specifications | 7 Hardware Specifications | 13 Best
Practices for Improving vSRX Virtual Firewall Performance | 14 Interface
Mapping for vSRX Virtual Firewall on KVM | 16 vSRX Virtual Firewall Default
Settings on KVM | 18
This section presents an overview of requirements for deploying a vSRX Virtual
Firewall instance on KVM;
Software Specifications
No Link Title lists the system software requirement specifications when
deploying vSRX Virtual Firewall in a KVM environment. The table outlines the
Junos OS release in which a particular software specification for deploying
vSRX Virtual Firewall on KVM was introduced. You will need to download a
specific Junos OS release to take advantage of certain features.
8
CAUTION: A Page Modification Logging (PML) issue related to the KVM host
kernel might prevent the vSRX Virtual Firewall from successfully booting. If
you experience this behavior with the vSRX Virtual Firewall, we recommend that
you disable the PML at the host kernel level. See Prepare Your Server for vSRX
Installation for details about disabling the PML as part of enabling nested
virtualization.
Table 3: Feature Support on vSRX Virtual Firewall
Features
Specification
Junos OS Release Introduced
vCPUs/Memory
2 vCPU / 4 GB RAM
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 (vSRX Virtual
Firewall)
5 vCPU / 8 GB RAM
Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1 (vSRX Virtual
Firewall)
9 vCPU / 16 GB RAM
Junos OS Release 18.4R1 (vSRX Virtual Firewall)
Junos OS Release 19.1R1 (vSRX Virtual Firewall 3.0)
17 vCPU / 32 GB RAM
Junos OS Release 18.4R1 (vSRX Virtual Firewall)
Junos OS Release 19.1R1 (vSRX Virtual Firewall 3.0)
Flexible flow session capacity
NA
scaling by an additional vRAM
Junos OS Release 19.1R1 (vSRX Virtual Firewall)
Junos OS Release 19.2R1 (vSRX Virtual Firewall 3.0)
Multicore scaling support (Software NA RSS)
Junos OS Release 19.3R1 (vSRX Virtual Firewall 3.0 only)
9
Table 3: Feature Support on vSRX Virtual Firewall (Continued)
Features
Specification
Reserve additional vCPU cores for NA the Routing Engine (vSRX Virtual Firewall
and vSRX Virtual Firewall 3.0)
Junos OS Release Introduced
Virtio (virtio-net, vhost-net) (vSRX NA Virtual Firewall and vSRX Virtual
Firewall 3.0)
Supported Hypervisors Linux KVM Hypervisor support
Ubuntu 14.04.5, 16.04, and 16.10 Junos OS Release 18.4R1
Other Features Cloud-init
Ubuntu 18.04 and 20.04
Junos OS Release 20.4R1
Red Hat Enterprise Linux (RHEL) 7.3
Junos OS Release 18.4R1
Red Hat Enterprise Linux (RHEL) 7.6 and 7.7
Junos OS Release 19.2R1
Red Hat Enterprise Linux (RHEL) 8.2
Junos OS Release 20.4R1
CentOS 7.1, 7.2, 7.6, and 7.7
Junos OS Release 19.2R1
NA
Powermode IPSec (PMI)
NA
Chassis cluster
NA
10
Table 3: Feature Support on vSRX Virtual Firewall (Continued)
Features
Specification
GTP TEID based session
NA
distribution using Software RSS
Junos OS Release Introduced
Yes (Junos OS Release 19.3R1 onwards)
On-device antivirus scan engine
NA
(Avira)
Yes (Junos OS Release 19.4R1 onwards)
LLDP
NA
Junos Telemetry Interface
NA
System Requirements
Hardware acceleration/enabled
NA
VMX CPU flag in the hypervisor
Yes (Junos OS Release 21.1R1 onwards)
Yes (Junos OS Release 20.3R1 onwards)
Disk space
16 GB (IDE or SCSI drives) (vSRX Virtual Firewall)
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1
18 GB (vSRX Virtual Firewall 3.0)
Table 4: vNIC Support on vSRX Virtual Firewall
vNICs
Release Introduced
Virtio SA and HA
SR-IOV SA and HA over Intel 82599/X520 series
Junos OS Release 15.1X49-D90 and Junos OS Release 17.3R1
SR-IOV SA and HA over Intel X710/XL710/XXV710 series
Junos OS Release 15.1X49-D90
SR-IOV SA over Intel E810 series
Junos OS Release 18.1R1
11
Table 4: vNIC Support on vSRX Virtual Firewall (Continued)
vNICs
Release Introduced
SR-IOV HA over Intel E810 series
unos OS Release 18.1R1
SR-IOV SA and HA over Mellanox ConnectX-3
Not supported
SR-IOV SA and HA over Mellanox ConnectX-4/5/6 (MLX5 driver only)
Junos OS Release 18.1R1 (vSRX Virtual Firewall)
Junos OS Release 21.2R1 onwards on vSRX Virtual Firewall 3.0
PCI passthrough over Intel 82599/X520 series PCI passthrough over Intel
X710/XL710 series Data Plane Development Kit (DPDK) version 17.05
Not supported Not supported Junos OS Release 18.2R1
Data Plane Development Kit (DPDK) version 18.11
Junos OS Release 19.4R1
Starting in Junos OS Release 19.4R1, DPDK version 18.11 is supported on vSRX
Virtual Firewall. With this feature the Mellanox Connect Network Interface
Card (NIC) on vSRX Virtual Firewall now supports OSPF Multicast and VLANs.
Data Plane Development Kit (DPDK) version 20.11
Junos OS Release 21.2R1
Starting in Junos OS Release 21.2R1, we’ve upgraded the Data Plane Development
Kit (DPDK) from version 18.11 to version 20.11. The new version supports ICE
Poll Mode Driver (PMD), which enables the physical Intel E810 series 100G NIC
support on vSRX Virtual Firewall 3.0.
NOTE: A vSRX Virtual Firewall on KVM deployment requires you to enable
hardware-based virtualization on a host OS that contains an Intel
Virtualization Technology (VT) capable processor. You can verify CPU
compatibility here: http://www.linux-kvm.org/page/ Processor_support
12
No Link Title lists the specifications on the vSRX Virtual Firewall VM.
Starting in Junos OS Release 19.1R1, the vSRX Virtual Firewall instance
supports guest OS using 9 or 17 vCPUs with single-root I/O virtualization over
Intel X710/XL710 on Linux KVM hypervisor for improved scalability and
performance.
KVM Kernel Recommendations for vSRX Virtual Firewall
Table 5 on page 12 lists the recommended Linux kernel version for your Linux
host OS when deploying vSRX Virtual Firewall on KVM. The table outlines the
Junos OS release in which support for a particular Linux kernel version was
introduced.
Table 5: Kernel Recommendations for KVM
Linux Distributi on
Linux Kernel Version
Supported Junos OS Release
CentOS
3.10.0.229
Upgrade the Linux kernel to capture the recommended version.
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release
Ubuntu
3.16
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release
4.4
Junos OS Release 15.1X49-D15 and Junos OS
Release 17.3R1 or later release
18.04
Junos OS Release 20.4R1 or later release
20.04
Junos OS Release 20.4R1 or later release
RHEL
3.10
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release
13
Additional Linux Packages for vSRX Virtual Firewall on KVM
Table 6 on page 13 lists the additional packages you need on your Linux host
OS to run vSRX Virtual Firewall on KVM. See your host OS documentation for how
to install these packages if they are not present on your server.
Table 6: Additional Linux Packages for KVM
Package
Version
Download Link
libvirt
0.10.0
libvirt download
virt-manager (Recommended)
0.10.0
virt-manager download
Hardware Specifications
Table 7 on page 13 lists the hardware specifications for the host machine that
runs the vSRX Virtual Firewall VM.
Table 7: Hardware Specifications for the Host Machine
Component
Specification
Host processor type
Intel x86_64 multi-core CPU
NOTE: DPDK requires Intel Virtualization VT-x/VT-d support in the CPU. See
About Intel Virtualization Technology.
14
Table 7: Hardware Specifications for the Host Machine (Continued)
Component
Specification
Physical NIC support for vSRX Virtual Firewall and vSRX Virtual Firewall 3.0
· SR-IOV (Mellanox ConnectX-3/ConnectX-3 Pro and Mellanox ConnectX-4 EN/
ConnectX-4 Lx EN)
NOTE: If using SR-IOV with either the Mellanox ConnectX-3 or ConnectX-4 Family
Adapters, on the Linux host, if necessary, install the latest MLNX_OFED Linux
driver. See Mellanox OpenFabrics Enterprise Distribution for Linux
(MLNX_OFED).
NOTE: You must enable the Intel VT-d extensions to provide hardware support
for directly assigning physical devices per guest. See Configure SR-IOV and
PCI on KVM.
Physical NIC support for vSRX Virtual Firewall 3.0
Support SR-IOV on Intel X710/XL710/XXV710, and Intel E810.
Best Practices for Improving vSRX Virtual Firewall Performance
Review the following practices to improve vSRX Virtual Firewall performance.
NUMA Nodes
The x86 server architecture consists of multiple sockets and multiple cores
within a socket. Each socket has memory that is used to store packets during
I/O transfers from the NIC to the host. To efficiently read packets from
memory, guest applications and associated peripherals (such as the NIC) should
reside within a single socket. A penalty is associated with spanning CPU
sockets for memory accesses, which might result in nondeterministic
performance. For vSRX Virtual Firewall, we recommend that all vCPUs for the
vSRX Virtual Firewall VM are in the same physical non-uniform memory access
(NUMA) node for optimal performance.
CAUTION: The Packet Forwarding Engine (PFE) on the vSRX Virtual Firewall will
become unresponsive if the NUMA nodes topology is configured in the hypervisor
to spread the instance’s vCPUs across multiple host NUMA nodes. vSRX Virtual
Firewall requires that you ensure that all vCPUs reside on the same NUMA node.
15
We recommend that you bind the vSRX Virtual Firewall instance with a specific
NUMA node by setting NUMA node affinity. NUMA node affinity constrains the
vSRX Virtual Firewall VM resource scheduling to only the specified NUMA node.
Mapping Virtual Interfaces to a vSRX Virtual Firewall VM To determine which
virtual interfaces on your Linux host OS map to a vSRX Virtual Firewall VM: 1.
Use the virsh list command on your Linux host OS to list the running VMs.
hostOS# virsh list
Id Name
State
—————————————————-
9 centos1
running
15 centos2
running
16 centos3
running
48 vsrx
running
50 1117-2
running
51 1117-3
running
2. Use the virsh domiflist vsrx-name command to list the virtual interfaces
on that vSRX Virtual Firewall VM.
hostOS# virsh domiflist vsrx
Interface Type
Source Model
MAC
——————————————————-
vnet1
bridge brem2
virtio
52:54:00:8f:75:a5
vnet2
bridge br1
virtio
52:54:00:12:37:62
vnet3
bridge brconnect virtio
52:54:00:b2:cd:f4
NOTE: The first virtual interface maps to the fxp0 interface in Junos OS.
16
Interface Mapping for vSRX Virtual Firewall on KVM
Each network adapter defined for a vSRX Virtual Firewall is mapped to a
specific interface, depending on whether the vSRX Virtual Firewall instance is
a standalone VM or one of a cluster pair for high availability. The interface
names and mappings in vSRX Virtual Firewall are shown in Table 8 on page 16
and Table 9 on page 17.
Note the following:
· In standalone mode:
· fxp0 is the out-of-band management interface.
· ge-0/0/0 is the first traffic (revenue) interface.
· In cluster mode:
· fxp0 is the out-of-band management interface.
· em0 is the cluster control link for both nodes.
· Any of the traffic interfaces can be specified as the fabric links, such as
ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.
Table 8 on page 16 shows the interface names and mappings for a standalone
vSRX Virtual Firewall VM. Table 8: Interface Names for a Standalone vSRX
Virtual Firewall VM
Network Adapter
Interface Name in Junos OS for vSRX Virtual Firewall
1
fxp0
2
ge-0/0/0
3
ge-0/0/1
4
ge-0/0/2
5
ge-0/0/3
17
Table 8: Interface Names for a Standalone vSRX Virtual Firewall VM (Continued)
Network Adapter
Interface Name in Junos OS for vSRX Virtual Firewall
6
ge-0/0/4
7
ge-0/0/5
8
ge-0/0/6
Table 9 on page 17 shows the interface names and mappings for a pair of vSRX
Virtual Firewall VMs in a cluster (node 0 and node 1).
Table 9: Interface Names for a vSRX Virtual Firewall Cluster Pair
Network Adapter
Interface Name in Junos OS for vSRX Virtual Firewall
1
fxp0 (node 0 and 1)
2
em0 (node 0 and 1)
3
ge-0/0/0 (node 0)
ge-7/0/0 (node 1)
4
ge-0/0/1 (node 0)
ge-7/0/1 (node 1)
5
ge-0/0/2 (node 0)
ge-7/0/2 (node 1)
6
ge-0/0/3 (node 0)
ge-7/0/3 (node 1)
7
ge-0/0/4 (node 0)
ge-7/0/4 (node 1)
18
Table 9: Interface Names for a vSRX Virtual Firewall Cluster Pair (Continued)
Network Adapter
Interface Name in Junos OS for vSRX Virtual Firewall
8
ge-0/0/5 (node 0)
ge-7/0/5 (node 1)
vSRX Virtual Firewall Default Settings on KVM
vSRX Virtual Firewall requires the following basic configuration settings: ·
Interfaces must be assigned IP addresses. · Interfaces must be bound to zones.
· Policies must be configured between zones to permit or deny traffic. Table
10 on page 18 lists the factory-default settings for security policies on the
vSRX Virtual Firewall. Table 10: Factory Default Settings for Security
Policies
Source Zone
Destination Zone
Policy Action
trust
untrust
permit
trust
trust
permit
untrust
trust
deny
RELATED DOCUMENTATION About Intel Virtualization Technology DPDK Release Notes
19
CHAPTER 2
Install vSRX Virtual Firewall in KVM
IN THIS CHAPTER Prepare Your Server for vSRX Virtual Firewall Installation |
19 Install vSRX Virtual Firewall with KVM | 21 Example: Install and Launch
vSRX Virtual Firewall on Ubuntu | 27 Load an Initial Configuration on a vSRX
Virtual Firewall with KVM | 45 Use Cloud-Init in an OpenStack Environment to
Automate the Initialization of vSRX Virtual Firewall Instances | 48
Prepare Your Server for vSRX Virtual Firewall Installation
IN THIS SECTION Enable Nested Virtualization | 19 Upgrade the Linux Kernel on
Ubuntu | 21
Enable Nested Virtualization
We recommend that you enable nested virtualization on your host OS or
OpenStack compute node. Nested virtualization is enabled by default on Ubuntu
but is disabled by default on CentOS. Use the following command to determine
if nested virtualization is enabled on your host OS. The result should be Y.
hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y
20
NOTE: APIC virtualization (APICv) does not work well with nested VMs such as
those used with KVM. On Intel CPUs that support APICv (typically v2 models,
for example E5 v2 and E7 v2), you must disable APICv on the host server before
deploying vSRX Virtual Firewall.
To enable nested virtualization on the host OS: 1. Depending on your host
operating system, perform the following:
· On CentOS, open the /etc/modprobe.d/dist.conf file in your default editor.
hostOS# vi /etc/modprobe.d/dist.conf · On Ubuntu, open the /etc/modprobe.d
/qemu-system-x86.conf file in your default editor.
hostOS# vi /etc/modprobe.d/qemu-system-x86.conf 2. Add the following line to
the file:
hostOS# options kvm-intel nested=y enable_apicv=n
NOTE: A Page Modification Logging (PML) issue related to the KVM host kernel
might prevent the vSRX Virtual Firewall from successfully booting. We
recommend that you add the following line to the file instead of the line
listed above in Step 2: hostOS# options kvm-intel nested=y enable_apicv=n
pml=n
3. Save the file and reboot the host OS. 4. (Optional) After the reboot,
verify that nested virtualization is enabled.
hostOS# cat /sys/module/kvm_intel/parameters/nested
hostOS# Y
21
5. On Intel CPUs that support APICv ( for example, E5 v2 and E7 v2), disable
APICv on the host OS.
root@host# sudo rmmod kvm-intel root@host# sudo sh -c “echo ‘options kvm-intel
enable_apicv=n’ >> /etc/modprobe.d/dist.conf” root@host# sudo modprobe kvm-
intel 6. Optionally, verify that APICv is now disabled.
root@host# cat /sys/module/kvm_intel/parameters/enable_apicv
N
Upgrade the Linux Kernel on Ubuntu
To upgrade to the latest stable Linux kernel on Ubuntu: 1. Get and install the
available updated kernel.
hostOS:$ sudo apt-get install linux-image-generic-lts-utopic 2. Reboot the
host OS.
hostOS:$ reboot 3. Optionally, type uname -a in a terminal on your host OS to
verify that the host OS is using the latest
kernel version. hostOS:$ uname -a
3.16.0-48-generic
Install vSRX Virtual Firewall with KVM
IN THIS SECTION Install vSRX Virtual Firewall with virt-manager | 22 Install
vSRX Virtual Firewall with virt-install | 24
22 You use virt-manager or virt-install to install vSRX Virtual Firewall VMs.
See your host OS documentation for complete details on these packages.
NOTE: To upgrade an existing vSRX Virtual Firewall instance, see Migration,
Upgrade, and Downgrade in the vSRX Virtual Firewall Release Notes.
Install vSRX Virtual Firewall with virt-manager
Ensure that sure you have already installed KVM, qemu, virt-manager, and
libvirt on your host OS. You must also configure the required virtual networks
and storage pool in the host OS for the vSRX Virtual Firewall VM. See your
host OS documentation for details. You can install and launch vSRX Virtual
Firewall with the KVM virt-manager GUI package. To install vSRX Virtual
Firewall with virt-manager: 1. Download the vSRX Virtual Firewall QCOW2 image
from the Juniper software download site. 2. On your host OS, type virt-
manager. The Virtual Machine Manager appears. See Figure 2 on page
22. NOTE: You must have admin rights on the host OS to use virt-manager.
Figure 2: virt-manager
3. Click Create a new virtual machine as seen in Figure 3 on page 23. The New
VM wizard appears .
23
Figure 3: Create a New Virtual Machine
4. Select Import existing disk image, and click Forward. 5. Browse to the
location of the downloaded vSRX Virtual Firewall QCOW2 image and select the
vSRX Virtual Firewall image. 6. Select Linux from the OS type list and select
Show all OS options from the Version list. 7. Select Red Hat Enterprise Linux
7 from the expanded Version list and click Forward. 8. Set the RAM to 4096 MB
and set CPUs to 2. Click Forward. 9. Set the disk image size to 16 GB and
click Forward. 10. Name the vSRX Virtual Firewall VM, and select Customize
this configuration before install to
change parameters before you create and launch the VM. Click Finish. The
Configuration dialog box appears. 11. Select Processor and expand the
Configuration list. 12. Select Copy Host CPU Configuration. 13. Set CPU
Feature invtsc to disabled on CPUs that support that feature. Set vmx to
require for optimal throughput. You can optionally set aes to require for
improved cryptographic throughput
NOTE: If the CPU feature option is not present in your version of virt-
manager, you need start and stop the VM once, and then edit the vSRX Virtual
Firewall VM XML file, typically found in /etc/libvirt/qemu directory on your
host OS. Use virsh edit to edit the VM XML file to configure <feature
policy=’require’ name=’vmx’/> under the element. Also add <feature
policy=’disable’ name=’invtsc’/> if your host OS supports this CPU flag. Use
the virsh capabilities command on your host OS to list the host OS and CPU
virtualization capabilities. The following example shows the relevant portion
of the vSRX Virtual Firewall XML file on a CentOS host:
SandyBridgeIntel
24
14\. Select the disk and expand Advanced Options. 15. Select IDE from the Disk
bus list. 16. Select the NIC, and select virtio from the Device model field.
This first NIC is the fpx0
(management) interface for vSRX Virtual Firewall. 17. Click Add Hardware to
add more virtual networks, and select virtio from the Device model list. 18.
Click Apply, and click x to close the dialog box. 19. Click Begin
Installation. The VM manager creates and launches the vSRX Virtual Firewall
VM.
NOTE: The default vSRX Virtual Firewall VM login ID is root with no password.
By default, if a DHCP server is on the network, it assigns an IP address to
the vSRX Virtual Firewall VM.
Install vSRX Virtual Firewall with virt-install
Ensure that sure you have already installed KVM, qemu, virt-install, and
libvirt on your host OS. You must also configure the required virtual networks
and storage pool in the host OS for the vSRX Virtual Firewall VM. See your
host OS documentation for details.
25
NOTE: You must have root access on the host OS to use the virt-install
command.
The virt-install and virsh tools are CLI alternatives to installing and
managing vSRX Virtual Firewall VMs on a Linux host. To install vSRX Virtual
Firewall with virt-install: 1. Download the vSRX Virtual Firewall QCOW2 image
from the Juniper software download site. 2. On your host OS, use the virt-
install command with the mandatory options listed in Table 11 on page
25.
NOTE: See the official virt-install documentation for a complete description
of available options.
Table 11: virt-install Options
Command Option
Description
–name name
Name the vSRX Virtual Firewall VM.
–ram megabytes
Allocate RAM for the VM, in megabytes.
–cpu cpu-model, cpu-flags Enable the vmx feature for optimal throughput. You
can also enable aes for improved cryptographic throughput.
NOTE: CPU flag support depends on your host OS and CPU.
Use virsh capabilities to list the virtualization capabilities of your host OS
and CPU.
–vcpus number
Allocate the number of vCPUs for the vSRX Virtual Firewall VM.
26
Table 11: virt-install Options (Continued)
Command Option
Description
–disk path
Specify disk storage media and size for the VM. Include the following options:
· size=gigabytes · device=disk · bus=ide · format=qcow2
–os-type os-type –os-variant os-type
Configure the guest OS type and variant.
–import
Create and boot the vSRX Virtual Firewall VM from an existing image.
The following example creates a vSRX Virtual Firewall VM with 4096 MB RAM, 2
vCPUs, and disk storage up to 16 GB:
hostOS# virt-install –name vSRXVM –ram 4096 –cpu SandyBridge,+vmx,-invtsc
–vcpus=2 -arch=x86_64 –disk
path=/mnt/vsrx.qcow2,size=16,device=disk,bus=ide,format=qcow2 –os-type linux
–os-variant rhel7 –import
The following example shows the relevant portion of the vSRX Virtual Firewall
XML file on a CentOS host:
SandyBridgeIntel
27
NOTE: The default vSRX Virtual Firewall VM login ID is root with no password.
By default, if a DHCP server is on the network, it assigns an IP address to
the vSRX Virtual Firewall VM.
RELATED DOCUMENTATION Installing a virtual machine using virt-install
Migration, Upgrade, and Downgrade Linux CPU Flags
Example: Install and Launch vSRX Virtual Firewall on Ubuntu
IN THIS SECTION Requirements | 28 Overview | 28 Quick Configuration – Install
and Launch a vSRX Virtual Firewall VM on Ubuntu | 29 | 32 Step by Step
Configuration | 32
28 This example shows how to install and launch a vSRX Virtual Firewall
instance on an Ubuntu server with KVM.
Requirements
This example uses the following hardware and software components: · Generic
x86 server · Junos OS Release 15.1X49-D20 for vSRX Virtual Firewall · Ubuntu
version 14.04.2 Before you begin: · This example assumes a fresh install of
the Ubuntu server software. · Ensure that your host OS meets the requirements
specified in Requirements for vSRX on KVM.
Overview
This example shows how to set up your Ubuntu host server and install and
launch a vSRX Virtual Firewall VM. Figure 4 on page 28 shows the basic
structure of a vSRX Virtual Firewall VM on an Ubuntu server.
Figure 4: vSRX Virtual Firewall VM on Ubuntu
NOTE: This example uses static IP addresses. If you are configuring the vSRX
Virtual Firewall instance in an NFV environment, you should use DHCP.
29
Quick Configuration – Install and Launch a vSRX Virtual Firewall VM on Ubuntu
IN THIS SECTION
CLI Quick Configuration | 29 Procedure | 29
CLI Quick Configuration
To quickly configure this example, copy the following commands, paste them
into a text file, remove any line breaks, change any details necessary to
match your network configuration, and copy and paste the commands into the
Ubuntu server terminal or vSRX Virtual Firewall console as specified.
Procedure
Step-by-Step Procedure
1. If the default virtual network does not already exist, copy the following
commands and paste them into the Ubuntu server terminal to create the default
virtual network.
cat < /etc/libvirt/qemu/networks/default.xml
30
virsh net-autostart default
2. Create the left, or trusted, virtual network on the Ubuntu server.
cat < /etc/libvirt/qemu/networks/testleftnetwork.xml
TestLeft
EOF virsh net-define /etc/libvirt/qemu/networks/testleftnetwork.xml
virsh net-start TestLeft virsh net-autostart TestLeft
3\. Create the right, or untrusted, virtual network on the Ubuntu server.
cat < /etc/libvirt/qemu/networks/testrightnetwork.xml TestRight EOF virsh net-define
/etc/libvirt/qemu/networks/testrightnetwork.xml virsh net-start TestRight
31
virsh net-autostart TestRight
4. Download the vSRX Virtual Firewall KVM image from the Juniper Networks
website at https:// www.juniper.net/support/downloads/?p=vsrx#sw.
5. Copy the following commands and modify the cpu parameter and flags to
match your Ubuntu server CPU. Paste the resulting commands into the Ubuntu
server terminal to copy the image to a mount point and create the vSRX Virtual
Firewall VM.
cp junos-vsrx-vmdisk-15.1X49-D20.2.qcow2 /mnt/vsrx20one.qcow2 virt-install
–name vSRX20One –ram 4096 –cpu SandyBridge,+vmx,-invtsc, –vcpus=2 -arch=x86_64
–disk path=/mnt/vsrx20one.qcow2,size=16,device=disk,bus=ide,format=qcow2
–ostype linux –os-variant rhel7 –import –network=network:default,model=virtio
-network=network:TestLeft,model=virtio –network=network:TestRight,model=virtio
NOTE: The CPU model and flags in the virt-install command might vary based on
the CPU and features in the Ubuntu server.
6. To set the root password on the vSRX Virtual Firewall VM, copy and paste
the command into the vSRX Virtual Firewall CLI at the [edit] hierarchy level.
set system root-authentication plain-text-password
7. To create a base configuration on the vSRX Virtual Firewall VM, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration, copy and
paste the following commands into the vSRX Virtual Firewall CLI at the [edit]
hierarchy level, and then enter commit from configuration mode.
set interfaces fxp0 unit 0 family inet dhcp-client set interfaces ge-0/0/0
unit 0 family inet address 192.168.123.254/24 set interfaces ge-0/0/1 unit 0
family inet dhcp-client set security zones security-zone trust interfaces
ge-0/0/0.0 host-inbound-traffic systemservices all set security zones
security-zone untrust interfaces ge-0/0/1.0 host-inbound-traffic
systemservices dhcp set routing-instances CUSTOMER-VR instance-type virtual-
router set routing-instances CUSTOMER-VR interface ge-0/0/0.0
32
set routing-instances CUSTOMER-VR interface ge-0/0/1.0 set security nat source
rule-set source-nat from zone trust set security nat source rule-set source-
nat to zone untrust set security nat source rule-set source-nat rule nat1
match source-address 0.0.0.0/0 set security nat source rule-set source-nat
rule nat1 then source-nat interface
IN THIS SECTION | 32
Step-by-Step Procedure
Step by Step Configuration
IN THIS SECTION Add Virtual Networks | 33 Verify the Virtual Networks | 36
Download and Installing the vSRX Virtual Firewall Image | 37 Verify the vSRX
Virtual Firewall Installation | 37 Create a Base Configuration on the vSRX
Virtual Firewall Instance | 40 Verify the Basic Configuration on the vSRX
Virtual Firewall Instance | 43
Use the following sections for a more detailed set of procedures to install
and launch a vSRX Virtual Firewall VM.
33
Add Virtual Networks
Step-by-Step Procedure You need to create virtual networks on the Ubuntu
server to provide network connectivity to interfaces on the vSRX Virtual
Firewall VM. Copy and paste these command into a terminal on the Ubuntu
server. This example uses three virtual networks: · default– Connects the fxp0
management interface.
NOTE: The default virtual network should already exist on the Ubuntu server.
Use the virsh net-list command to verify that the default network is present
and active.
· TestLeft– Connects the ge-0/0/0 interface to the trusted zone. · TestRight–
Connects the ge-0/0/1 interface to the untrusted zone. 1. If the default
network does not exist, follow these steps:
Step-by-Step Procedure
a. Open a text editor on the Ubuntu server and create the default network XML
(default.xml) file.
emacs /etc/libvirt/qemu/networks/default.xml
b. Set the forward mode to nat, configure an IP address and subnet mask, and a
bridge interface, and configure DHCP to assign IP addresses to interfaces on
this virtual network.
NOTE: Use the XML format specified by libvirt.
default
34
c. Define and start the default virtual network, based on the default.xml file
you created.
virsh net-define /etc/libvirt/qemu/networks/default.xml virsh net-start
default virsh net-autostart default
2\. Remove any previously configured TestLeft virtual network.
virsh net-destroy TestLeft virsh net-undefine TestLeft
3\. Remove any previously configured TestRight virtual network.
virsh net-destroy TestRight virsh net-undefine TestRight
4\. Open a text editor on the Ubuntu server and create the TestLeft network
XML (testleftnetwork.xml) file.
emacs /etc/libvirt/qemu/networks/testleftnetwork.xml
5\. Set the forward mode to route, configure an IP address and subnet mask,
and a bridge interface, and configure DHCP to assign IP addresses to
interfaces on this virtual network.
35
NOTE: Use the XML format specified by libvirt.
TestLeft
6\. Open a text editor on the Ubuntu server and create the TestRight network
XML (testrightnetwork.xml) file.
emacs /etc/libvirt/qemu/networks/testrightnetwork.xml
7\. Set the forward mode to nat, configure an IP address and subnet mask, and
a bridge interface, and configure DHCP to assign IP addresses to interfaces on
this virtual network.
NOTE: Use the XML format specified by libvirt.
TestRight
36
8. Define and start the TestLeft virtual network, based on the
testleftnetwork.xml file you created.
virsh net-define /etc/libvirt/qemu/networks/testleftnetwork.xml virsh net-
start TestLeft virsh net-autostart TestLeft
9. Define and start the TestRight virtual network, based on the
testrightnetwork.xml file you created.
virsh net-define /etc/libvirt/qemu/networks/testrightnetwork.xml virsh net-
start TestRight virsh net-autostart TestRight
Verify the Virtual Networks Purpose Verify the new virtual network
configuration on the Ubuntu server. Action Use the virsh net-list command on
the Ubuntu server to verify that the new virtual interfaces are active and are
set to autostart on reboot.
virsh net-list
Name
State
Autostart Persistent
———————————————————-
default
active
yes
yes
TestLeft
active
yes
yes
TestRight
active
yes
yes
37
Download and Installing the vSRX Virtual Firewall Image
Step-by-Step Procedure To download and install the vSRX Virtual Firewall image
on the Ubuntu server: 1. Download the vSRX Virtual Firewall KVM image from the
Juniper Networks website: https://
www.juniper.net/support/downloads/?p=vsrx#sw 2. Copy the vSRX Virtual Firewall
image to an appropriate mount point.
hostOS# cp junos-vsrx-vmdisk-15.1X49-D20.2.qcow2 /mnt/vsrx20one.qcow2
3. Use the virt-install command to create a vSRX Virtual Firewall VM. Modify
the cpu parameter and flags to match your Ubuntu server CPU.
hostOS# virt-install –name vSRX20One –ram 4096 –cpu SandyBridge,+vmx,-invtsc,
–vcpus=2 -arch=x86_64 –disk
path=/mnt/vsrx20one.qcow2,size=16,device=disk,bus=ide,format=qcow2 –ostype
linux –os-variant rhel7 –import –network=network:default,model=virtio
-network=network:TestLeft,model=virtio –network=network:TestRight,model=virtio
NOTE: The CPU model and flags in the virt-install command might vary based on
the CPU and features in the Ubuntu server.
Verify the vSRX Virtual Firewall Installation
Purpose Verify the vSRX Virtual Firewall Installation.
38
Action
1. Use the virsh console command on the Ubuntu server to access the vSRX
Virtual Firewall console and watch the progress of the installation. The
installation can take several minutes to complete.
hostOS# virsh console vSRx200ne
Starting install… ERROR internal error: process exited while connecting to
monitor: libust[11994/11994]: Warning: HOME environment variable not set.
Disabling LTTng-UST per-user tracing. (in setup_local_apps() at lttng-ust-
comm.c:305) libust[11994/11995]: Error: Error opening shm /lttng-ust-wait-5
(in get_wait_shm() at lttngust-comm.c:886) libust[11994/11995]: Error: Error
opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttngust-comm.c:886)
Booting `Juniper Linux’
Loading Linux … Consoles: serial port BIOS drive C: is disk0 BIOS drive D: is
disk1 BIOS drive E: is disk2 BIOS drive F: is disk3 BIOS 639kB/999416kB
available memory
FreeBSD/i386 bootstrap loader, Revision 1.2 (builder@example.com, Thu Jul 30
23:20:10 UTC 2015) Loading /boot/defaults/loader.conf /kernel text=0xa3a2c0
data=0x6219c+0x11f8e0 syms=[0x4+0xb2ed0+0x4+0x1061bb]
/boot/modules/libmbpool.ko text=0xce8 data=0x114 /boot/modules/if_em_vsrx.ko
text=0x184c4 data=0x7fc+0x20 /boot/modules/virtio.ko text=0x2168 data=0x208
syms=[0x4+0x7e0+0x4+0x972] /boot/modules/virtio_pci.ko text=0x2de8
data=0x200+0x8 syms=[0x4+0x8f0+0x4+0xb22] /boot/modules/virtio_blk.ko
text=0x299c data=0x1dc+0xc syms=[0x4+0x960+0x4+0xa0f]
/boot/modules/if_vtnet.ko text=0x5ff0 data=0x360+0x10
syms=[0x4+0xdf0+0x4+0xf19] /boot/modules/pci_hgcomm.ko text=0x12fc
data=0x1a4+0x44 syms=[0x4+0x560+0x4+0x61d] /boot/modules/chassis.ko text=0x9bc
data=0x1d0+0x10 syms=[0x4+0x390+0x4+0x399] Hit [Enter] to boot immediately, or
space bar for command prompt.
39
Booting [/kernel]… platform_early_bootinit: Early Boot Initialization GDB:
debug ports: sio GDB: current port: sio KDB: debugger backends: ddb gdb KDB:
current backend: ddb Copyright (c) 1996-2015, Juniper Networks, Inc. All
rights reserved. Copyright (c) 1992-2007 The FreeBSD Project. Copyright (c)
1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved. FreeBSD is a
registered trademark of The FreeBSD Foundation. JUNOS 15.1X49-D15.4 #0:
2015-07-31 02:20:21 UTC
