Juniper Networks Installation Guide for KVM vSRX Installation Guide

PDF

Dokument

Reklamë

vSRX Installation Guide for KVM

Release

15.1X49

Modified: 2016-01-13

Juniper Networks, Inc.

1133 Innovation Way

Sunnyvale, California 94089

USA

408-745-2000 www.juniper.net

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United

States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

vSRX Installation Guide for KVM

15.1X49

The information in this document is current as of the date on the title page.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

END USER LICENSE AGREEMENT

The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.juniper.net/support/eula.html

. By downloading, installing or using such software, you agree to the terms and conditions of that EULA.

Chapter 1

Chapter 2

Chapter 3

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Opening a Case with JTAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

vSRX Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Understanding vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Understanding vSRX with KVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

System Requirements for vSRX on KVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Software Environment Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

KVM Kernel Recommendations for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . 17

Additional Linux Packages for vSRX on KVM . . . . . . . . . . . . . . . . . . . . . . . 17

Hardware Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Best Practices Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

PCI NIC to VM Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Mapping Virtual Interfaces to a vSRX VM . . . . . . . . . . . . . . . . . . . . . . . . . 18

Interface Naming and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

vSRX Factory Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Enabling Nested Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Upgrading the Host OS Linux Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Upgrading the Linux Kernel on CentOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Installing vSRX with KVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Installing vSRX with virt-manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Installing vSRX with virt-install . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Connecting to the vSRX Management Console on KVM . . . . . . . . . . . . . . . . . . . . 29

Example: Installing and Launching vSRX on Ubuntu . . . . . . . . . . . . . . . . . . . . . . . 29

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 vSRX Feature Licenses Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

License Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 vSRX Evaluation License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Product Evaluation License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Advanced Security Features License . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Bandwidth (Throughput) Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

vSRX License Keys Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

iii

vSRX Installation Guide for KVM

Chapter 4

License Management Fields Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Managing Licenses for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 vSRX Evaluation License Installation Process . . . . . . . . . . . . . . . . . . . . . . . . . 47

Adding a New License Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Updating vSRX Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Deleting a License Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

License Warning Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

vSRX License Model Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

List of Figures

Chapter 2

Chapter 3

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Figure 1: virt-manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Figure 2: Create a New Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Figure 3: vSRX VM on Ubuntu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Figure 4: J-Web Licenses Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Figure 5: License Details in the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Figure 6: J-Web Licenses Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Figure 7: Add License Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Figure 8: License Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Figure 9: License Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Figure 10: Delete Licenses Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Figure 11: J-Web Dashboard for License Expiry Warning . . . . . . . . . . . . . . . . . . . . . 53

List of Tables

Chapter 1

Chapter 2

Chapter 3

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Table 1: Notice Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Table 2: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

vSRX Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Table 3: Specifications for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Table 4: Kernel Recommendations for KVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Table 5: Additional Linux Packages for KVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Table 6: Hardware Specifications for the Host Machine . . . . . . . . . . . . . . . . . . . . . 17

Table 7: Interface Names for a Standalone vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Table 8: Interface Names for a vSRX Cluster Pair . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Table 9: Factory Default Settings for Security Policies . . . . . . . . . . . . . . . . . . . . . . 21

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Table 10: virt-install Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Table 11: vSRX Feature Licenses Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Table 12: Summary of License Management Fields . . . . . . . . . . . . . . . . . . . . . . . . 45

Table 13: vSRX Bandwidth Licensing Package Types . . . . . . . . . . . . . . . . . . . . . . . 54

Table 14: Standard (STD) vSRX Bandwidth Licenses . . . . . . . . . . . . . . . . . . . . . . 56

Table 15: vSRX AppSecure and IPS (ASCB / ASEC) Bandwidth Licenses . . . . . . . 57

Table 16: vSRX AppSecure and IPS Subscription Licenses . . . . . . . . . . . . . . . . . . 58

Table 17: vSRX Content Security (CS) Bandwidth Licenses . . . . . . . . . . . . . . . . . . 59

Table 18: vSRX Content Security (CS) Subscription Licenses . . . . . . . . . . . . . . . . 60

Table 19: vSRX Sophos Anti-virus (S-AV) Bandwidth Licenses . . . . . . . . . . . . . . . 61

Table 20: vSRX Enhanced Web Filtering Bandwidth Licenses . . . . . . . . . . . . . . . . 62

vii

About the Documentation

•

Documentation and Release Notes on page ix

•

Documentation Conventions on page ix

•

Documentation Feedback on page xi

•

Requesting Technical Support on page xii

Documentation and Release Notes

To obtain the most current version of all Juniper Networks

® technical documentation, see the product documentation page on the Juniper Networks website at http://www.juniper.net/techpubs/ .

If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes.

Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at http://www.juniper.net/books .

Documentation Conventions

Table 1 on page x

defines notice icons used in this guide.

vSRX Installation Guide for KVM

Table 1: Notice Icons

Icon Meaning

Informational note

Caution

Warning

Laser warning

Tip

Best practice

Description

Indicates important features or instructions.

Indicates a situation that might result in loss of data or hardware damage.

Alerts you to the risk of personal injury or death.

Alerts you to the risk of personal injury from a laser.

Indicates helpful information.

Alerts you to a recommended use or implementation.

Table 2 on page x

defines the text and syntax conventions used in this guide.

Table 2: Text and Syntax Conventions

Convention Description Examples

Bold text like this

Fixed-width text like this

Italic text like this

Represents text that you type.

To enter configuration mode, type the configure command: user@host> configure

Represents output that appears on the terminal screen.

user@host> show chassis alarms

No alarms currently active

• Introduces or emphasizes important new terms.

•

Identifies guide names.

Identifies RFC and Internet draft titles.

•

A policy term is a named structure that defines match conditions and actions.

Junos OS CLI User Guide

RFC 1997, BGP Communities Attribute

Represents variables (options for which you substitute a value) in commands or configuration statements.

Configure the machine’s domain name:

About the Documentation

Table 2: Text and Syntax Conventions (continued)

Convention Description

Text like this

< > (angle brackets)

| (pipe symbol)

Examples

Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components.

•

To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level.

The console port is labeled CONSOLE .

Encloses optional keywords or variables.

stub <default-metric metric>;

Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity.

broadcast | multicast

(string1 | string2 | string3)

# (pound sign)

[ ] (square brackets)

Indention and braces ( { } )

; (semicolon)

Indicates a comment specified on the same line as the configuration statement to which it applies.

rsvp { # Required for dynamic MPLS only

Encloses a variable for which you can substitute one or more values.

Identifies a level in the configuration hierarchy.

Identifies a leaf statement at a configuration hierarchy level.

community name members [

community-ids ]

[edit] routing-options { static { route default { nexthop address; retain;

}

GUI Conventions

Bold text like this

> (bold right angle bracket)

Represents graphical user interface (GUI) items you click or select.

•

In the Logical Interfaces box, select

All Interfaces .

To cancel the configuration, click

Cancel .

Separates levels in a hierarchy of menu selections.

In the configuration editor hierarchy, select Protocols>Ospf.

Documentation Feedback

We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods:

• Online feedback rating system—On any page at the Juniper Networks Technical

Documentation site at http://www.juniper.net/techpubs/index.html

, simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at http://www.juniper.net/techpubs/feedback/ .

vSRX Installation Guide for KVM

• E-mail—Send your comments to [email protected]. Include the document or topic name, URL or page number, and software version (if applicable).

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance

Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf

• Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/ .

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day,

7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

• Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: http://www2.juniper.net/kb/

• Find product documentation: http://www.juniper.net/techpubs/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: http://kb.juniper.net/InfoCenter/

• Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

• Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number Entitlement

(SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

• Use the Case Management tool in the CSC at http://www.juniper.net/cm/ .

• Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

About the Documentation

For international or direct-dial options in countries without toll-free numbers, see http://www.juniper.net/support/requesting-support.html

xiii

CHAPTER 1

vSRX Overview

•

Understanding vSRX on page 15

•

Understanding vSRX with KVM on page 15

•

System Requirements for vSRX on KVM on page 16

•

Interface Naming and Mapping on page 19

•

vSRX Factory Default Settings on page 20

Understanding vSRX

vSRX is a virtual security appliance that provides security and networking services at the perimeter or edge in virtualized private or public cloud environments. vSRX runs as a virtual machine (VM) on a standard x86 server.

vSRX enables advanced security and routing at the network edge in a multitenant virtualized environment. vSRX is built on Junos OS and delivers networking and security features similar to those available on SRX Series Services Gateways for the branch.

Some of the key benefits of vSRX in virtualized private or public cloud multitenant environments include:

• Stateful firewall protection at the tenant edge

• Faster deployment of virtual firewalls

• Full routing, VPN, and networking capabilities

• Centralized and local management

NOTE: vSRX supports SCSI-based or IDE-based disk images.

Understanding vSRX with KVM

The Linux kernel uses the kernel-based virtual machine (KVM) as a virtualization infrastructure. KVM is open source software that you can use to create multiple virtual machines (VMs) and to install security and networking appliances.

vSRX Installation Guide for KVM

The basic components of KVM include:

• A loadable kernel module included in the Linux kernel that provides the basic virtualization infrastructure

• A processor-specific module

When loaded into the Linux kernel, the KVM software acts as a hypervisor. KVM supports multitenancy and allows you to run multiple vSRX VMs on the host OS. KVM manages and shares the system resources between the host OS and the multiple vSRX VMs.

NOTE: vSRX requires you to enable hardware-based virtualization on a host

OS that contains an Intel Virtualization Technology (VT) capable processor.

System Requirements for vSRX on KVM

•

Software Environment Requirements on page 16

•

Hardware Recommendations on page 17

•

Best Practices Recommendations on page 18

Software Environment Requirements

Table 3 on page 16

lists the system software requirement specifications for the vSRX environment.

Table 3: Specifications for vSRX

Component Specification

Hypervisor support

Memory

Disk space vCPUs

Linux KVM (CentOS 7.0 or Ubuntu 14.04.2)

4 GB

16 GB IDE drive

2 vNICs

Virtual NIC types

Up to 8

SR-IOV

Virtio

NOTE: We recommend the Intel X710/XL710 or X520/X540 physical

NICs for SR-IOV support on vSRX.

For SR-IOV limitations, see the Known Behavior section of the vSRX

Release Notes

Chapter 1: vSRX Overview

KVM Kernel Recommendations for vSRX

Table 4 on page 17

lists the recommended Linux kernels for your Linux host OS to run vSRX on KVM.

Table 4: Kernel Recommendations for KVM

Linux

Distribution Linux Kernel Version

CentOS

Ubuntu

3.10.0.229

Upgrade the Linux kernel to capture the recommended version.

3.16

Additional Linux Packages for vSRX on KVM

Table 5 on page 17

lists the additional packages you need on your Linux host OS to run vSRX on KVM. See your host OS documentation for how to install these packages if they are not present on your server.

Table 5: Additional Linux Packages for KVM

Package Version Download Link libvirt 0.10.0

virt-manager (Recommended) 0.10.0

libvirt download virt-manager download

Hardware Recommendations

Table 6 on page 17

lists the hardware specifications for the host machine that runs the vSRX virtual machine (VM).

Table 6: Hardware Specifications for the Host Machine

Component Specification

Host memory size

Host processor type

Physical NIC

Minimum 4 GB x86_64 multicore CPU

NOTE: DPDK requires Intel Virtualization VT-x/VT-d support in the CPU. See About Intel Virtualization Technology.

Intel X710/XL710 or X520/X540 physical NICs for SR-IOV support on vSRX

vSRX Installation Guide for KVM

NOTE: For KVM, we recommend that you enable hardware-based virtualization on the host machine. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support

To determine the Junos OS features supported on vSRX, use the Juniper Networks Feature

Explorer, a Web-based application that helps you to explore and compare Junos OS feature information to find the right software release and hardware platform for your network. Find Feature Explorer here:

Feature Explorer: vSRX

Best Practices Recommendations

vSRX deployments can be complex, and there is a great deal of variability in the specifics of possible deployments. The following recommendations might apply to and improve performance and function in your particular circumstances.

PCI NIC to VM Mapping

If the node on which vSRX is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. On a Linux host OS, install the hwloc package and use the lstopo command to provide information about relative physical NIC locations. Move the vSRX VM to a slot on the server that is connected to the PCI NIC that vSRX VM uses.

On some servers where this information is not available or not supported, refer to the hardware documentation for the slot-to-NUMA node topology.

Mapping Virtual Interfaces to a vSRX VM

To determine which virtual interfaces on your Linux host OS map to a vSRX virtual machine

(VM):

Use the virsh list command on your Linux host OS to list the running VMs.

hostOS# virsh list

Id Name State

----------------------------------------------------

9 centos1 running

15 centos2 running

16 centos3 running

48 vsrx running

50 1117-2 running

51 1117-3 running

Use the virsh domiflist vsrx-name command to list the virtual interfaces on that vSRX

VM.

hostOS# virsh domiflist vsrx

Interface Type Source Model MAC

------------------------------------------------------vnet1 bridge brem2 virtio 52:54:00:8f:75:a5 vnet2 bridge br1 virtio 52:54:00:12:37:62 vnet3 bridge brconnect virtio 52:54:00:b2:cd:f4

Chapter 1: vSRX Overview

NOTE: The first virtual interface maps to the fxp0 interface in the Junos

OS.

Documentation

• About Intel Virtualization Technology

• DPDK Release Notes

Interface Naming and Mapping

Each network adapter defined for a vSRX is mapped to a specific interface, depending on whether the vSRX instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX have changed since the previous release (called Firefly Perimeter), as shown in the following tables. Note the following changes:

• In standalone mode:

• fxp0 is the out-of-band management interface

• ge-0/0/0 is the first traffic (revenue) interface

• In cluster mode:

• fxp0 is the out-of-band management interface

• em0 is the cluster control link for both nodes

• Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 7 on page 19

shows the interface names and mappings for a standalone vSRX.

Table 7: Interface Names for a Standalone vSRX

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX fxp0 ge-0/0/0 ge-0/0/1

5 ge-0/0/2 ge-0/0/3 ge-0/0/4 ge-0/0/5

vSRX Installation Guide for KVM

Table 7: Interface Names for a Standalone vSRX (continued)

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX ge-0/0/6 ge-0/0/7 ge-0/0/8

Table 8 on page 20

shows the interface names and mappings for a pair of vSRX VMs in a cluster (node 0 and node 1).

Table 8: Interface Names for a vSRX Cluster Pair

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX

1 fxp0 (node 0 and 1)

10 em0 (node 0 and 1) ge-0/0/0 (node 0) ge-7/0/0 (node 1) ge-0/0/1 (node 0) ge-7/0/1 (node 1) ge-0/0/2 (node 0) ge-7/0/2 (node 1) ge-0/0/3 (node 0) ge-7/0/3 (node 1) ge-0/0/4 (node 0) ge-7/0/4 (node 1) ge-0/0/5 (node 0) ge-7/0/5 (node 1) ge-0/0/6 (node 0) ge-7/0/6 (node 1) ge-0/0/7 (node 0) ge-7/0/7 (node 1)

vSRX Factory Default Settings

vSRX requires the following basic configuration settings:

• Interfaces must be assigned IP addresses.

Chapter 1: vSRX Overview

• Interfaces must be bound to zones.

• Policies must be configured between zones to permit or deny traffic.

NOTE: The management interface, fxp0, requires the following:

• KVM uses the virtIO vNIC and requires promiscuous mode on the bridge.

Use the ifconfig bridge-name promisc command on the host OS to enable promiscuous mode on the Linux bridge.

Table 9 on page 21

lists the factory default settings for the vSRX security policies.

Table 9: Factory Default Settings for Security Policies

Source Zone Destination Zone Policy Action trust trust untrust untrust trust trust permit permit deny

vSRX Installation Guide for KVM

CHAPTER 2

Installing vSRX

•

Enabling Nested Virtualization on page 23

•

Upgrading the Host OS Linux Kernel on page 24

•

Installing vSRX with KVM on page 24

•

Connecting to the vSRX Management Console on KVM on page 29

•

Example: Installing and Launching vSRX on Ubuntu on page 29

Enabling Nested Virtualization

We recommend that you enable nested virtualization on your host OS or OpenStack compute node. Nested virtualization is enabled by default on Ubuntu, but is disabled by default on CentOS.

Use the following command to determine if nested virtualization is enabled on your host

OS. The result should be Y.

hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y

NOTE: APIC virtualization (APICv) does not work well with nested VMs such as those used with KVM. On Intel CPUs that support APICv (typically v2 models, for example E5 v2 and E7 v2), you must disable APICv on the host server before deploying vSRX.

To enable nested virtualization on the host OS:

On CentOS, open the /etc/modprobe.d/dist.conf file in your default editor.

hostOS# vi /etc/modprobe.d/dist.conf

On Ubuntu, open the /etc/modprobe.d/qemu-system-x86.conf file in your default editor.

hostOS# vi /etc/modprobe.d/qemu-system-x86.conf

Add the following line to the file: options kvm_intel nested=y

vSRX Installation Guide for KVM

Save the file and reboot the host OS.

Optionally after reboot, verify that nested virtualization is enabled.

hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y

On Intel CPUs that support APICv ( for example, E5 v2 and E7 v2), disable APICv on the host OS.

root@host# sudo rmmod kvm-intel root@host# sudo sh -c “echo ’options kvm-intel enable_apicv=n’ >>

/etc/modprobe.d/dist.conf” root@host# sudo modprobe kvm-intel

Optionally, verify that APICv is now disabled.

root@host# cat /sys/module/kvm_intel/parameters/enable_apicv

Upgrading the Host OS Linux Kernel

To determine your host OS Linux kernel version, type uname -a in a terminal on your host

OS.

•

Upgrading the Linux Kernel on CentOS on page 24

Upgrading the Linux Kernel on CentOS

Use the uname -a command on your CentOS host to check the current Linux kernel version. If the version is not 3.10.0-229, follow this procedure to update the kernel version.

To upgrade the Linux kernel on CentOS:

View the list of available Linux kernel packages.

hostOS# yum list --showduplicates kernel

Install the 3.10.0-229.el7 Linux kernel.

hostOS# yum install kernel-3.10.0-229.el7

Reboot the host OS. The updated kernel is now the default.

Optionally, type uname -a in a terminal on your host OS to verify that the host OS is using the kernel-3.10.0-229.el7 kernel version.

Installing vSRX with KVM

You use virt-manager or virt-install to install vSRX VMs. See your host OS documentation for complete details on these packages.

Chapter 2: Installing vSRX

NOTE: See Migration, Upgrade, and Downgrade in the vSRX Release Notes to upgrade an existing vSRX instance.

•

Installing vSRX with virt-manager on page 25

•

Installing vSRX with virt-install on page 27

Installing vSRX with virt-manager

You can install and launch vSRX with the KVM virt-manager GUI package.

Ensure that sure you have already installed KVM, qemu, virt-manager, and libvirt on your host OS. You must also configure the required virtual networks and storage pool in the host OS for the vSRX VM. See your host OS documentation for details.

To install vSRX with virt-manager:

Download the vSRX QCOW2 image from the Juniper software download site.

On your host OS, type virt-manager. The Virtual Machine Manager appears. See

Figure 1 on page 25 .

NOTE: You must have admin rights on the host OS to use virt-manager.

Figure 1: virt-manager

Click Create a new virtual machine as seen in

Figure 2 on page 25

. The New VM wizard appears .

Figure 2: Create a New Virtual Machine

Select Import existing disk image, and click Forward.

vSRX Installation Guide for KVM

Browse to the location of the downloaded vSRX QCOW2 image and select the vSRX image.

Select Linux from the OS type list and select Show all OS options from the Version list.

Select Red Hat Enterprise Linux 7 from the expanded Version list and click Forward.

Set the RAM to 4096 MB and set CPUs to 2. Click Forward.

Set the disk image size to 16 GB and click Forward.

10.

Name the vSRX VM, and select Customize this configuration before install to change parameters before you create and launch the VM. Click Finish. The Configuration dialog box appears.

11.

Select Processor and expand the Configuration list.

12.

Select Copy Host CPU Configuration.

13.

Set CPU Feature intsvc to disabled and vmx to require.

NOTE: If the CPU feature option is not present in your version of virt-manager , you need to edit the vSRX VM XML file, typically found in

/etc/libvirt/qemu directory on your host OS. Use virsh edit to edit the VM

XML file to configure <feature policy='require' name='vmx'/> under the

<cpu mode> element. Also add <feature policy='disable' name='invtsc'/> if your host OS is CentOS. Use the virsh capabilities command on your host

OS to list the host OS and CPU virtualization capabilities.

The following example shows the relevant portion of the vSRX XML file on a CentOS host:

<model fallback='allow'>SandyBridge</model>

<vendor>Intel</vendor>

</cpu>

Chapter 2: Installing vSRX

14.

Select the disk and expand Advanced Options.

15.

Select IDE from the Disk bus list.

16.

Select the NIC, and select virtio from the Device model field. This first NIC is the fpx0

(management) interface for vSRX.

17.

Click Add Hardware to add more virtual networks, and select virtio from the Device model list.

18.

Click Apply, and click x to close the dialog box.

19.

Click Begin Installation. The VM manager creates and launches the vSRX VM.

NOTE: The default vSRX VM login ID is root with no password. By default, if a DHCP server is on the network, it assigns an IP address to the vSRX VM.

Installing vSRX with virt-install

The virt-install and virsh tools are CLI alternatives to installing and managing vSRX VMs on a Linux host.

Ensure that sure you have already installed KVM, qemu, virt-install, and libvirt on your host OS. You must also configure the required virtual networks and storage pool in the host OS for the vSRX VM. See your host OS documentation for details.

NOTE: You must have root access on the host OS to use the virt-install command.

To install vSRX with virt-install:

Download the vSRX QCOW2 image from the Juniper software download site.

On your host OS, use the virt-install command with the mandatory options listed in

Table 10 on page 27

NOTE: See the official virt-install documentation for a complete description of available options.

Table 10: virt-install Options

Command Option Description

--name name Name the vSRX VM.

--ram megabytes Allocate RAM for the VM, in megabytes.

vSRX Installation Guide for KVM

Table 10: virt-install Options (continued)

Command Option Description

--cpu cpu-model, cpu-flags

--vcpus number

--disk path

--import

Enable the vmx feature policy. The remaining CPU flags depend on the host server CPU model.

Use virsh capabilities to list the virtualization capabilities of your host OS and CPU.

Allocate the number of vCPUs for the vSRX VM.

Specify disk storage media and size for the VM. Include the following options:

•

• size=gigabyles device=disk bus=ide format=qcow2

Create and boot the vSRX VM from an existing image.

The following example creates a vSRX VM with 4096 MB RAM, 2 vCPUs, and disk storage up to 16 GB: hostOS# virt-install --name vSRXVM --ram 4096 --cpu SandyBridge,+vmx,-invtc, --vcpus=2

--arch=x86_64 --disk path=/mnt/vsrx.qcow2,size=16,device=disk,bus=ide,format=qcow2

--import

The following example shows the relevant portion of the vSRX XML file on a CentOS host:

<model fallback='allow'>SandyBridge</model>

<vendor>Intel</vendor>

</cpu>

Chapter 2: Installing vSRX

NOTE: The default vSRX VM login ID is root with no password. By default, if a DHCP server is on the network, it assigns an IP address to the vSRX VM.

Documentation

• Installing a virtual machine using virt-install

• Migration, Upgrade, and Downgrade

Connecting to the vSRX Management Console on KVM

Ensure that you have the virt-manager package or virsh installed on your host OS.

To connect to the vSRX management console using virt-manager:

Launch virt-manager.

Highlight the vSRX VM you want to connect to from the list of VMs displayed.

Click Open.

Select View>Text Consoles>Serial 1. The vSRX console appears.

NOTE: Optionally, you can connect to the vSRX VM with virsh: user@host# virsh console vSRX-kvm-2

Connected to domain vSRX-kvm-2

Documentation

• virt-tools

Example: Installing and Launching vSRX on Ubuntu

This example shows how to install and launch a vSRX instance on an Ubuntu server with

KVM.

•

Requirements on page 29

•

Overview on page 30

•

Quick Configuration on page 30

•

Step by Step Configuration on page 32

Requirements

This example uses the following hardware and software components:

• Generic x86 server

• Junos OS Release 15.1X49-D20 for vSRX

• Ubuntu version 14.04.2

vSRX Installation Guide for KVM

Overview

Before you begin:

• This example assumes a fresh install of the Ubuntu server software.

• Ensure that your host OS meets the requirements specified in

“System Requirements for vSRX on KVM” on page 16 .

This example shows how to set up your Ubuntu host server and install and launch a vSRX

VM.

Figure 3 on page 30

shows the basic structure of a vSRX VM on an Ubuntu server.

Figure 3: vSRX VM on Ubuntu

NOTE: This example uses static IP addresses. If you are configuring the vSRX instance in an NFV environment, you should use DHCP.

Quick Configuration

CLI Quick

Configuration

Installing and Launching a vSRX VM on Ubuntu

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and copy and paste the commands into the Ubuntu server terminal or vSRX console as specified.

If the default virtual network does not already exist, copy the following commands and paste them into the Ubuntu server terminal to create the default virtual network.

cat <<EOF> /etc/libvirt/qemu/networks/default.xml

<name>default</name>

<nat>

</nat>

<dhcp>

</dhcp>

Chapter 2: Installing vSRX

</ip>

</network>

EOF virsh net-define /etc/libvirt/qemu/networks/default.xml

virsh net-start default virsh net-autostart default

Create the left, or trusted, virtual network on the Ubuntu server.

cat <<EOF> /etc/libvirt/qemu/networks/testleftnetwork.xml

<name>TestLeft</name>

<dhcp>

</dhcp>

</ip>

</network>

EOF virsh net-define /etc/libvirt/qemu/networks/testleftnetwork.xml

virsh net-start TestLeft virsh net-autostart TestLeft

Create the right, or untrusted, virtual network on the Ubuntu server.

cat <<EOF > /etc/libvirt/qemu/networks/testrightnetwork.xml

<name>TestRight</name>

<nat>

</nat>

<dhcp>

</dhcp>

</ip>

</network>

EOF virsh net-define /etc/libvirt/qemu/networks/testrightnetwork.xml

virsh net-start TestRight virsh net-autostart TestRight

Download the vSRX KVM appliance image from the Juniper website at http://www.juniper.net/support/downloads/?p=vsrx#sw .

Copy the following commands and modify the cpu parameter and flags to match your

Ubuntu server CPU. Paste the resulting commands into the Ubuntu server terminal to copy the image to a mount point and create the vSRX VM.

cp junos-vsrx-vmdisk-15.1X49-D20.2.qcow2 /mnt/vsrx20one.qcow2

virt-install --name vSRX20One --ram 4096 --cpu SandyBridge,+vmx,-invtc, --vcpus=2

--arch=x86_64 --disk path=/mnt/vsrx20one.qcow2,size=16,device=disk,bus=ide,format=qcow2 --import

vSRX Installation Guide for KVM

--network=network:default,model=virtio --network=network:TestLeft,model=virtio

--network=network:TestRight,model=virtio

NOTE: The CPU model and flags in the virt-install command might vary based on the CPU and features in the Ubuntu server.

To set the root password on the vSRX VM, copy and paste the command into the vSRX CLI at the [edit] hierarchy level.

set system root-authentication plain-text-password

To create a base configuration on the vSRX VM, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the following commands into the vSRX

CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set interfaces fxp0 unit 0 family inet dhcp-client set interfaces ge-0/0/0 unit 0 family inet address 192.168.123.254/24 set interfaces ge-0/0/1 unit 0 family inet dhcp-client set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services all set security zones security-zone untrust interfaces ge-0/0/1.0 host-inbound-traffic system-services dhcp set routing-instances CUSTOMER-VR instance-type virtual-router set routing-instances CUSTOMER-VR interface ge-0/0/0.0

set routing-instances CUSTOMER-VR interface ge-0/0/1.0

set security nat source rule-set source-nat from zone trust set security nat source rule-set source-nat to zone untrust set security nat source rule-set source-nat rule nat1 match source-address 0.0.0.0/0 set security nat source rule-set source-nat rule nat1 then source-nat interface

Step by Step Configuration

Use the following sections for a more detailed set of procedures to install and launch a vSRX VM.

•

Adding Virtual Networks on page 33

•

Verifying the Virtual Networks on page 35

•

Downloading and Installing the vSRX Image on page 35

•

Verifying the vSRX Installation on page 36

•

Creating a Base Configuration on the vSRX Instance on page 37

•

Verifying the Basic Configuration on the vSRX Instance on page 39

Chapter 2: Installing vSRX

Step-by-Step

Procedure

Adding Virtual Networks

You need to create virtual networks on the Ubuntu server to provide network connectivity to interfaces on the vSRX VM. Copy and paste these command into a terminal on the

Ubuntu server.

This example uses three virtual networks:

• default— Connects the fxp0 management interface.

NOTE: The default virtual network should already exist on the Ubuntu server. Use the virsh net-list command to verify that the default network is present and active.

• TestLeft— Connects the ge-0/0/0 interface to the trusted zone.

• TestRight— Connects the ge-0/0/1 interface to the untrusted zone.

If the default network does not exist, follow these steps: a.

Open a text editor on the Ubuntu server and create the default network XML

(default.xml) file.

emacs /etc/libvirt/qemu/networks/default.xml

Set the forward mode to nat, configure an IP address and subnet mask, and a bridge interface, and configure DHCP to assign IP addresses to interfaces on this virtual network.

NOTE: Use the XML format specified by libvirt.

<name>default</name>

<nat>

</nat>

<dhcp>

</dhcp>

</ip>

</network> c.

Define and start the default virtual network, based on the default.xml file you created.

virsh net-define /etc/libvirt/qemu/networks/default.xml

virsh net-start default

vSRX Installation Guide for KVM

virsh net-autostart default

Remove any previously configured TestLeft virtual network.

virsh net-destroy TestLeft virsh net-undefine TestLeft

Remove any previously configured TestRight virtual network.

virsh net-destroy TestRight virsh net-undefine TestRight

Open a text editor on the Ubuntu server and create the TestLeft network XML

(testleftnetwork.xml) file.

emacs /etc/libvirt/qemu/networks/testleftnetwork.xml

Set the forward mode to route, configure an IP address and subnet mask, and a bridge interface, and configure DHCP to assign IP addresses to interfaces on this virtual network.

NOTE: Use the XML format specified by libvirt.

<name>TestLeft</name>

<dhcp>

</dhcp>

</ip>

</network>

Open a text editor on the Ubuntu server and create the TestRight network XML

(testrightnetwork.xml) file.

emacs /etc/libvirt/qemu/networks/testrightnetwork.xml

Set the forward mode to nat, configure an IP address and subnet mask, and a bridge interface, and configure DHCP to assign IP addresses to interfaces on this virtual network.

NOTE: Use the XML format specified by libvirt.

<name>TestRight</name>

<nat>

</nat>

Chapter 2: Installing vSRX

<dhcp>

</dhcp>

</ip>

</network>

Define and start the TestLeft virtual network, based on the testleftnetwork.xml file you created.

virsh net-define /etc/libvirt/qemu/networks/testleftnetwork.xml

virsh net-start TestLeft virsh net-autostart TestLeft

Define and start the TestRight virtual network, based on the testrightnetwork.xml

file you created.

virsh net-define /etc/libvirt/qemu/networks/testrightnetwork.xml

virsh net-start TestRight virsh net-autostart TestRight

Verifying the Virtual Networks

Purpose Verify the new virtual network configuration on the Ubuntu server.

Action Use the virsh net-list command on the Ubuntu server to verify that the new virtual interfaces are active and are set to autostart on reboot.

virsh net-list

Name State Autostart Persistent

---------------------------------------------------------default active yes yes

TestLeft active yes yes

TestRight active yes yes

Step-by-Step

Procedure

Downloading and Installing the vSRX Image

To download and install the vSRX image on the Ubuntu server:

Download the vSRX KVM appliance image from the Juniper website: http://www.juniper.net/support/downloads/?p=vsrx#sw

Copy the vSRX image to an appropriate mount point.

hostOS# cp junos-vsrx-vmdisk-15.1X49-D20.2.qcow2 /mnt/vsrx20one.qcow2

Use the virt-install command to create a vSRX VM. Modify the cpu parameter and flags to match your Ubuntu server CPU.

hostOS# virt-install --name vSRX20One --ram 4096 --cpu SandyBridge,+vmx,-invtc,

--vcpus=2 --arch=x86_64 --disk path=/mnt/vsrx20one.qcow2,size=16,device=disk,bus=ide,format=qcow2 --import

--network=network:default,model=virtio --network=network:TestLeft,model=virtio

--network=network:TestRight,model=virtio

NOTE: The CPU model and flags in the virt-install command might vary based on the CPU and features in the Ubuntu server.

vSRX Installation Guide for KVM

Verifying the vSRX Installation

Purpose Verify the vSRX Installation.

Action 1.

Use the virsh console command on the Ubuntu server to access the vSRX console and watch the progress of the installation. The installation can take several minutes to complete.

hostOS# virsh console vSRx200ne

Starting install...

ERROR internal error: process exited while connecting to monitor: libust[11994/11994]: Warning: HOME environment variable not set. Disabling

LTTng-UST per-user tracing. (in setup_local_apps() at lttng-ust-comm.c:305) libust[11994/11995]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:886) libust[11994/11995]: Error: Error opening shm /lttng-ust-wait-5 (in get_wait_shm() at lttng-ust-comm.c:886)

Booting `Juniper Linux'

Loading Linux ...

Consoles: serial port

BIOS drive C: is disk0

BIOS drive D: is disk1

BIOS drive E: is disk2

BIOS drive F: is disk3

BIOS 639kB/999416kB available memory

FreeBSD/i386 bootstrap loader, Revision 1.2

([email protected], Thu Jul 30 23:20:10 UTC 2015)

Loading /boot/defaults/loader.conf

/kernel text=0xa3a2c0 data=0x6219c+0x11f8e0 syms=[0x4+0xb2ed0+0x4+0x1061bb]

/boot/modules/libmbpool.ko text=0xce8 data=0x114

/boot/modules/if_em_vsrx.ko text=0x184c4 data=0x7fc+0x20

/boot/modules/virtio.ko text=0x2168 data=0x208 syms=[0x4+0x7e0+0x4+0x972]

/boot/modules/virtio_pci.ko text=0x2de8 data=0x200+0x8 syms=[0x4+0x8f0+0x4+0xb22]

/boot/modules/virtio_blk.ko text=0x299c data=0x1dc+0xc syms=[0x4+0x960+0x4+0xa0f]

/boot/modules/if_vtnet.ko text=0x5ff0 data=0x360+0x10 syms=[0x4+0xdf0+0x4+0xf19]

/boot/modules/pci_hgcomm.ko text=0x12fc data=0x1a4+0x44 syms=[0x4+0x560+0x4+0x61d]

/boot/modules/chassis.ko text=0x9bc data=0x1d0+0x10 syms=[0x4+0x390+0x4+0x399]

Hit [Enter] to boot immediately, or space bar for command prompt.

Booting [/kernel]...

platform_early_bootinit: Early Boot Initialization

GDB: debug ports: sio

GDB: current port: sio

KDB: debugger backends: ddb gdb

KDB: current backend: ddb

FreeBSD is a registered trademark of The FreeBSD Foundation.

Chapter 2: Installing vSRX

JUNOS 15.1X49-D15.4 #0: 2015-07-31 02:20:21 UTC

The machine id is empty.

Cleaning up ...

Thu Aug 27 12:06:22 UTC 2015

Aug 27 12:06:22 init: exec_command: /usr/sbin/dhcpd (PID 1422) started

Aug 27 12:06:22 init: dhcp (PID 1422) started

Aug 27 12:06:23 init: exec_command: /usr/sbin/pppd (PID 1428) started

Amnesiac (ttyd0) login:

On the vSRX console, log in and verify the vSRX version installed.

--- JUNOS 15.1X49-D15.4 built 2015-07-31 02:20:21 UTC root@% root@% cli root> root> show version

Model: vSRX

Junos: 15.1X49-D15.4

JUNOS Software Release [15.1X49-D15.4]

Step-by-Step

Procedure

Creating a Base Configuration on the vSRX Instance

To configure a base setup on the vSRX instance, enter the following steps in edit mode:

Create a root password.

[edit] set system root-authentication plain-text-password

Set the IP address family for the management interface, and enable the DHCP client for this interface.

set interfaces fxp0 unit 0 family inet dhcp-client

Set the IP address for the ge-0/0/0.0 interface.

set interfaces ge-0/0/0 unit 0 family inet address 192.168.123.254/24

Set the IP address family for the ge-0/0/1.0 interface, and enable the DHCP client for this interface.

set interfaces ge-0/0/1 unit 0 family inet dhcp-client

Add the ge-0/0/0.0 interface to the trust security zone and allow all system services from inbound traffic on that interface.

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services all

Add the ge-0/0/1.0 interface to the untrust security zone and allow only DHCP system services from inbound traffic on that interface.

vSRX Installation Guide for KVM

set security zones security-zone untrust interfaces ge-0/0/1.0 host-inbound-traffic system-services dhcp

Create a virtual router routing instance and add the two interfaces to that routing instance.

set routing-instances CUSTOMER-VR instance-type virtual-router set routing-instances CUSTOMER-VR interface ge-0/0/0.0

set routing-instances CUSTOMER-VR interface ge-0/0/1.0

Create a source NAT rule set.

set security nat source rule-set source-nat from zone trust set security nat source rule-set source-nat to zone untrust

Configure a rule that matches packets and translates the source address to the address of the egress interface.

set security nat source rule-set source-nat rule nat1 match source-address 0.0.0.0/0 set security nat source rule-set source-nat rule nat1 then source-nat interface

Results From configuration mode, confirm your configuration by entering the show interfaces command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

show interfaces ge-0/0/0 {

unit 0 {

family inet {

192.168.123.254/24;

}

} ge-0/0/1 {

unit 0 {

family inet {

## Warning: Incompatible with 'system autoinstallation'

dhcp-client;

}

} fxp0 {

unit 0 {

family inet {

## Warning: Incompatible with 'system autoinstallation'

dhcp-client;

}

Chapter 2: Installing vSRX

From configuration mode, confirm your security policies by entering the show security policies command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

show security policies from-zone trust to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

} from-zone trust to-zone untrust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

} from-zone untrust to-zone trust {

policy default-deny {

match {

source-address any;

destination-address any;

application any;

}

then {

deny;

}

If you are done configuring the device, enter commit from configuration mode.

NOTE: As a final step, exit configuration mode and use the request system reboot command to reboot the vSRX VM. You can use the virsh console command on the Ubuntu server to reconnect to the vSRX after reboot.

Verifying the Basic Configuration on the vSRX Instance

Purpose Verify the basic configuration on the vSRX instance.

vSRX Installation Guide for KVM

Action Verify that the ge-0/0/0.0 interface has an assigned IP address from the TestLeft network

DHCP address range, and that the ge-0/0/1.0 has an assigned IP address from the

TestRight network DHCP address range.

root> show interfaces terse

Interface Admin Link Proto Local Remote ge-0/0/0 up up ge-0/0/0.0 up up inet 192.168.123.254/24 gr-0/0/0 up up ip-0/0/0 up up lsq-0/0/0 up up lt-0/0/0 up up mt-0/0/0 up up sp-0/0/0 up up sp-0/0/0.0 up up inet

inet6 sp-0/0/0.16383 up up inet ge-0/0/1 up up ge-0/0/1.0 up up inet 192.168.124.238/24 dsc up up em0 up up em0.0 up up inet 128.0.0.1/2 em1 up up em1.32768 up up inet 192.168.1.2/24 em2 up up fxp0 up up fxp0.0 up up inet 192.168.2.1/24 ipip up up irb up up lo0 up up lo0.16384 up up inet 127.0.0.1 --> 0/0 lo0.16385 up up inet 10.0.0.1 --> 0/0

10.0.0.16 --> 0/0

128.0.0.1 --> 0/0

128.0.0.4 --> 0/0

128.0.1.16 --> 0/0 lo0.32768 up up lsi up up mtun up up pimd up up pime up up pp0 up up ppd0 up up ppe0 up up st0 up up tap up up vlan up down

Documentation

• libvirt Network XML Format

• libvirt Command Reference

CHAPTER 3

vSRX Licensing

•

vSRX Feature Licenses Overview on page 41

•

Managing Licenses for vSRX on page 47

•

vSRX License Model Numbers on page 53

vSRX Feature Licenses Overview

Some Junos OS software features require a license to activate the feature.

To enable a licensed feature, you need to purchase, install, manage, and verify a license key that corresponds to each licensed feature. To conform to software feature licensing requirements, you must purchase one license per feature per instance. The presence of the appropriate software unlocking key on your virtual instance allows you to configure and use the licensed feature.

Licenses are usually ordered when the software application is purchased, and this information is bound to a customer ID. If you did not order the licenses when you purchased your software application, contact your account team or Juniper Networks Customer

Care for assistance.

Licenses can be procured from the Juniper Networks License Management System (LMS) .

NOTE: The license for advanced security features available on the physical

SRX Series device cannot be used with vSRX deployments.

NOTE: If you are performing a software downgrade with licenses installed, you will see an error message in the CLI when you try to configure the licensed features or run the command show system license status.

We recommend deleting existing licenses before performing a software downgrade.

vSRX Installation Guide for KVM

License Types

Juniper Networks provides evaluation licenses for both basic firewall features and advanced security features for a limited period.

If you want to use vSRX to provide basic firewall features, you can use core (basic) licenses. However, to use some of the more advanced security features, such as

AppSecure, IDP, and UTM, you might need to purchase advanced features licenses.

vSRX Evaluation License

To speed deployment of licensed features, Junos OS software for vSRX implements an honor-based licensing structure and provides you with a 60-day product evaluation license or a 30-day advanced security features license, both of which allow you to use a licensed feature for the specified period without having to install a license key.

Table 11 on page 42

lists vSRX evaluation license types.

Table 11: vSRX Feature Licenses Type

License Package Type Period

License Model

Number

Trial license

(temporary for evaluation only)

Product evaluation- Basic 60 days

Product evaluation- Advanced features

30 days

Product Evaluation License

This is a 60-day evaluation license for vSRX. This product unlocking license is required for basic functions, such as networking, routing and, basic security features.

vSRX software image includes a 60-day trial license. When you download and install the vSRX image, you are entitled to use the trial license for 60 days.

Within 30 days of the license expiration date, a license expiration warning appears when you log in to the vSRX instance. After the product evaluation license expires, you will not be able to use the product; it will be disabled because as flow configuration options will not work. Only management interfaces and CLI configurations are preserved.

Advanced Security Features License

The advanced security features license is a 30-day trial license for vSRX that is required for advanced security features such as UTM, IDP, and AppSecure.

You can download the trial license for advanced security features from one of the following locations:

• Software Download Page

• vSRX 60-Day Free Trial License Page

Chapter 3: vSRX Licensing

Installation of the trial license is similar to the regular license installation. For details, see

“Managing Licenses for vSRX” on page 47

NOTE: The 30-day trial license period begins on the day you enable enhanced security features after you install the evaluation licenses.

To continue using vSRX features after an optional 30-day period, you must purchase and install the license; otherwise, the features are disabled.

If the license for advanced security features expires while the evaluation license (product unlocking license) is still valid, only the advanced security features that require license are disabled.

NOTE: Direct upgrade is not supported for upgrading from earlier Junos OS releases for vSRX to Junos OS Release 15.1X49-D15 for vSRX. When you download and install the vSRX image for Junos OS Release 15.1X49-D15, you are entitled use the trial license for 60 days.

Bandwidth (Throughput) Licenses

Bandwidth (throughput) licenses allow you to use a single instance of the software for up to the maximum throughput specified in the license entitlement. Throughput licenses can be combined on a single instance of the software so that the maximum throughput for that instance is the aggregate of all the throughput licenses assigned to that instance.

A throughput license cannot be split across multiple instances. Throughput licenses are identified in the license entitlement in Mbps, or Gbps.

For more information on Bandwidth licenses, see

“vSRX License Model Numbers” on page 53 .

A throughput license can be perpetual or subscription-based.

• Perpetual license: A perpetual license allows you to use the licensed software indefinitely.

• Subscription-based license: A subscription-based license is an annual license that allows you to use the licensed software feature for a limited duration. Subscriptions might involve periodic downloads of content (such as for IDP threat signature files).

At the end of the license period, you need to renew the license to continue using it.

All license subscriptions are renewable.

Only subscription-based licenses, which are active for a set period, require renewal.

Perpetually licensed features or capacities never expire and therefore never need to be renewed.

For more information, see vSRX subscriptions .

For details on installing and managing licenses, see

“Managing Licenses for vSRX” on page 47 .

vSRX Installation Guide for KVM

vSRX License Keys Components

A license key consists of two parts:

• License ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, it is given a license ID.

• License data—Block of binary data that defines and stores all license key objects.

For example, in the following typical license key, the string E413XXXX57 is the license ID, and the trailing block of data is the license data:

E413XXXX57 aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa

aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff

The license data conveys the customer ID and the software serial number (Juniper

Networks support reference number) to the vSRX instance.

License Management Fields Summary

The Licenses page displays a summary of licensed features that are configured on the vSRX instance and a list of licenses that are installed on the vSRX instance.

To view the license details, select Maintain>Licenses in the J-Web user interface. The

Licenses window appears as shown in

Figure 4 on page 44 .

Figure 4: J-Web Licenses Window

Chapter 3: vSRX Licensing

You can also view the details of a license in the CLI using the show system license command.

Figure 5 on page 45

shows details of an evaluation license in the CLI.

Figure 5: License Details in the CLI

The information on the license management page is summarized in

Table 12 on page 45 .

Table 12: Summary of License Management Fields

Field Name Definition

Feature Summary

Feature

Licenses Used

Name of the licensed feature:

•

Features —Software feature licenses.

All features —All-inclusive licenses.

Number of licenses currently being used on the vSRX instance. Usage is determined by the configuration. If a feature license exists and that feature is configured, the license is considered used.

vSRX Installation Guide for KVM

Table 12: Summary of License Management Fields (continued)

Field Name Definition

Licenses Installed

Licenses Needed

Licenses expires on

Number of licenses installed on the vSRX instance for the particular feature.

Number of licenses required for legal use of the feature. Usage is determined by the configuration on the vSRX instance: If a feature is configured and the license for that feature is not installed, a single license is needed.

Date the license expires.

Installed Licenses

State

Version

Group

Unique alphanumeric ID of the license.

Valid —The installed license key is valid.

Invalid —The installed license key is not valid.

Numeric version number of the license key.

If the license defines a group license, this field displays the group definition.

If the license requires a group license, this field displays the required group definition.

NOTE: Because group licenses are currently unsupported, this field is always blank.

Enabled Features

Expiration

Name of the feature that is enabled with the particular license.

Date the license expires.

Software serial number The serial number is a unique 14-digit number that Juniper Networks uses to identify your particular software installation. You can find the software serial number in the Software Serial Number Certificate attached to the e-mail that was sent when you ordered your Juniper

Networks software.

Customer ID ID that identifies the registered user.

Documentation

•

vSRX License Model Numbers on page 53

•

Managing Licenses for vSRX on page 47

Chapter 3: vSRX Licensing

Managing Licenses for vSRX

This section includes following topics:

•

vSRX Evaluation License Installation Process on page 47

•

Adding a New License Key on page 47

•

Updating vSRX Licenses on page 50

•

Deleting a License Key on page 50

•

License Warning Messages on page 52

vSRX Evaluation License Installation Process

Juniper Networks provides a 60-day evaluation license for vSRX standard security features. In addition, you can download and install 30-day evaluation license for vSRX advanced (Layer 7) security features.

Within 30 days of the license expiration date, a license expiration warning appears when you log in to the device. After license expiry, vSRX no longer functions effectively. Only management interfaces and the CLI configuration are preserved.

vSRX software image includes a 60-day trail license. When you download and install the vSRX image, you are entitled use the trial license for 60 days.

If you want to install evaluation license for advanced security features (30-day evaluation license), you can download the evaluation license from one of the following options:

• Software Download Page

• vSRX 60-Day Free Trial License Page

Installation of the evaluation license is similar to the regular license installation using the

CLI. See

“Adding a New License Key” on page 47

NOTE: The 30-day evaluation license period begins on the day you enable enhanced security features after installing evaluation licenses.

To continue using vSRX features after an optional 30-day evaluation period, you must purchase and install the license. Otherwise, the features are disabled.

Adding a New License Key

You can add a license key from a file or URL, from a terminal, or from the J-Web user interface.

vSRX Installation Guide for KVM

To install a license using the J-Web interface:

Select Maintain>Licenses on the J-Web user interface. The Licenses window is displayed as shown in

Figure 6 on page 48 .

Figure 6: J-Web Licenses Window

Under Installed Licenses, click Add. The Add License dialog is displayed as shown in

Figure 7 on page 48 .

Figure 7: Add License Window

Do one of the following, using a blank line to separate multiple license keys:

• Enter the full URL to the destination file containing the license key in the License

File URL box.

• Paste the license key text, in plain-text format, in the License Key Text box.

Click OK to add the license key. The License Details window is displayed as shown in

Figure 8 on page 49 .

Chapter 3: vSRX Licensing

Figure 8: License Details Window

The license key is installed and activated on vSRX.

To install a license from the CLI:

From operational mode, add a license key using one of the following steps:

• Enter the full URL to the destination file containing the license key.

user@host> request system license add <license-key>

• Paste the license key text in plain-text format.

user@host>request system license add terminal

When prompted, enter the license key, separating multiple license keys with a blank line. If the license key you enter is invalid, an error is generated when you press CTRL+D to exit license entry mode.

[Type ^D at a new line to end input,

enter blank line between each license key]

E413012057 aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa

aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff

E413012057: successfully added add license complete (no errors)

View the details of the license by entering the show system license command.

root@host> show system license

License usage: Licenses Licenses Licenses Expiry

Feature name used installed needed wf key websense ewf 1 0 1 invalid

Licenses installed: none

vSRX Installation Guide for KVM

NOTE: You can save the license key to a file and upload this file to vSRX file system through FTP or Secure Copy (SCP), and then use the request system license add file-name command to install the license.

The license key is installed and activated on vSRX.

Updating vSRX Licenses

You can update the vSRX licenses using the following two methods:

• Automatic license update using the CLI

• Manual license update using the CLI

As a prerequisite, you must install at least one valid license key on your vSRX for required features. License auto-update is performed based on the valid software serial number and customer ID embedded in the license key.

To enable automatic license updates from the CLI:

Contact your account team or Juniper Networks Customer Care to extend the validity period of existing license keys and obtain the URL for a valid update server.

Once you have successfully extended your license key and received the update server

URL, configure the auto-update parameter.

user@host> set system license autoupdate url https://ae1.juniper.net/

Configure renew options (if required). The following sample shows configuring before expiration as 30 days and renew interval as 6 hours.

user@host> set system license renew before-expiration 30 user@host> set system license renew interval 6

The configuration allows vSRX to contact the license server 30 days before the current license expires and sends an automatic update request every 6 hours.

To manually update the license from the CLI:

Update the license keys manually.

user@host> request system license update url <url.of.license.server>

NOTE: The request system license update command will always use the default Juniper license server https://ae1.juniper.net

Check the status of the license by entering the show system license command.

This command sends a license update request to the license server immediately.

Deleting a License Key

You can delete a license key using the CLI or the J-Web user interface.

Chapter 3: vSRX Licensing

To delete a license using the J-Web interface:

Select Maintain>Licenses .

Select the check box of the license or licenses you want to delete, as shown in

Figure 9 on page 51

Figure 9: License Details Window

Click Delete.

Click OK to confirm your deletion, as shown in

Figure 10 on page 51

Figure 10: Delete Licenses Window

The license key you deleted will be removed.

To delete a license key using the CLI:

From operational mode, for each license, enter the following command and specify the license ID. You can delete only one license at a time.

user@host> request system license delete <license-key-identifier>

Or you can use the following command to delete all installed licenses at a time.

vSRX Installation Guide for KVM user@host> request system license delete all

Type yes when you are prompted to confirm the deletion.

Delete license JUNOS606279 ? [yes,no] (no)

The license key you deleted will be removed.

License Warning Messages

You must purchase a new license or renew your existing subscription-based license to have a seamless transition from the old license to the new one.

The following conditions occur when a license expires on vSRX:

• Evaluation license for the core expires: Packet forwarding on vSRX is disabled. However, you can manage vSRX through the fxp0 management interface, and the CLI configuration is preserved.

• Subscription-based licenses for advanced security features expire but subscription-based licenses for core services are active: A 30-day grace period begins, allowing the user to continue using advanced security features. After the grace period, advanced security features are disabled. Basic features are always available for using.

After subscription-based licenses for core services are expired, a warning message is displayed to notify the user, but basic features will be preserved.

• Subscription-based license for core features expires but subscription-based license for advanced security features is active: A warning message is displayed to notify the user. However, you can continue to use all features on vSRX. Advanced security features are disabled when the subscription-based license for advanced security features expires, but basic features are still preserved.

To use features that require a license, you must install and configure a license key. After the license expires, warning messages are displayed in the system log and on the J-Web dashboard.

When a license expires, the System Alarms section of the J-Web dashboard displays a message stating that the license has expires as shown in

Figure 11 on page 53 .

Figure 11: J-Web Dashboard for License Expiry Warning

Chapter 3: vSRX Licensing

When license expires, the following message is displayed when you login:

Virtual Appliance License is invalid

Documentation

•

vSRX Feature Licenses Overview on page 41

•

vSRX License Model Numbers on page 53

vSRX License Model Numbers

The licenses used by all Juniper Networks devices are based on SKUs, which represent lists of features. Each license includes a list of features that the license enables along with information about those features.

For information about purchasing software licenses, contact your Juniper Networks sales representative at http://www.juniper.net/in/en/contact-us/ .

vSRX licenses are based on application packages and processing capacity.

A throughput license cannot be split across multiple instances. Throughput licenses are identified in the license entitlement in Mbps, or Gbps.

vSRX Installation Guide for KVM vSRX provides bandwidth in the following capacities (throughput per instance): 10 Mbps,

100 Mbps, 1 Gbps, 2 Gbps, and 4 Gbps. Each of these bandwidth tiers are offered with four different packages along with bandwidth based ala-carte advanced Layer 7 security services SKUs.

Table 13 on page 54

describes the features available with the various license packages.

Table 13: vSRX Bandwidth Licensing Package Types

License

Type Description Duration

STD

ASCB /

ASEC

Includes the following features:

•

Core security – firewall, ALG, screens, user firewall

IPSec VPN (site-to-site VPN) •

•

NAT

CoS

Multicast services – IP Multicast (PIM,

IGMP)

Routing services – BGP, OSPF, DHCP,

J-Flow, IPv4, and IPv6

•

High availability

Foundation – Static routing, management (J-Web, CLI, and

NetConf), on-box logging, diagnostics

• Software platform – KVM, Openstack,

ESXi 6.0, Contrail

Both perpetual and subscription license options are available.

See

Table 14 on page 56

for STD bandwidth SKUs available for vSRX.

Includes all STD features and the following additional AppSecure features:

Subscription licenses only.

•

AppID

AppFW

AppQoS

AppTrack

See

Table 15 on page 57

for bandwidth SKUs available for vSRX with AppSecure and IPS features.

Includes all STD and ASEC features with the addition of UTM capabilities:

•

Antispam

Antivirus

Content filtering

Web filtering

Subscription licenses only.

See

Table 17 on page 59

for CS bandwidth SKUs available for vSRX.

Chapter 3: vSRX Licensing

Table 13: vSRX Bandwidth Licensing Package Types (continued)

License

Type Description Duration

Advanced

Security

Services

(Ala carte:

ASEC, S-AV,

W-EWF)

•

Ala-carte Layer 7 security services licenses including:

Subscription licenses only.

Sophos antivirus

Websense enhanced Web filtering

AppSecure

IPS

See

Table 16 on page 58

for

AppSecure and IPS SKUs available for vSRX.

See

Table 19 on page 61

for vSRX.

for Sophos antivirus bandwidth SKUs available

Table 20 on page 62

lists the Web filtering subscription licenses available for vSRX.

NOTE: License stacking is allowed. So, for example, to license 20 Mbps of throughput for the standard (STD) feature set perpetually, use two

VSRX-10M-STD licenses.

Table 14 on page 56

lists the standard bandwidth licenses available for vSRX.

vSRX Installation Guide for KVM

Table 14: Standard (STD) vSRX Bandwidth Licenses

STD Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX standard package (1 year, 3 years, and perpetual)

VSRX-10M-STD

VSRX-10M-STD-1

VSRX-10M-STD-1-R

VSRX-10M-STD-3

VSRX-10M-STD-3-R

VSRX-100M-STD

VSRX-100M-STD-1

VSRX-100M-STD-1-R

VSRX-100M-STD-3

VSRX-100M-STD-3-R

VSRX-1G-STD

VSRX-1G-STD-1

VSRX-1G-STD-1-R

VSRX-1G-STD-3

VSRX-1G-STD-3-R

VSRX-2G-STD

VSRX-2G-STD-1

VSRX-2G-STD-1-R

VSRX-2G-STD-3

VSRX-2G-STD-3-R

VSRX-4G-STD

VSRX-4G-STD-1

VSRX-4G-STD-1-R

VSRX-4G-STD-3

VSRX-4G-STD-3-R

Chapter 3: vSRX Licensing

Table 15 on page 57

lists the bandwidth licenses available for vSRX with AppSecure and

IPS features.

Table 15: vSRX AppSecure and IPS (ASCB / ASEC) Bandwidth Licenses

ASCB / ASEC Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX

AppSecure package includes all features in the STD package with IPS and

AppSecure (1 year and 3 years subscription)

VSRX-10M-ASECB-1

VSRX-10M-ASECB-1-R

VSRX-10M-ASECB-3

VSRX-10M-ASECB-3-R

VSRX-100M-ASCB-1

VSRX-100M-ASCB-1-R

VSRX-100M-ASCB-3

VSRX-100M-ASCB-3-R

VSRX-1G-ASECB-1

VSRX-1G-ASECB-1-R

VSRX-1G-ASECB-3

VSRX-1G-ASECB-3-R

VSRX-2G-ASECB-1

VSRX-2G-ASECB-1-R

VSRX-2G-ASECB-3

VSRX-2G-ASECB-3-R

VSRX-4G-ASECB-1

VSRX-4G-ASECB-1-R

VSRX-4G-ASECB-3

VSRX-4G-ASECB-3-R

Table 16 on page 58

lists the subscription licenses available for vSRX with AppSecure and IPS features.

vSRX Installation Guide for KVM

Table 16: vSRX AppSecure and IPS Subscription Licenses

ASEC Licenses Model Number

10M/100M/1G/2G/4G subscription—vSRX AppSecure package includes IPS and AppSecure (1 year and

3 years subscription)

VSRX-10M-ASEC-1

VSRX-10M-ASEC-1-R

VSRX-10M-ASEC-3

VSRX-10M-ASEC-3-R

VSRX-100M-ASEC-1

VSRX-100M-ASEC-1-R

VSRX-100M-ASEC-3

VSRX-100M-ASEC-3-R

VSRX-1G-ASEC-1

VSRX-1G-ASEC-1-R

VSRX-1G-ASEC-3

VSRX-1G-ASEC-3-R

VSRX-2G-ASEC-1

VSRX-2G-ASEC-1-R

VSRX-2G-ASEC-3

VSRX-2G-ASEC-3-R

VSRX-4G-ASEC-1

VSRX-4G-ASEC-1-R

VSRX-4G-ASEC-3

VSRX-4G-ASEC-3-R

Table 17 on page 59

lists the Content Security(CS) bandwidth licenses available for vSRX.

Chapter 3: vSRX Licensing

Table 17: vSRX Content Security (CS) Bandwidth Licenses

CS Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX

CS package includes all features in STD,

IPS, and Appsecure, enhanced Web filtering, Sophos antivirus, antispam, contentfiltering, (1 year and 3 years).

VSRX-10M-CS-B-1

VSRX-10M-CS-B-1-R

VSRX-10M-CS-B-3

VSRX-10M-CS-B-3-R

VSRX-100M-CS-B-1

VSRX-100M-CS-B-1-R

VSRX-100M-CS-B-3

VSRX-100M-CS-B-3-R

VSRX-1G-CS-B-1

VSRX-1G-CS-B-1-R

VSRX-1G-CS-B-3

VSRX-1G-CS-B-3-R

VSRX-2G-CS-B-1

VSRX-2G-CS-B-1-R

VSRX-2G-CS-B-3

VSRX-2G-CS-B-3-R

VSRX-4G-CS-B-1

VSRX-4G-CS-B-1-R

VSRX-4G-CS-B-3

VSRX-4G-CS-B-3-R

Table 18 on page 60

lists the CS subscription licenses available for vSRX.

vSRX Installation Guide for KVM

Table 18: vSRX Content Security (CS) Subscription Licenses

CS Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX

CS package includes enhanced Web filtering, Sophos antivirus, antispam,

Appsecure and IPS (1 year and 3 years)

VSRX-10M-CS-1

VSRX-10M-CS-1-R

VSRX-10M-CS-3

VSRX-10M-CS-3-R

VSRX-100M-CS-1

VSRX-100M-CS-1-R

VSRX-100M-CS-3

VSRX-100M-CS-3-R

VSRX-1G-CS-1

VSRX-1G-CS-1-R

VSRX-1G-CS-3

VSRX-1G-CS-3-R

VSRX-2G-CS-1

VSRX-2G-CS-1-R

VSRX-2G-CS-3

VSRX-2G-CS-3-R

VSRX-4G-CS-1

VSRX-4G-CS-1-R

VSRX-4G-CS-3

VSRX-4G-CS-3-R

Table 19 on page 61

lists the Sophos antivirus (S-AV) bandwidth licenses available for vSRX.

Chapter 3: vSRX Licensing

Table 19: vSRX Sophos Anti-virus (S-AV) Bandwidth Licenses

S-AV Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX

S-AV license (1 year and 3 years).

VSRX-10M-S-AV-1

VSRX-10M-S-AV-1-R

VSRX-10M-S-AV-3

VSRX-10M-S-AV-3-R

VSRX-100M-S-AV-1

VSRX-100M-S-AV-1-R

VSRX-100M-S-AV-3

VSRX-100M-S-AV-3-R

VSRX-1G-S-AV-1

VSRX-1G-S-AV-1-R

VSRX-1G-S-AV-3

VSRX-1G-S-AV-3-R

VSRX-2G-S-AV-1

VSRX-2G-S-AV-1-R

VSRX-2G-S-AV-3

VSRX-2G-S-AV-3-R

VSRX-4G-S-AV-1

VSRX-4G-S-AV-1-R

VSRX-4G-S-AV-3

VSRX-4G-S-AV-3-R

Table 20 on page 62

lists the enhanced Web filtering (E-EWF) subscription licenses available for vSRX.

vSRX Installation Guide for KVM

Table 20: vSRX Enhanced Web Filtering Bandwidth Licenses

W-EWF Licenses Model Number

10M/100M/1G/2G/4G throughput—vSRX

W-EWF license (1 year and 3 years).

VSRX-10M-W-EWF-1

VSRX-10M-W-EWF-1-R

VSRX-10M-W-EWF-3

VSRX-10M-W-EWF-3-R

VSRX-100M-WEWF-1

VSRX-100M-WEWF-1-R

VSRX-100M-WEWF-3

VSRX-100M-WEWF-3-R

VSRX-1G-W-EWF-1

VSRX-1G-W-EWF-1-R

VSRX-1G-W-EWF-3

VSRX-1G-W-EWF-3-R

VSRX-2G-W-EWF-1

VSRX-2G-W-EWF-1-R

VSRX-2G-W-EWF-3

VSRX-2G-W-EWF-3-R

VSRX-4G-W-EWF-1

VSRX-4G-W-EWF-1-R

VSRX-4G-W-EWF-3

VSRX-4G-W-EWF-3-R

Documentation

•

vSRX Feature Licenses Overview on page 41

•

Managing Licenses for vSRX on page 47

CHAPTER 4

Index

•

Index on page 65

vSRX Installation Guide for KVM

Index

Symbols

#, comments in configuration statements.....................

( ), in syntax descriptions.......................................................

< >, in syntax descriptions.....................................................

[ ], in configuration statements...........................................

{ }, in configuration statements..........................................

| (pipe), in syntax descriptions............................................

B

braces, in configuration statements..................................

brackets

angle, in syntax descriptions........................................

xi square, in configuration statements.........................

C

comments, in configuration statements.........................

conventions

text and syntax...................................................................

curly braces, in configuration statements.......................

customer support....................................................................

xii contacting JTAC...............................................................

xii

D

documentation

comments on....................................................................

E

example installing on Ubuntu.....................................................

F

factory default settings........................................................

font conventions........................................................................

H

host OS........................................................................................

I

installing

virt-manager....................................................................

K

KVM understanding..................................................................

L

launching virt-manager....................................................................

licenses displaying (J-Web)........................................................

Linux kernel upgrade..............................................................................

version................................................................................

M

management console

connecting........................................................................

manuals

comments on....................................................................

P

parentheses, in syntax descriptions..................................

R

RAM configuring........................................................................

maximum...........................................................................

S

Specifications vSRX....................................................................................

support, technical See technical support

syntax conventions...................................................................

T

technical support contacting JTAC...............................................................

xii

V

vCPUs configuring........................................................................

maximum...........................................................................

vNICs configuring........................................................................

maximum...........................................................................

vSRX

hardware requirements................................................

installing............................................................................

installing on Ubuntu (example)...............................

management console..................................................

vSRX Installation Guide for KVM

RAM......................................................................................

16 specifications...................................................................

understanding..................................................................

vCPUs..................................................................................

16 vNICs....................................................................................

Reklamë

vSRX Installation Guide for KVM

Table of Contents

List of Figures

List of Tables

About the Documentation

Documentation and Release Notes

Documentation Conventions

Table 1: Notice Icons

Table 2: Text and Syntax Conventions

Table 2: Text and Syntax Conventions (continued)

Documentation Feedback

Requesting Technical Support

Self-Help Online Tools and Resources

Opening a Case with JTAC

CHAPTER 1

vSRX Overview

Understanding vSRX

Understanding vSRX with KVM

System Requirements for vSRX on KVM

Software Environment Requirements

Table 3: Specifications for vSRX

Table 4: Kernel Recommendations for KVM

Table 5: Additional Linux Packages for KVM

Hardware Recommendations

Table 6: Hardware Specifications for the Host Machine

Best Practices Recommendations

Interface Naming and Mapping

Table 7: Interface Names for a Standalone vSRX

Table 7: Interface Names for a Standalone vSRX (continued)

Table 8: Interface Names for a vSRX Cluster Pair

vSRX Factory Default Settings

Table 9: Factory Default Settings for Security Policies

CHAPTER 2

Installing vSRX

Enabling Nested Virtualization

Upgrading the Host OS Linux Kernel

Upgrading the Linux Kernel on CentOS

Installing vSRX with KVM

Installing vSRX with virt-manager

Figure 1: virt-manager

Figure 2: Create a New Virtual Machine

Installing vSRX with virt-install

Table 10: virt-install Options

Table 10: virt-install Options (continued)

Connecting to the vSRX Management Console on KVM

Example: Installing and Launching vSRX on Ubuntu

Requirements

Overview

Figure 3: vSRX VM on Ubuntu

Quick Configuration

Step by Step Configuration

CHAPTER 3

vSRX Licensing

vSRX Feature Licenses Overview

License Types

vSRX Evaluation License

Table 11: vSRX Feature Licenses Type

Bandwidth (Throughput) Licenses

vSRX License Keys Components

License Management Fields Summary

Figure 4: J-Web Licenses Window

Figure 5: License Details in the CLI

Table 12: Summary of License Management Fields

Table 12: Summary of License Management Fields (continued)

Managing Licenses for vSRX

vSRX Evaluation License Installation Process

Adding a New License Key

Figure 6: J-Web Licenses Window

Figure 7: Add License Window

Figure 8: License Details Window

Updating vSRX Licenses

Deleting a License Key

Figure 9: License Details Window

Figure 10: Delete Licenses Window

License Warning Messages

Figure 11: J-Web Dashboard for License Expiry Warning

vSRX License Model Numbers

Table 13: vSRX Bandwidth Licensing Package Types

Table 13: vSRX Bandwidth Licensing Package Types (continued)

Table 14: Standard (STD) vSRX Bandwidth Licenses