Juniper Networks vSRX Virtual Security Appliance User Guide

PDF

Documento

vSRX Guide for Contrail

Modified: 2017-11-01

Juniper Networks, Inc.

1133 Innovation Way

Sunnyvale, California 94089

USA

408-745-2000 www.juniper.net

Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc. and/or its affiliates in the United States and other countries. All other trademarks may be property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

vSRX Guide for Contrail

The information in this document is current as of the date on the title page.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

END USER LICENSE AGREEMENT

The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.juniper.net/support/eula/ . By downloading, installing or using such software, you agree to the terms and conditions of that

EULA.

Chapter 1

Chapter 2

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Documentation Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv

Opening a Case with JTAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv

Overview and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Understanding vSRX with Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 vSRX Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Juniper Networks Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

vSRX Scale Up Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 vSRX Benefits and Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

System Requirements for vSRX on Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Contrail Recommendations for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Hardware Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Best Practices Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

NUMA Nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

PCI NIC-to-VM Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Mapping Virtual Interfaces to a vSRX VM . . . . . . . . . . . . . . . . . . . . . . . . . 23

Interface Naming and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

vSRX Factory-Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Enabling Nested Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Creating an Image Flavor with OpenStack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Creating an Image Flavor for vSRX with Horizon . . . . . . . . . . . . . . . . . . . . . . . 29

Creating an Image Flavor for vSRX with the Nova CLI . . . . . . . . . . . . . . . . . . . 31

Uploading the vSRX Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Uploading the vSRX Image with OpenStack Horizon . . . . . . . . . . . . . . . . . . . 32

Uploading the vSRX Image with the OpenStack Glance CLI . . . . . . . . . . . . . 34

Using Cloud-Init in an OpenStack Environment to Automate the Initialization of vSRX Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Performing Automatic Setup of a vSRX Instance Using an OpenStack

Command-Line Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Performing Automatic Setup of a vSRX Instance from the OpenStack

Dashboard (Horizon) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

iii

vSRX Guide for Contrail iv

vSRX Service Chains in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Overview of Service Chains with vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Understanding Service Chains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Service Chain Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Components of a Service Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Service Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Service Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Network Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Spawning vSRX in a Contrail Service Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Creating a Service Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Creating Left and Right Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Creating a vSRX Service Instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Creating a Network Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Adding a Network Policy to a Virtual Network . . . . . . . . . . . . . . . . . . . . . . . . . 55

vSRX VM Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Connecting to the vSRX Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Connecting to the vSRX Management Console with Horizon . . . . . . . . . . . . . 57

Connecting to the vSRX Management Console with Contrail . . . . . . . . . . . . . 57

Managing the vSRX VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Powering On the VM from OpenStack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Pausing the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Restarting the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Powering Off the VM from OpenStack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Deleting the vSRX VM from Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Upgrading Multicore vSRX with Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Configuring Multi-queue Virtio Interface for vSRX VM with OpenStack . . . . . 61

Modifying an Image Flavor for vSRX with the Dashboard . . . . . . . . . . . . . . . . 61

Updating a Service Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Monitoring vSRX with Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

vSRX Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 vSRX Configuration and Management Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Understanding the Junos OS CLI and Junos Scripts . . . . . . . . . . . . . . . . . . . . 65

Understanding the J-Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Understanding Junos Space Security Director . . . . . . . . . . . . . . . . . . . . . . . . 65

Configuring vSRX Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Configuring vSRX Using the J-Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Accessing the J-Web Interface and Configuring vSRX . . . . . . . . . . . . . . . . . . . 67

Applying the Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 vSRX Feature Licenses Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 vSRX License Procurement and Renewal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

vSRX Evaluation License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Product Evaluation License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Advanced Security Features Evaluation License . . . . . . . . . . . . . . . . . . . 73

License Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Throughput . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Table of Contents

Chapter 7

Chapter 8

License Duration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Individual (á la carte) Feature Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Bundled Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Stacking Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 vSRX License Keys Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

License Management Fields Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Managing Licenses for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 vSRX Evaluation License Installation Process . . . . . . . . . . . . . . . . . . . . . . . . . 79

Adding a New License Key with J-Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Adding a New License Key from the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Updating vSRX Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Deleting a License with J-Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Deleting a License with the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

License Warning Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

vSRX License Model Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Junos OS Features on vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Finding the Software Serial Number for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

List of Figures

Overview and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Figure 1: vSRX Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Figure 2: OpenStack Flavors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Figure 3: Create a Flavor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Figure 4: OpenStack Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Figure 5: Create an Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Figure 6: Launch Instance Details Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Figure 7: Launch Instance Source Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Figure 8: Launch Instance Flavor Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Figure 9: Launch Instance Networks Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Figure 10: Launch Instance Configuration Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Figure 11: Launch Instance Configuration Tab with Loaded Junos OS

Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

vSRX Service Chains in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Figure 12: vSRX Service Chaining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Figure 13: Contrail Service Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Figure 14: Contrail Add a Service Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Figure 15: Advanced Options - Add Service Template . . . . . . . . . . . . . . . . . . . . . . . 51

Figure 16: Creating a Virtual Network in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Figure 17: Creating a Network Policy in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Figure 18: Contrail Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Figure 19: Adding a Network Policy to a Virtual Network in Contrail . . . . . . . . . . . 55

vSRX VM Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Figure 20: OpenStack Flavors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Figure 21: Sample vSRX License SKU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Figure 22: J-Web Licenses Window Showing Installed Licenses . . . . . . . . . . . . . . 77

Figure 23: J-Web Licenses Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Figure 24: Add License Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Figure 25: License Details Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Figure 26: Deleting a License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Figure 27: Delete Licenses Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Figure 28: J-Web Dashboard for License Expiry Warning . . . . . . . . . . . . . . . . . . . . 85

vii

List of Tables

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Table 1: Notice Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Table 2: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Overview and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Table 3: vSRX Scale Up Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Table 4: Specifications for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Table 5: Contrail Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Table 6: Hardware Specifications for the Host Machine . . . . . . . . . . . . . . . . . . . . . 22

Table 7: Interface Names for a Standalone vSRX VM . . . . . . . . . . . . . . . . . . . . . . . 24

Table 8: Interface Names for a vSRX Cluster Pair . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Table 9: Factory Default Settings for Security Policies . . . . . . . . . . . . . . . . . . . . . . 25

Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Table 10: nova flavor-create Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

vSRX Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Table 11: Instance Name and User Account Information . . . . . . . . . . . . . . . . . . . . 69

Table 12: System Time Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

vSRX Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Table 13: vSRX Evaluation License Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Table 14: Summary of License Management Fields . . . . . . . . . . . . . . . . . . . . . . . . 78

Table 15: vSRX Licensing Package Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Table 16: Secure Cloud Connect (SCC) vSRX Bandwidth Licenses . . . . . . . . . . . 88

Table 17: Standard (STD) vSRX Bandwidth Licenses . . . . . . . . . . . . . . . . . . . . . . 89

Table 18: vSRX AppSecure and IPS Bundled (ASCB and ASECB) Bandwidth

Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Table 19: Individual vSRX AppSecure and IPS Subscription Licenses . . . . . . . . . . 91

Table 20: vSRX Content Security Bundled (CS-B) Bandwidth Licenses . . . . . . . . 92

Table 21: vSRX Individual Content Security (CS) Subscription Licenses . . . . . . . . 93

Table 22: vSRX Individual Sophos Antivirus (S-AV) Bandwidth Licenses . . . . . . . 94

Table 23: vSRX Individual Enhanced Web Filtering (W-EWF) Bandwidth

Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Junos OS Features on vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Table 24: vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Table 25: SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . 98

About the Documentation

•

Documentation and Release Notes on page xi

•

Supported Platforms on page xi

•

Documentation Conventions on page xi

•

Documentation Feedback on page xiii

•

Requesting Technical Support on page xiv

Documentation and Release Notes

To obtain the most current version of all Juniper Networks

® technical documentation, see the product documentation page on the Juniper Networks website at http://www.juniper.net/techpubs/ .

If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes.

Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at http://www.juniper.net/books .

Supported Platforms

For the features described in this document, the following platforms are supported:

• vSRX

Documentation Conventions

Table 1 on page xii

defines notice icons used in this guide.

vSRX Guide for Contrail

Table 1: Notice Icons

Icon Meaning

Informational note

Caution

Warning

Laser warning

Tip

Best practice

Description

Indicates important features or instructions.

Indicates a situation that might result in loss of data or hardware damage.

Alerts you to the risk of personal injury or death.

Alerts you to the risk of personal injury from a laser.

Indicates helpful information.

Alerts you to a recommended use or implementation.

Table 2 on page xii

defines the text and syntax conventions used in this guide.

Table 2: Text and Syntax Conventions

Convention Description Examples

Bold text like this

Fixed-width text like this

Represents text that you type.

Represents output that appears on the terminal screen.

To enter configuration mode, type the configure command: user@host> configure user@host> show chassis alarms

No alarms currently active

Italic text like this

•

Introduces or emphasizes important new terms.

Identifies guide names.

Identifies RFC and Internet draft titles.

•

A policy term is a named structure that defines match conditions and actions.

Junos OS CLI User Guide

RFC 1997, BGP Communities Attribute

Represents variables (options for which you substitute a value) in commands or configuration statements.

Configure the machine’s domain name:

[edit] root@# set system domain-name

domain-name

About the Documentation

Table 2: Text and Syntax Conventions (continued)

Convention Description

Text like this

< > (angle brackets)

| (pipe symbol)

Examples

Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components.

•

To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level.

The console port is labeled CONSOLE .

Encloses optional keywords or variables.

stub <default-metric metric>;

Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity.

broadcast | multicast

(string1 | string2 | string3)

# (pound sign)

[ ] (square brackets)

Indention and braces ( { } )

; (semicolon)

Indicates a comment specified on the same line as the configuration statement to which it applies.

rsvp { # Required for dynamic MPLS only

Encloses a variable for which you can substitute one or more values.

Identifies a level in the configuration hierarchy.

Identifies a leaf statement at a configuration hierarchy level.

community name members [

community-ids ]

[edit] routing-options { static { route default { nexthop address; retain;

}

GUI Conventions

Bold text like this

> (bold right angle bracket)

Represents graphical user interface (GUI) items you click or select.

•

In the Logical Interfaces box, select

All Interfaces .

To cancel the configuration, click

Cancel

Separates levels in a hierarchy of menu selections.

In the configuration editor hierarchy, select Protocols>Ospf.

Documentation Feedback

We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods:

• Online feedback rating system—On any page of the Juniper Networks TechLibrary site at http://www.juniper.net/techpubs/index.html

, simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience.

Alternately, you can use the online feedback form at http://www.juniper.net/techpubs/feedback/ .

xiii

vSRX Guide for Contrail

•

E-mail—Send your comments to [email protected]. Include the document or topic name, URL or page number, and software version (if applicable).

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance

Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf

•

Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/ .

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day,

7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

•

Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: https://prsearch.juniper.net/

• Find product documentation: http://www.juniper.net/documentation/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: http://kb.juniper.net/InfoCenter/

•

Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

•

Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number Entitlement

(SNE) Tool: https://entitlementsearch.juniper.net/entitlementsearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

•

Use the Case Management tool in the CSC at http://www.juniper.net/cm/

•

Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

About the Documentation

For international or direct-dial options in countries without toll-free numbers, see http://www.juniper.net/support/requesting-support.html

CHAPTER 1

Overview and Requirements

•

Understanding vSRX with Contrail on page 17

•

System Requirements for vSRX on Contrail on page 20

•

Interface Naming and Mapping on page 24

•

vSRX Factory-Default Settings on page 25

Understanding vSRX with Contrail

vSRX is a virtual security appliance that provides security and networking services at the perimeter or edge in virtualized private or public cloud environments. vSRX runs as a virtual machine (VM) on a standard x86 server.

vSRX enables advanced security and routing at the network edge in a multitenant virtualized environment. vSRX is built on Junos OS and delivers networking and security features similar to those available on SRX Series Services Gateways for the branch.

•

vSRX Architecture on page 17

•

Juniper Networks Contrail on page 18

•

vSRX Scale Up Performance on page 19

•

vSRX Benefits and Use Cases on page 19

vSRX Architecture

Figure 1 on page 18

shows the high level architecture for vSRX.

vSRX Guide for Contrail

Figure 1: vSRX Architecture

Junos Control Plane

JCP / vRE

MGD

Management

Daemon

RPD

Routing Protocol

Daemon vSRX VM

Junos Kernel

QEMU/KVM

Advanced Services

Flow Processing

Packet Forwarding

(JEXEC)

Juniper Linux (Guest OS)

DPDK

Data Plane Development Kit

VMware

HYPERVISORS/CLOUD ENVIRONMENTS

Microsoft

Hyper-V

KVM

Kernel-based

Virtual

Machines

AWS

Amazon

Web

Services

Microsoft

Azure

Cloud

Deployment

Contrail Cloud

Deployment

Memory Storage

Physical x86 vSRX includes the Junos control plane (JCP) and the packet forwarding engine (PFE) components that make up the data plane. vSRX uses one virtual CPU (vCPU) for the

JCP and at least one vCPU for the PFE. Starting in Junos OS Release 15.1X49-D70 and

Junos OS Release 17.3R1, multi-core vSRX supports scaling vCPUs and GB virtual RAM

(vRAM). Additional vCPUs are applied to the data plane to increase performance.

Juniper Networks Contrail

Juniper Networks Contrail is an open, standards-based software solution that delivers network virtualization and service automation for federated cloud networks. It provides self-service provisioning, improves network troubleshooting and diagnostics, and enables service chaining for dynamic application environments across enterprise virtual private cloud (VPC), managed Infrastructure as a Service (IaaS), and Networks Functions

Virtualization (NFV) use cases.

You can use Contrail with open cloud orchestration systems such as OpenStack or

CloudStack to instantiate instances of vSRX in a virtual environment. Contrail with vSRX provides network services such as firewall, NAT, and load balancing to virtual networks.

NOTE: vSRX on a KVM hypervisor requires you to enable hardware-based virtualization on a host OS that contains an Intel Virtualization Technology

(VT) capable processor.

Chapter 1: Overview and Requirements

Documentation

• Contrail Overview

vSRX Scale Up Performance

Table 3 on page 19

shows the vSRX scale up performance based on the number of vCPUs and vRAM applied to a vSRX VM along with the Junos OS Release 15.1X49 for vSRX release in which a particular software specification was introduced.

Table 3: vSRX Scale Up Performance

vCPUs vRAM NICs Release Introduced

2 vCPUs 4 GB

5 vCPUs 8 GB

•

Virtio

SR-IOV (Intel X520/X540)

Junos OS Release 15.1X49-D20

Virtio Junos OS Release 15.1X49-D70 and Junos OS

Release 17.3R1

You can scale the performance and capacity of a vSRX instance by increasing the number of vCPUs or the amount of vRAM allocated to the vSRX. The multi-core vSRX automatically selects the appropriate vCPUs and vRAM values at boot time, as well as the number of Receive Side Scaling (RSS) queues in the NIC. If the vCPU or vRAM setting allocated to a vSRX VM does not match what is currently available, the vSRX scales down to the closest supported value for the instance. For example, if a vSRX VM has 3 vCPUs and 8 GB of vRAM, vSRX boots to the smaller vCPU size, which requires a minimum of 2 vCPUs. You can scale up a vSRX instance to a higher number of vCPUs or amount of vRAM, but you cannot scale down an existing vSRX instance to a smaller setting.

NOTE: The number of RSS queues typically matches with the number of data plane vCPUs of a vSRX instance. For example, a vSRX with 4 data plane vCPUs should have 4 RSS queues.

vSRX Benefits and Use Cases

vSRX on standard x86 servers enables you to quickly introduce new services, deliver customized services to customers, and scale security services based on dynamic needs.

vSRX is ideal for public, private, and hybrid cloud environments.

Some of the key benefits of vSRX in a virtualized private or public cloud multitenant environment include:

• Stateful firewall protection at the tenant edge

• Faster deployment of virtual firewalls into new sites

•

Full routing, VPN, core security, and networking capabilities

•

Application security features (including IPS and App-Secure)

vSRX Guide for Contrail

•

Content security features (including Anti Virus, Web Filtering, Anti Spam, and Content

Filtering)

• Centralized management with Junos Space Security Director and local management with J-Web Interface

•

Juniper Networks Sky Advanced Threat Prevention (Sky ATP) integration

System Requirements for vSRX on Contrail

•

Software Requirements on page 20

•

Hardware Recommendations on page 22

•

Best Practices Recommendations on page 22

Software Requirements

Table 4 on page 20

lists the system software requirement specifications for the vSRX environment along with the Junos OS release in which a particular software specification was introduced.

Table 4 on page 20

lists the recommended software versions for running vSRX on Juniper Networks Contrail.

To determine the Junos OS features supported on vSRX, use the Juniper Networks Feature

Explorer, a Web-based application that helps you to explore and compare Junos OS feature information to find the right software release and hardware platform for your network. Find Feature Explorer here:

Feature Explorer: vSRX

Table 4: Specifications for vSRX

Component Specification Release Introduced

Hypervisor support

Linux KVM Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

Memory 4 GB

8 GB

Disk space 16 GB IDE drive

Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

Junos OS Release 15.1X49-D70 and

Junos OS Release 17.3R1

Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

Chapter 1: Overview and Requirements

Table 4: Specifications for vSRX (continued)

Component Specification Release Introduced vCPUs 2 vCPUs

NOTE: The Contrail compute node must bare metal since vSRX as a VNF does not support nested virtualization.

Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

vNICs

5 vCPUs

NOTE: The Contrail compute node must bare metal since vSRX as a VNF does not support nested virtualization.

Junos OS Release 15.1X49-D70 and

Junos OS Release 17.3R1

Up to 8 Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

Virtual NIC types

•

Virtio

SR-IOV

NOTE: We recommend the Intel

X520/X540 physical NICs for SR-IOV support on vSRX. For SR-IOV limitations, see the Known Behavior section of the vSRX Release Notes.

Junos OS Release 15.1X49-D20 and

Junos OS Release 17.3R1

NOTE: For KVM, we recommend that you enable hardware-based virtualization on the host machine. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support

Contrail Recommendations for vSRX

Table 5 on page 21

lists the recommended software versions to run vSRX on Contrail.

Table 5: Contrail Recommendations

Software Version Release Introduced

Contrail 2.20

3.1

OpenStack Juno or Icehouse

Juno or Kilo

Junos OS Release 15.1X49-D20

Junos OS Release 15.1X49-D60

Junos OS Release 15.1X49-D20

Junos OS Release 15.1X49-D60

Host OS Ubuntu 14.04.2

Linux

Kernel

3.16

Junos OS Release 15.1X49-D20

vSRX Guide for Contrail

NOTE: We recommend that you enable hardware-based virtualization on the host machine. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support

. See

Contrail - Server

Requirements to review any additional requirements for Contrail.

Hardware Recommendations

Table 6 on page 22

lists the hardware specifications for the host machine that runs the vSRX VM.

Table 6: Hardware Specifications for the Host Machine

Component Specification

Host memory size

Host processor type

4 GB (minimum) .

x86_64 multicore CPU

NOTE: DPDK requires Intel Virtualization VT-x/VT-d support in the

CPU. See About Intel Virtualization Technology.

Virtual network adapter [Warning: element unresolved in stylesheets: <item> (in <entry>).

This is probably a new element that is not yet supported in the stylesheets.]

VMXNet3 device or VMWare Virtual NIC

NOTE: Virtual Machine Communication Interface (VMCI) communication channel is internal to the ESXi hypervisor and the vSRX VM.

Best Practices Recommendations

vSRX deployments can be complex, and there is a great deal of variability in the specifics of possible deployments. The following recommendations might apply to and improve performance and function in your particular circumstances.

NUMA Nodes

The x86 server architecture consists of multiple sockets and multiple cores within a socket. Each socket also has memory that is used to store packets during I/O transfers from the NIC to the host. To efficiently read packets from memory, guest applications and associated peripherals (such as the NIC) should reside within a single socket. A penalty is associated with spanning CPU sockets for memory accesses, which might result in nondeterministic performance. For vSRX, we recommend that all vCPUs for the vSRX VM are in the same physical non-uniform memory access (NUMA) node for optimal performance.

Chapter 1: Overview and Requirements host NUMA nodes. We recommend that you remove the hw:numa_nodes=2 line from OpenStack to ensure that the PFE functions properly.

PCI NIC-to-VM Mapping

If the node on which vSRX is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. On a Linux host OS, install the hwloc package and use the lstopo command to provide information about relative physical NIC locations. Move the vSRX VM to a slot on the server that is connected to the PCI NIC that vSRX VM uses.

On some servers where this information is not available or not supported, refer to the hardware documentation for the slot-to-NUMA node topology.

Mapping Virtual Interfaces to a vSRX VM

To determine which virtual interfaces on your Linux host OS map to a vSRX VM:

Use the virsh list command on your Linux host OS to list the running VMs.

hostOS# virsh list

Id Name State

----------------------------------------------------

9 centos1 running

15 centos2 running

16 centos3 running

48 vsrx running

50 1117-2 running

51 1117-3 running

Use the virsh domiflist vsrx-name command to list the virtual interfaces on that vSRX

VM.

hostOS# virsh domiflist vsrx

Interface Type Source Model MAC

------------------------------------------------------vnet1 bridge brem2 virtio 52:54:00:8f:75:a5 vnet2 bridge br1 virtio 52:54:00:12:37:62 vnet3 bridge brconnect virtio 52:54:00:b2:cd:f4

NOTE: The first virtual interface maps to the fxp0 interface in Junos OS.

Documentation

•

About Intel Virtualization Technology

•

DPDK Release Notes

•

Contrail - Server Requirements

vSRX Guide for Contrail

Interface Naming and Mapping

Each network adapter defined for a vSRX is mapped to a specific interface, depending on whether the vSRX instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX have changed since the previous

release (called Firefly Perimeter), as shown Table 7 on page 24

and

Table 8 on page 25 .

Note the following changes:

• In standalone mode:

• fxp0 is the out-of-band management interface.

• ge-0/0/0 is the first traffic (revenue) interface.

•

In cluster mode:

• fxp0 is the out-of-band management interface.

• em0 is the cluster control link for both nodes.

•

Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 7 on page 24

shows the interface names and mappings for a standalone vSRX VM.

Table 7: Interface Names for a Standalone vSRX VM

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX fxp0 ge-0/0/0 ge-0/0/1 ge-0/0/2

10 ge-0/0/3 ge-0/0/4 ge-0/0/5 ge-0/0/6 ge-0/0/7 ge-0/0/8

Table 8 on page 25

shows the interface names and mappings for a pair of vSRX VMs in a cluster (node 0 and node 1).

Chapter 1: Overview and Requirements

Table 8: Interface Names for a vSRX Cluster Pair

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX

5 fxp0 (node 0 and 1) em0 (node 0 and 1) ge-0/0/0 (node 0) ge-7/0/0 (node 1) ge-0/0/1 (node 0) ge-7/0/1 (node 1) ge-0/0/2 (node 0) ge-7/0/2 (node 1)

10 ge-0/0/3 (node 0) ge-7/0/3 (node 1) ge-0/0/4 (node 0) ge-7/0/4 (node 1) ge-0/0/5 (node 0) ge-7/0/5 (node 1) ge-0/0/6 (node 0) ge-7/0/6 (node 1) ge-0/0/7 (node 0) ge-7/0/7 (node 1)

vSRX Factory-Default Settings

vSRX requires the following basic configuration settings:

• Interfaces must be assigned IP addresses.

•

Interfaces must be bound to zones.

•

Policies must be configured between zones to permit or deny traffic.

Table 9 on page 25

lists the factory default settings for the vSRX security policies.

Table 9: Factory Default Settings for Security Policies

Source Zone Destination Zone Policy Action trust trust untrust untrust trust trust permit permit deny

vSRX Guide for Contrail

CHAPTER 2

Installation

•

Enabling Nested Virtualization on page 27

•

Creating an Image Flavor with OpenStack on page 28

•

Uploading the vSRX Image on page 31

•

Using Cloud-Init in an OpenStack Environment to Automate the Initialization of vSRX

Instances on page 35

Enabling Nested Virtualization

We recommend that you enable nested virtualization on your host OS or OpenStack compute node. Nested virtualization is enabled by default on Ubuntu but is disabled by default on CentOS.

Use the following command to determine if nested virtualization is enabled on your host

OS. The result should be Y.

hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y

NOTE: APIC virtualization (APICv) does not work well with nested VMs such as those used with KVM. On Intel CPUs that support APICv (typically v2 models, for example E5 v2 and E7 v2), you must disable APICv on the host server before deploying vSRX.

To enable nested virtualization on the host OS:

Depending on your host operating system, perform the following:

•

On CentOS, open the /etc/modprobe.d/dist.conf file in your default editor.

hostOS# vi /etc/modprobe.d/dist.conf

• On Ubuntu, open the /etc/modprobe.d/qemu-system-x86.conf file in your default editor.

hostOS# vi /etc/modprobe.d/qemu-system-x86.conf

vSRX Guide for Contrail

Add the following line to the file: hostOS# options kvm-intel nested=y enable_apicv=n

Save the file and reboot the host OS.

(Optional) After the reboot, verify that nested virtualization is enabled.

hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y

On Intel CPUs that support APICv ( for example, E5 v2 and E7 v2), disable APICv on the host OS.

root@host# sudo rmmod kvm-intel root@host# sudo sh -c “echo ’options kvm-intel enable_apicv=n’ >>

/etc/modprobe.d/dist.conf” root@host# sudo modprobe kvm-intel

Optionally, verify that APICv is now disabled.

root@host# cat /sys/module/kvm_intel/parameters/enable_apicv

Creating an Image Flavor with OpenStack

Before you begin, ensure that you have a working OpenStack installation. See the

OpenStack Installation Guide for more details.

OpenStack launches instances of images, based on the image installed and VM templates called flavors. Flavors set the memory, vCPU, and storage requirements for the vSRX image. You can use the Horizon GUI or the OpenStack nova commands to create flavors for the vSRX VMs. See

“System Requirements for vSRX on Contrail” on page 20

for the software requirement specifications for a vSRX VM.

CAUTION: The packet forwarding engine (PFE) on the vSRX might become unresponsive if the NUMA nodes topology properties in OpenStack includes the line hw:numa_nodes=2 to spread the instance’s vCPUs across multiple host NUMA nodes. We recommend that you remove the hw:numa_nodes=2 line from OpenStack to ensure that the PFE functions properly.

•

Creating an Image Flavor for vSRX with Horizon on page 29

•

Creating an Image Flavor for vSRX with the Nova CLI on page 31

Chapter 2: Installation

Creating an Image Flavor for vSRX with Horizon

OpenStack uses VM templates, or flavors, to set the memory, vCPU, and storage requirements for an image. OpenStack includes a default set of flavors, but we recommend that you create a flavor to match the vSRX image requirements.

To create an image flavor for vSRX with Horizon:

From the Horizon GUI, select your project, and select Admin>System Panel>Flavors.

The list of existing image flavors appears, as shown in

Figure 2 on page 29 .

Figure 2: OpenStack Flavors

Click Create Flavor. The Create Flavor dialog box appears, as shown in

Figure 3 on page 30

vSRX Guide for Contrail

Figure 3: Create a Flavor

Enter a name in the Name box for this vSRX flavor.

Enter the appropriate value in the vCPUs box for your configuration. The minimum required for vSRX is 2 vCPUs.

Enter the appropriate value in the RAM MB box. The minimum required for vSRX is

4096 MB.

Enter the appropriate value in the Root Disk GB box. The minimum required for vSRX is 16 GB.

Enter the appropriate values in the Emphemeral Disk GB and Swap Disk MB boxes.

The minimum required for vSRX is 0 for each.

Click Create Flavor. The flavor appears on the Flavors tab.

Chapter 2: Installation

Creating an Image Flavor for vSRX with the Nova CLI

To create an image flavor for vSRX with the nova CLI command:

Use the nova flavor-create command on the OpenStack compute node that will host the vSRX VM. See

Table 10 on page 31

for a list of mandatory parameters.

NOTE: See the official OpenStack documentation for a complete description of available options for the nova flavor-create command.

Table 10: nova flavor-create Command

Command Option Description

--is-public true

flavor_name

auto

ram_megabytes

Set the flavor as publicly available.

Name the vSRX flavor.

Select auto to automatically assign the flavor ID.

Allocate RAM for the VM, in megabytes.

disk_gigabytes vcpus

Specify disk storage size for the VM.

Allocate the number of vCPUs for the vSRX VM.

NOTE: Use nova help flavor-create for more details on the command options.

Optionally, use the nova flavor-list to verify the flavors.

The following example creates a vSRX flavor with 4096 MB RAM, 2 vCPUs, and disk storage up to 16 GB:

$ nova flavor-create --is-public true vsrx_flavor auto 4096 16 2

Documentation

• OpenStack Installation Guide

• OpenStack End User Guide

Uploading the vSRX Image

Contrail integrates with OpenStack for public, private, or hybrid cloud orchestration. You can install the vSRX image and use this installed image to provide security services in a service chain with Contrail.

vSRX Guide for Contrail

Before installing vSRX, ensure that you have installed either Contrail and, optionally,

OpenStack Glance.

• Contrail - Installation Overview

• OpenStack - Add the Image Service (glance)

You can upload the vSRX image with either Horizon, the OpenStack GUI dashboard, or

Glance, the OpenStack CLI-based image services project.

NOTE: To upgrade an existing vSRX instance, see Migration, Upgrade, and

Downgrade in the vSRX Release Notes.

•

Uploading the vSRX Image with OpenStack Horizon on page 32

Uploading the vSRX Image with the OpenStack Glance CLI on page 34

Uploading the vSRX Image with OpenStack Horizon

To upload a vSRX image with Horizon:

From the Horizon GUI, select your project, and select Compute>Images. The list of existing images appears, as shown in

Figure 4 on page 32

Figure 4: OpenStack Images

Click Create Image. The Create Image dialog box appears, as shown in

Figure 5 on page 33

Figure 5: Create an Image

Chapter 2: Installation

Enter a name for the vSRX image, and enter the image location.

Select QCOW2- QEMU Emulator from the Format list.

Enter the appropriate value in the Minimum Disk (GB) box for your configuration. The minimum required for vSRX is 16 GB.

Enter the appropriate value in the Minimum RAM (MB) box. The minimium required for vSRX is 4096 MB.

vSRX Guide for Contrail

Select Public.

Click Create Image. OpenStack uploads the image to the image service. The image appears on the Images tab.

NOTE: The default vSRX VM login ID is root with no password. By default, vSRX is assigned a DHCP-based IP address if a DHCP server is available on the network.

Uploading the vSRX Image with the OpenStack Glance CLI

To upload a vSRX image with the Glance CLI:

Use wget to download the vSRX image to the compute node.

Use glance image-create to add the image to the image service with a base configuration for disk, format, and memory requirements. Use glance help image-create for complete details on this command-line tool.

For example, the following command adds the vSRX QCOW2 image to the image service with 16 GB disk space and 4096 MB of RAM: glance image-create --name='vSRXimage' --is-public=true --container-format=bare

--disk-format=qcow2 --min-disk=16 --min-ram=4096

--file=media-srx-ffp-vsrx-vmdisk-15.1X49-D30.qcow2

NOTE: vSRX requires at least 16 GB of disk space and 4096 MB of RAM.

NOTE: The default vSRX VM login ID is root with no password. By default, vSRX is assigned a DHCP-based IP address if a DHCP server is available on the network.

Documentation

•

Contrail - Installation Overview

•

OpenStack Installation Guide for Ubuntu 14.04

•

OpenStack - Add the Image Service (glance)

•

OpenStack - Upload and Manage Images

•

OpenStack - Manage images (glance)

• Migration, Upgrade, and Downgrade

Chapter 2: Installation

Using Cloud-Init in an OpenStack Environment to Automate the Initialization of vSRX

Instances

Starting in Junos OS Release 15.1X49-D100 for vSRX, the cloud-init package (version

0.7x) comes pre-installed in the vSRX image to help simplify configuring new vSRX instances operating in an OpenStack environment according to a specified user-data file. Cloud-init is performed during the first-time boot of a vSRX instance.

Cloud-init is an OpenStack software package for automating the initialization of a cloud instance at boot-up. It is available in Ubuntu and most major Linux and FreeBSD operating systems. Cloud-init is designed to support multiple different cloud providers so that the same virtual machine (VM) image can be directly used in multiple hypervisors and cloud instances without any modification. Cloud-init support in a VM instance runs at boot time

(first-time boot) and initializes the VM instance according to the specified user-data file.

You use cloud-init with a validated Junos OS configuration file (juniper.conf) to automate the initialization of new vSRX instances. The default Junos OS configuration is replaced during the vSRX instance launch with a validated Junos OS configuration that you supply in the form of a user-data file.

A user-data file is a special key in the metadata service that contains a file that cloud-aware applications in the VM instance can access upon a first-time boot. In this case, it is the validated Junos OS configuration file that you intend to upload to a vSRX instance as the active configuration. This file uses the standard Junos OS command syntax to define configuration details, such as root password, management IP address, default gateway, and other configuration statements.

Before you begin:

• Create a configuration file with the Junos OS command syntax and save it. The configuration file can be plain text or MIME file type text/plain. The string #junos-config must be the first line of the user-data configuration file before the Junos OS configuration.

NOTE: The #junos-config string is mandatory in the user-data configuration file; if it is not included, the configuration will not be applied to the vSRX instance as the active configuration.

•

Determine the name for the vSRX instance you want to initialize with a validated Junos

OS configuration file.

• Determine the flavor for your vSRX instance, which defines the compute, memory, and storage capacity of the vSRX instance.

vSRX Guide for Contrail

Depending on your OpenStack environment, you can use either an OpenStack command-line interface (such as nova boot or openstack server create) or the OpenStack

Dashboard (“Horizon”) to launch and initialize a vSRX instance.

•

Performing Automatic Setup of a vSRX Instance Using an OpenStack Command-Line

Interface on page 36

•

Performing Automatic Setup of a vSRX Instance from the OpenStack Dashboard

(Horizon) on page 38

Performing Automatic Setup of a vSRX Instance Using an OpenStack Command-Line Interface

You can launch and manage a vSRX instance using either the nova boot or openstack server create commands, which includes the use of a validated Junos OS configuration user-data file from your local directory to initialize the active configuration of the target vSRX instance.

To initiate the automatic setup of a vSRX instance from an OpenStack command-line client:

If you have not done so already, create a configuration file with the Junos OS command syntax and save the file. The configuration file can be plain text or MIME file type text/plain.

The user-data configuration file must contain the full vSRX configuration that is to be used as the active configuration on each vSRX instance, and the string #junos-config must be the first line of the user-data configuration file before the Junos OS configuration.

NOTE: The #junos-config string is mandatory in the user-data configuration file; if it is not included, the configuration will not be applied to the vSRX instance as the active configuration.

Copy the Junos OS configuration file to an accessible location from where it can be retrieved to launch the vSRX instance.

Depending on your OpenStack environment, use the nova boot or openstack server create command to launch the vSRX instance with a validated Junos OS configuration file as the specified user-data.

NOTE: If you are supplying a Junos OS configuration file using Cloud Drive, the drive must be formatted in a vfat or ISO 9660 file system.

For example:

• nova boot --user-data <path_to>/juniper.conf --image vSRX_image --flavor vSRX_flavor_instance

Chapter 2: Installation

• openstack server create --user-data <path_to>/juniper.conf --image vSRX_image

--flavor vSRX_flavor_instance

Where:

--user-data <path_to>/juniper.conf

specifies the location of the Junos OS configuration file. The user-data file is limited to approximately 16,384 bytes.

--image vSRX_image identifies the name of a unique vSRX image.

--flavor vSRX_flavor_instance identifies the vSRX flavor (ID or name).

Boot or reboot the vSRX instance. During the initial boot-up sequence, the vSRX instance processes the cloud-init request.

NOTE: The boot time for the vSRX instance might increase with the use of the cloud-init package. This additional time in the initial boot sequence is due to the operations performed by the cloud-init package. During this operation, the cloud-init package halts the boot sequence and performs a lookup for the configuration data in each data source identified in the cloud.cfg. The time required to look up and populate the cloud data is directly proportional to the number of data sources defined. In the absence of a data source, the lookup process continues until it reaches a predefined timeout of 30 seconds for each data source.

When the initial boot-up sequence resumes, the user-data file replaces the original factory-default Junos OS configuration loaded on the vSRX instance. If the commit succeeds, the factory-default configuration will be permanently replaced. If the configuration is not supported or cannot be applied to the vSRX instance, the vSRX will boot using the default Junos OS configuration.

Performing Automatic Setup of a vSRX Instance from the OpenStack Dashboard (Horizon)

Horizon is the canonical implementation of the OpenStack Dashboard. It provides a

Web-based user interface to OpenStack services including Nova, Swift, Keystone, and so on. You can launch and manage a vSRX instance from the OpenStack Dashboard, which includes the use of a validated Junos OS configuration user-data file from your local directory to initialize the active configuration of the target vSRX instance.

To initiate the automatic setup of a vSRX instance from the OpenStack Dashboard:

If you have not done so already, create a configuration file with the Junos OS command syntax and save the file. The configuration file can be plain text or MIME file type text/plain.

NOTE: The #junos-config string is mandatory in the user-data configuration file; if it is not included, the configuration will not be applied to the vSRX instance as the active configuration.

Copy the Junos OS configuration file to an accessible location from where it can be retrieved to launch the vSRX instance.

Log in to the OpenStack Dashboard using your login credentials and then select the appropriate project from the drop-down menu at the top left.

On the Project tab, click the Compute tab and select Instances. The dashboard shows the various instances with its image name, its private and floating IP addresses, size, status, availability zone, task, power state, and so on.

Click Launch Instance. The Launch Instance dialog box appears.

From the Details tab (see

Figure 6 on page 39

), enter an instance name for the vSRX

VM along with the associated availability zone (for example, Nova) and then click

Next . We recommend that you keep this name the same as the hostname assigned to the vSRX VM.

Figure 6: Launch Instance Details Tab

Chapter 2: Installation

From the Source tab (see

Figure 7 on page 40 ), select a vSRX VM image source file

from the Available list and then click +(Plus). The selected vSRX image appears under

Allocated. Click Next.

vSRX Guide for Contrail

Figure 7: Launch Instance Source Tab

From the Flavor tab (see

Figure 8 on page 41

), select a vSRX instance with a specific compute, memory, and storage capacity from the Available list and then click +(plus sign) . The selected vSRX flavor appears under Allocated. Click Next.

Figure 8: Launch Instance Flavor Tab

Chapter 2: Installation

From the Networks tab (see

Figure 9 on page 42 ), select the specific network of the

vSRX instance from the Available list and then click +(plus sign). The selected network appears under Allocated. Click Next.

NOTE: Do not update any parameters in the Network Ports, Security

Groups, or Key Pair tabs in the Launch Instance dialog box.

vSRX Guide for Contrail

Figure 9: Launch Instance Networks Tab

10.

From the Configuration tab (see

Figure 10 on page 43

), click Browse and navigate to the location of the validated Junos OS configuration file from your local directory that you want to use as the user-data file. Click Next.

Figure 10: Launch Instance Configuration Tab

Chapter 2: Installation

11.

Confirm that the loaded Junos OS configuration contains the #junos-config string in the first line of the user-data configuration file (see

Figure 11 on page 44 ) and then

click Next.

NOTE: Do not update any parameters in the Metadata tab of the Launch

Instance dialog box.

vSRX Guide for Contrail

Figure 11: Launch Instance Configuration Tab with Loaded Junos OS

Configuration

12.

Click Launch Instance. During the initial boot-up sequence, the vSRX instance processes the cloud-init request.

13.

CHAPTER 3

vSRX Service Chains in Contrail

•

Overview of Service Chains with vSRX on page 47

•

Spawning vSRX in a Contrail Service Chain on page 49

Overview of Service Chains with vSRX

You can use Contrail to chain various Layer 2 through Layer 7 services such as firewall,

NAT, and IDP through one or more vSRX VMs. For example, you can insert a vSRX firewall

VM between two other virtual machines (VMs). By using vSRX and service chains, you can tailor the security needs to a targeted virtual network and VM set. This provides agility and scalability in line with the fluidity of cloud network environments.

•

Understanding Service Chains on page 47

•

Service Chain Modes on page 48

•

Components of a Service Chain on page 48

Understanding Service Chains

To create a service through vSRX, you instantiate one or more vSRX VMs to dynamically apply single or multiple services to network traffic.

Figure 12 on page 47

shows a basic service chain with a single vSRX VM. The vSRX service

VM spawns a service, such as a firewall. The left interface (left IF) points to the internal end customer, who uses the service; and the right interface (right IF) points to the external network or Internet. You can also instantiate multiple vSRX VMs to chain multiple services together. For example, you could add an IDP service after the firewall.

Figure 12: vSRX Service Chaining

vSRX Guide for Contrail

When you create a service chain, Contrail creates tunnels across the underlay network that span all services in the chain.

Service Chain Modes

You can configure the following service modes:

• Transparent or bridge mode—Used for services that do not modify the packet. Also known as bump-in-the-wire or Layer 2 mode. Examples include Layer 2 firewall and

IDP.

•

In-network or routed mode—Provides a gateway service that routes packets between the service instance interfaces. Examples include NAT, Layer 3 firewall, and load balancing.

•

In-network-nat mode—Similar to in-network mode; however, packets from the left

(private) network are not routed to the right (public) source network. In-network-nat mode is particularly useful for NAT services.

NOTE: Ensure that you define the service policy with the private network on the left and public on the right in order to get the public routes (usually the default) advertised into the left network.

Components of a Service Chain

Service chaining requires the following configuration components to build the chain:

• Service template

• Virtual networks

•

Service instance

•

Network policy

Service Templates

Service templates map out the basic configuration that Contrail uses to instantiate a service instance, or VM. Within Contrail, you configure service templates in the scope of a domain, and you can use the templates on all projects within a domain. You can use a template to launch multiple service instances of the same type in different projects within a domain. Within a service template, you select the service mode, a vSRX image name for the VM that will provide the service, and an ordered list of interfaces for the service.

vSRX service VMs require the management interface to be the first interface in that ordered list. You can use OpenStack Horizon or Glance to add the vSRX image. You also select the OpenStack flavor to associate with all service instances that use the service template. An OpenStack flavor defines the number of vCPUs, storage, and memory you can assign to a VM. OpenStack includes default flavors, and you can create new flavors in the OpenStack dashboard.

Chapter 3: vSRX Service Chains in Contrail

Virtual Networks

Virtual networks provide the link between the service instance and the network traffic in the virtualized environment. You can create the virtual networks in Contrail or OpenStack and use those networks to direct traffic to or through the service instance.

Service Instances

A service instance is the instantiation of the selected service template to create one or more VMs that provide the service (for example, a firewall). When you create a service instance, you select a service template that defines the instance. You also associate the interfaces in the service template with the virtual networks needed to direct traffic into and out of the service instance. If you enable service scaling in the selected service template, you can instantiate more than one VM when you create the service instance.

Network Policies

By default, all traffic in a virtual network remains isolated. You configure a network policy to allow traffic between virtual networks and through the service instance. The network policy filters traffic to and from the service VM based on the rules you configure. You select the service instance VM and the virtual networks for the right and left interfaces of that VM that the network policy applies to. As a final step. you associate the network policy with each virtual network the policy applies to.

Documentation

• Contrail - Service Chaining

Spawning vSRX in a Contrail Service Chain

Ensure that you have installed Contrail and have loaded the vSRX images with OpenStack

Horizon or Glance.

• Installation Overview (Contrail)

• Add the Image Service (glance)

You can use Contrail to chain various Layer 2 through Layer 7 services such as firewall,

NAT, and IDP through vSRX VMs.

•

Creating a Service Template on page 50

•

Creating Left and Right Virtual Networks on page 52

•

Creating a vSRX Service Instance on page 53

•

Creating a Network Policy on page 54

•

Adding a Network Policy to a Virtual Network on page 55

vSRX Guide for Contrail

Creating a Service Template

To create a service template:

From Contrail, select Configure>Services>Service Templates. The list of existing service templates appears, as shown in

Figure 13 on page 50

Figure 13: Contrail Service Templates

Click + to create a new service template. The Add Service Template dialog box appears, as shown in

Figure 14 on page 50 .

Figure 14: Contrail Add a Service Template

Chapter 3: vSRX Service Chains in Contrail

Add a name for the service template in the Name box.

Select the appropriate service mode and service type from the lists.

Select the vSRX image from the Image Name list. This is the image you installed previously in the OpenStack image service.

Click + to add three interfaces.

Select Management for the first interface type, Left for the second interface type, and

Right for the third interface type. You associate the left and right interfaces with the left and right virtual networks when you create the service instance. Any additional interfaces must be of type Other.

Expand Advanced Options and select an instance flavor from the Instance Flavor list, as shown in

Figure 15 on page 51 . You can use an appropriate default flavor from

OpenStack or a custom flavor you created previously for vSRX.

Figure 15: Advanced Options - Add Service Template

vSRX Guide for Contrail

Optionally, check Scaling to create multiple identical vSRX instances from this service template for load balancing.

10.

Click Save to create this new service template.

See Contrail - Creating an In-Network or In-Network-NAT Service Chain for more details.

Creating Left and Right Virtual Networks

Ensure that you have IP Address Management (IPAM) set up for your project.

To create a virtual network:

From Contrail, select Configure>Networking>Networks. The list of existing networks appears.

Verify that your project is displayed as active in the upper right Project list, and click

+ to create a new virtual network. The Create Network dialog box appears, as shown in

Figure 16 on page 52

Figure 16: Creating a Virtual Network in Contrail

Enter a name for the left virtual network.

Do not select a network policy yet. You create the network policy after you create the service instance and then you update this virtual network to add the policy.

Expand Subnet and click + to add IPAM to this virtual network.

Select the appropriate IPAM from the list.

Set the CIDR and Gateway fields.

Chapter 3: vSRX Service Chains in Contrail

Expand Advanced Options and select appropriate options for your network.

Click Save. The new virtual network appears in the list of configured networks.

Repeat this procedure for the right virtual network.

See

Contrail - Creating a Virtual Network for more details

Creating a vSRX Service Instance

To create a vSRX service instance:

Select Configure>Services>Service Instances. The list of existing service instances appears.

Click + to create a new service instance. The Create Service Instance dialog box appears.

Enter a name for the service instance.

NOTE: Do not use white space in the service instance name.

Select the service template you created for vSRX from the Services Template list.

This service template includes the vSRX image used to provide the service.

Select Management from the Interface 1 list. Management must be the first interface for vSRX service instances.

Select Left from the Interface 2 list, and Right from the Interface 3 list.

Select Auto Configured for the Management interface.

Select the left virtual network for the left interface, and the right virtual network for the right interface.

Click Save to save this service instance. Contrail launches the vSRX VM for this service instance.

10.

Optionally, select Configure>Services>Service Instances to view this new vSRX instance status. You can expand the row for this instance in the table and click View Console to access the vSRX console port.

vSRX Guide for Contrail

NOTE: You can also view this service instance from the OpenStack Instances table, but you should only use Contrail to delete service instances.

See

Contrail - Creating an In-Network or In-Network-NAT Service Chain for more details.

Creating a Network Policy

To create a network policy:

Select Configure>Networking>Policies. The table of policies appears.

Click + to create a new policy. The Create Policy dialog box appears, as shown in

Figure 17 on page 54 .

Figure 17: Creating a Network Policy in Contrail

Name the policy.

Click + to create a new rule for this policy.

Select the left virtual network you created from the Source list and select the right virtual network from the Destination list.

Select the appropriate protocol from the Protocol list and select the source and destination ports for this policy.

Select Services and select the vSRX instance you want to apply this policy to.

Optionally, add more policy rules to this policy.

Click Save to create this policy.

See

Contrail - Creating a Network Policy for more details.

Chapter 3: vSRX Service Chains in Contrail

Adding a Network Policy to a Virtual Network

To add a network policy to a virtual network:

Select Configure>Networking, and select the settings icon to the right of the virtual network you want to add a network policy to, as shown in

Figure 18 on page 55 .

Figure 18: Contrail Virtual Networks

Click Edit. The Edit Networks dialog box appears, as shown in

Figure 19 on page 55 .

Figure 19: Adding a Network Policy to a Virtual Network in Contrail

Select the appropriate policy from the Networks Policy(s) list.

Click Save to save this change.

Repeat this procedure for the other virtual network in this service chain.

See Contrail - Associating a Network to a Policy for more details.

Documentation

• Contrail - Creating an In-Network or In-Network-NAT Service Chain

• Contrail - Installation Overview

vSRX Guide for Contrail

CHAPTER 4

vSRX VM Management

•

Connecting to the vSRX Management Console on page 57

•

Managing the vSRX VM on page 58

•

Upgrading Multicore vSRX with Contrail on page 59

•

Monitoring vSRX with Contrail on page 63

Connecting to the vSRX Management Console

Ensure that you have launched the vSRX VM with Contrail.

You can connect to the vSRX console through OpenStack or Contrail.

•

Connecting to the vSRX Management Console with Horizon on page 57

•

Connecting to the vSRX Management Console with Contrail on page 57

Connecting to the vSRX Management Console with Horizon

To connect to the vSRX console with OpenStack Horizon:

From the Horizon GUI, select your project, and select Compute>Instances. The list of existing instances appears.

From the Actions column, select Console from the More list. The vSRX console appears, and you can log in to the management port for the vSRX instance.

Connecting to the vSRX Management Console with Contrail

To connect to the vSRX console of a vSRX VM with Contrail:

From the Contrail GUI, select your project, and select Configure>Services>Service

Instances

. The list of existing service instances appears.

Click on the left arrow next to the vSRX VM to expand to the Service Instance Details view.

Click the View Console link on the right. The vSRX console appears, and you can log in to the management port for the vSRX.

vSRX Guide for Contrail

Documentation

• OpenStack End User Guide

• Contrail - Creating an In-Network or In-Network-NAT Service Chain

Managing the vSRX VM

Each vSRX instance is an independent virtual machine (VM) that you can power on, pause, or shut down.

•

Powering On the VM from OpenStack on page 58

•

Pausing the VM on page 58

•

Restarting the VM on page 58

•

Powering Off the VM from OpenStack on page 59

•

Deleting the vSRX VM from Contrail on page 59

Powering On the VM from OpenStack

To power on the VM:

From the OpenStack dashboard for your project, select Compute>Instances. The list of existing instances appears.

Check the VM you want to power on.

From the Actions column, select Start Instance from the list.

Pausing the VM

To pause the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM that you want to pause.

From the Actions column, select Pause Instance from the list.

Restarting the VM

To restart the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM that you want to reboot.

Select Soft Reboot Instance from the More list to restart the VM.

Chapter 4: vSRX VM Management

Powering Off the VM from OpenStack

To power off the VM:

From the OpenStack dashboard for your project, select Compute>Instances. The list of existing instances appears.

Check the VM you want to power off.

From the Actions column, select Console from the list. The console opens.

From the console, power off the VM.

user@host>request system power-off

Deleting the vSRX VM from Contrail

BEST PRACTICE: We recommend that you use Contrail to delete any VMs used in service chains created by Contrail.

To delete the VM from Contrail:

From the Contrail GUI for your project, select Configure>Services>Service Instances.

The list of existing service instances appears.

Select the VM that you want to delete.

Click trash icon on the upper right menu to delete the selected VMs.

Upgrading Multicore vSRX with Contrail

Starting in Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1, you can scale up the number of vCPUs or vRAM for a vSRX VM. You must gracefully power off the vSRX

VM before you can scale up vSRX. See

“Powering Off the VM from OpenStack” on page 59

for details.

You can modify an existing flavor with the OpenStack Dashboard (Horizon). You cannot use the OpenStack CLI (nova flavor) commands to modify the CPU or RAM settings on an existing flavor. Instead, create a new flavor and modify the vSRX service template in

vSRX Guide for Contrail

Contrail to use this new flavor. See the

“Creating an Image Flavor for vSRX with the Nova

CLI” on page 31

for details.

NOTE: You cannot scale down the number of vCPUs or vRAM for an existing vSRX VM.

•

Configuring Multi-queue Virtio Interface for vSRX VM with OpenStack on page 61

•

Modifying an Image Flavor for vSRX with the Dashboard on page 61

•

Updating a Service Template on page 62

Chapter 4: vSRX VM Management

Configuring Multi-queue Virtio Interface for vSRX VM with OpenStack

Before you plan to scale up vSRX performance, enable network multi-queuing as a means to support an increased number of dataplane vCPUs for the vSRX VM. The default for vSRX in Contrail is 2 dataplane vCPUs, but you can scale that number to 4 vCPUs.

OpenStack Liberty supports the ability to create VMs with multiple queues on their virtio interfaces. Virtio is a Linux platform for I/O virtualization, providing a common set of I/O virtualization drivers. Multiqueue virtio is an approach that enables the processing of packet sending and receiving to be scaled to the number of available virtual CPUs (vCPUs) of a guest, through the use of multiple queues

To use multiqueue virtio interfaces, ensure your system meets the following requirements:

•

The OpenStack version must be Liberty or greater.

•

The maximum number of queues in the vSRX VM interface is set to the same value as the number of vCPUs in the guest.

• The vSRX VM image metadata property is set to enable multiple queues inside the

VM.

Use the following command on the OpenStack node to enable multiple queues on a vSRX VM in Contrail: source /etc/contrail/openstackrc nova image-meta <image_name> set hw_vif_multiqueue_enabled="true"

After the vSRX VM is spawned, use the following command on the virtio interface in the guest to enable multiple queues inside the vSRX VM: ethtool –L <interface_name> combined <#queues>

Modifying an Image Flavor for vSRX with the Dashboard

OpenStack uses VM templates, or flavors, to set the memory, vCPU, and storage requirements for an image.

To Modify an image flavor for vSRX with the OpenStack dashboard:

vSRX Guide for Contrail

From the dashboard select your project, and select Admin>System Panel>Flavors.

The list of existing image flavors appears, as shown in

Figure 2 on page 29 .

Figure 20: OpenStack Flavors

Select the vSRX flavor and click Edit Flavor. The Edit Flavor dialog box appears.

Increase the number of vCPUs for your configuration. The minimum required for vSRX is 2 vCPUs.

Increase the RAM MB value. The minimum required for vSRX is 4096 MB.

Click Create Flavor. The flavor appears on the Flavors tab.

Updating a Service Template

If you created a new image flavor for an existing vSRx instance, you need to update the service template to use this new image flavor before you relaunch the vSRX instance.

To update a service template:

From Contrail, select Configure>Services>Service Templates. The list of existing service templates appears.

Click on the vSRX service template and select edit.

Expand Advanced Options and select the new instance flavor from the Instance Flavor list.

Click Save to update this service template.

Power on the vSRX VM. See

“Powering On the VM from OpenStack” on page 58

for details.

Chapter 4: vSRX VM Management

Release History Table

Release

15.1X49-D70

Description

Starting in Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1, you can scale up the number of vCPUs or vRAM for a vSRX VM.

Documentation

•

OpenStack Installation Guide

•

OpenStack End User Guide

Monitoring vSRX with Contrail

To monitor basic statistics on the vSRX VM with Contrail:

On Contrail, select Monitor>Networking>Instances. The list of existing VMs appears.

Expand the row for the VM that you want to monitor. The CPU and memory statistics appear.

On Contrail, select Monitor>Networking>Networks. The list of existing virtual networks appears.

Expand the row for the virtual network that you want to monitor and select Traffic

Statistics . The traffic and throughput statistics appear.

Documentation

• Contrail - Monitor Networking

vSRX Guide for Contrail

CHAPTER 5

vSRX Configuration

•

vSRX Configuration and Management Tools on page 65

•

Configuring vSRX Using the CLI on page 66

•

Configuring vSRX Using the J-Web Interface on page 67

vSRX Configuration and Management Tools

•

Understanding the Junos OS CLI and Junos Scripts on page 65

•

Understanding the J-Web Interface on page 65

•

Understanding Junos Space Security Director on page 65

Understanding the Junos OS CLI and Junos Scripts

The Junos operating system command-line interface (Junos OS CLI) is a Juniper Networks specific command shell that runs on top of a UNIX-based operating system kernel.

Built into Junos OS, Junos script automation is an onboard toolset available on all Junos

OS platforms, including routers, switches, and security instances.

You can use Junos OS CLI and the Junos OS scripts to configure, manage, administer, and troubleshoot vSRX.

Understanding the J-Web Interface

The J-Web interface allows you to monitor, configure, troubleshoot, and manage instances by means of a Web browser. J-Web provides access to all the configuration statements supported by the instance.

You can use J-Web to configure, manage, administer, and troubleshoot vSRX.

Understanding Junos Space Security Director

Managing enterprise security policy has become extremely complex. The growth in network traffic, including mobile traffic and BYOD, and the emergence of cloud services have combined into a new array of opportunities for malicious hackers.

Security management can become error-prone and time-consuming if management solutions are slow, difficult to use, or restricted in their granularity of control. Resulting

vSRX Guide for Contrail misconfigurations can make the enterprise vulnerable to threats and noncompliant with regulations and policies.

As one of the Junos Space Network Management Platform applications, Junos Space

Security Director helps organizations improve the reach, ease, and accuracy of security policy administration with a scalable, GUI-based management tool. Security Director automates security provisioning through one centralized Web-based interface to help administrators manage all phases of security policy life cycle more quickly and intuitively, from policy creation to remediation.

Documentation

• CLI User Interface Overview

• J-Web Overview

• Mastering Junos Automation Programming

• Spotlight Secure Threat Intelligence

Configuring vSRX Using the CLI

To configure the vSRX instance using the CLI:

Verify that the vSRX is powered on.

Start the CLI.

root#cli root@>

Enter configuration mode.

configure

[edit] root@#

Set the root authentication password by entering a cleartext password, an encrypted password, or an SSH public key string (DSA or RSA).

[edit] root@# set system root-authentication plain-text-password

New password: password

Retype new password: password

Configure the hostname.

[edit] root@# set system host-name host-name

Configure the management interface.

Chapter 5: vSRX Configuration

[edit] root@# set interfaces fxp0 unit 0 family inet dhcp-client

Configure the traffic interfaces.

[edit] root@# set interfaces ge-0/0/0 unit 0 family inet dhcp-client

Configure basic security zones and bind them to traffic interfaces.

[edit] root@# set security zones security-zone trust interfaces ge-0/0/0.0

10.

Verify the configuration.

[edit] root@# commit check configuration check succeeds

11.

Commit the configuration to activate it on the vSRX instance.

[edit] root@# commit commit complete

12.

Optionally, use the show command to display the configuration to verify that it is correct.

Documentation

• CLI User Guide

Configuring vSRX Using the J-Web Interface

•

Accessing the J-Web Interface and Configuring vSRX on page 67

•

Applying the Configuration on page 70

Accessing the J-Web Interface and Configuring vSRX

Use the Junos OS CLI to configure, at a minimum, the following parameters before you can access a vSRX VM using J-Web:

•

Configure an IP address on fxp0.

• Configure a default route if the fxp0 IP address is on a different subnet than the host server.

•

Enable Web management through the fxp0 interface.

system { services { web-management { http { interface fxp0.0;

vSRX Guide for Contrail

}

To configure vSRX using the J-Web Interface:

Launch a Web browser from the management instance.

Enter the vSRX fxp0 interface IP address in the Address box.

Specify the username and password.

Click Log In, and select the Configuration Wizards tab from the left navigation panel.

The J-Web Setup wizard page opens.

Click Setup.

You can use the Setup wizard to configure the vSRX VM or edit an existing configuration.

• Select Edit Existing Configuration if you have already configured the wizard using the factory mode.

• Select Create New Configuration to configure the vSRX VM using the wizard.

The following configuration options are available in the guided setup:

• Basic

Chapter 5: vSRX Configuration

Select basic to configure the vSRX VM name and user account information as shown in

Table 11 on page 69

•

Instance name and user account information

Table 11: Instance Name and User Account Information

Field Description

Instance name

Root password

Verify password

Type the name of the instance. For example: vSRX .

Create a default root user password.

Verify the default root user password.

Operator Add an optional administrative account in addition to the root account.

User role options include:

•

Super User : This user has full system administration rights and can add, modify, and delete settings and users.

Operator

: This user can perform system operations such as a system reset but cannot change the configuration or add or modify users.

Read only : This user can only access the system and view the configuration.

Disabled

: This user cannot access the system.

•

Select either Time Server or Manual.

Table 12 on page 69

lists the system time options.

Table 12: System Time Options

Field Description

Time Server

Host Name Type the hostname of the time server. For example: ntp.example.com

IP Type the IP address of the time server in the IP address entry field. For example: 192.0.2.254

NOTE: You can enter either the hostname or the IP address.

Manual

Date

Time

Time Zone (mandatory)

Time Zone

Click the current date in the calendar.

Set the hour, minute, and seconds. Choose AM or PM .

Select the time zone from the list. For example: GMT Greenwich

Mean Time GMT.

vSRX Guide for Contrail

•

Expert

Select Expert to configure the basic options as well as the following advanced options:

• Four or more internal zones

•

Internal zone services

•

Application of security policies between internal zones

Click the Need Help icon for detailed configuration information.

You see a success message after the basic configuration is complete.

Applying the Configuration

To apply the configuration settings for vSRX:

Review and ensure that the configuration settings are correct, and click Next. The

Commit Configuration page appears.

Click Apply Settings to apply the configuration changes to vSRX.

Check the connectivity to vSRX, as you might lose connectivity if you have changed the management zone IP. Click the URL for reconnection instructions on how to reconnect to the instance.

Click Done to complete the setup.

After successful completion of the setup, you are redirected to the J-Web interface.

CAUTION: After you complete the initial setup, you can relaunch the J-Web

Setup wizard by clicking Configuration>Setup. You can either edit an existing configuration or create a new configuration. If you create a new configuration, the current configuration in vSRX will be deleted.

CHAPTER 6

vSRX Licensing

•

vSRX Feature Licenses Overview on page 71

•

Managing Licenses for vSRX on page 79

•

vSRX License Model Numbers on page 85

vSRX Feature Licenses Overview

Some Junos OS software features require a license to activate the feature.

To enable a licensed feature, you need to purchase, install, manage, and verify a license key that corresponds to each licensed feature. To conform to software feature licensing requirements, you must purchase one license per feature per instance. The presence of the appropriate software unlocking key on your virtual instance allows you to configure and use the licensed feature.

NOTE: If applicable for your vSRX deployment, vSRX pay-as-you-go images do not require any separate licenses. For a vSRX on Microsft Azure deployment, only the build-your-own-license (BYOL) model is supported.

•

vSRX License Procurement and Renewal on page 71

•

vSRX Evaluation License on page 72

•

License Types on page 74

•

Throughput on page 75

•

License Duration on page 75

•

Individual (á la carte) Feature Licenses on page 76

•

Bundled Licenses on page 76

•

Stacking Licenses on page 76

•

vSRX License Keys Components on page 76

•

License Management Fields Summary on page 77

vSRX License Procurement and Renewal

Licenses are usually ordered when the software application is purchased, and this information is bound to a customer ID. If you did not order the licenses when you purchased

vSRX Guide for Contrail your software application, contact your account team or Juniper Networks Customer

Care for assistance.

Licenses can be procured from the

Juniper Networks License Management System (LMS)

For license renewal, use the show system license command to find the Juniper vSRX software serial number that you use to renew a license.

vsrx> show system license

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

Virtual Appliance 1 1 0 58 days

Licenses installed:

License identifier: E420588955

License version: 4

Software Serial Number: 20150625

Customer ID: vSRX-JuniperEval

Features:

Virtual Appliance - Virtual Appliance

count-down, Original validity: 60 days

License identifier: JUNOS657051

License version: 4

Software Serial Number: 9XXXXAXXXXXXX9

Customer ID: MyCompany

Features:

Virtual Appliance - Virtual Appliance

permanent

NOTE: Do not use the show chassis hardware command to get the serial number on vSRX, because that command is only appropriate for the physical

SRX Series devices. Also, the license for advanced security features available on the physical SRX Series devices cannot be used with vSRX deployments.

NOTE: If you are performing a software downgrade with licenses installed, you will see an error message in the CLI when you try to configure the licensed features or run the show system license status command.

We recommend deleting existing licenses before performing a software downgrade.

vSRX Evaluation License

To speed deployment of licensed features, the vSRX software image provides you with a 60-day product evaluation license and a 30-day advanced security features license, both of which allow you to use vSRX and licensed features for a specified period without having to install a license key.

Table 13 on page 73

lists vSRX evaluation license types.

Chapter 6: vSRX Licensing

Table 13: vSRX Evaluation License Type

License Package

Trial license

(temporary for evaluation only)

Type Period

Product evaluation–Basic 60 days

Product evaluation–Advanced features

30 days

License Model

Number

Product Evaluation License

The vSRX software image includes a 60-day trial license. When you download and install the vSRX image, you are entitled to use this trial license for 60 days. It is intended as an evaluation license for using vSRX. This product-unlocking license is required to use the basic functions of the vSRX, such as networking, routing, and basic security features

(such as stateful firewall).

NOTE: The use of the 60-day trial license does not include vSRX support unless you already have a pre-existing vSRX support contract. If you require support during this 60-day evaluation period, please work with your Juniper

Account team or go to the J-Net Community forum ( http://forums.juniper.net/ ) and view the Support topics under the vSRX category.

Within 30 days of the license expiration date, a license expiration warning appears each time you log in to the vSRX instance. After the product evaluation license expires, you will not be able to use the vSRX; it will be disabled and flow configuration options will not work (the vSRX will stop forwarding traffic). At this point, only management interfaces and CLI configurations are preserved.

Advanced Security Features Evaluation License

The advanced security features license is a 30-day trial license for vSRX that is required for advanced security features such as UTM, IDP, and AppSecure. You can download the trial license for advanced security features from the vSRX Free Trial License Page .

The 30-day trial license period begins on the day you enable the enhanced security features after you install the 60-day product evaluation license for vSRX. To continue using vSRX features after the 30-day license period expires, you must purchase and install the license; otherwise, the features are disabled. If the license for advanced security features expires while the evaluation license (product unlocking license) is still valid, only the advanced security features that require a license are disabled.

vSRX Guide for Contrail

License Types

NOTE: The UTM advanced features have a slightly different trial license strategy. UTM does not requires 30-day trial license but only a 30-day grace period. Once the 30-day advanced security features trial license expires,

Juniper Networks supports a 30-day grace period for you to continue using

UTM features. The 30-day grace period goes into effect after the 30-trial license expires.

There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention

(ATP). This is a second license that you can apply for a 30-day period in addition to the advanced security features license for vSRX to enable the Sky ATP features. You can download the Sky ATP trial license from the vSRX Free Trial License Page .

Juniper Networks provides a variety of licenses for both basic firewall features and advanced security features for different throughputs and durations.

If you want to use vSRX to provide basic firewall features, you can use standard (basic) licenses. However, to use some of the more advanced security features, such as

AppSecure, IDP, and UTM, you might need to purchase advanced features licenses.

The high-level categories for licenses are:

• Throughput–All licenses have an associated throughput. Throughput rates include 1

Gbps, 2 Gbps, and 4 Gbps on most platforms.

•

Features–Licenses are available for different combinations of feature sets, from standard (STD) through Content Security Bundle (CS-B).

• Individual or bundled–Licenses can be individual (á la carte) licenses for a set of features, or can be bundled together to provide a broad range of features in one easy license to maintain.

• Duration–All licenses have an associated time duration. You can purchase basic licenses as perpetual (never expire) or subscription based (1-year or 3-year duration). All vSRX licenses are subscription based.

•

New or renewal–All subscription licenses are either new (first-time purchase) or renewals (extending the license duration when the initial new subscription license is about to expire).

Figure 21 on page 75

shows a sample license SKU and identifies how each field maps to these categories.

Chapter 6: vSRX Licensing

Throughput

License Duration

Figure 21: Sample vSRX License SKU

Throughput

Bundled or individual

VSRX-10M-ASECB-3-R

Product Duration Feature set

New or renewal

These categories of licenses can also be combined, or stacked, to provide more flexibility for your vSRX use cases.

Bandwidth or throughput license types allow you to use a single instance of the software for up to the maximum throughput specified in the license entitlement. Throughput can be combined on a single instance of the software so that the maximum throughput for that instance is the aggregate of all the throughput licenses assigned to that instance.

A throughput license cannot be split across multiple instances. Throughput is identified in the license entitlement in megabits per second (Mbps), or gigabits per second (Gbps).

For example, if you want 3 Gbps of throughput for a vSRX instance using the STD features, you would purchase a 1G STD license and a 2G STD license and install both on the vSRX.

If you wanted 2 Gbps of throughput on two vSRX instances acting as a chassis cluster, you could not use the same 2 Gbps license on both vSRX instances. You would need to purchase one set of licenses for each vSRX instance in the cluster.

All licenses can be perpetual or subscription based.

•

Perpetual license–A perpetual license allows you to use the licensed software indefinitely. Perpetual licenses do not require renewals. Perpetual licenses do not include maintenance and upgrade support. You must purchase that separately, vSRX software releases such as vSRX for Azure or vSRX for AWS do not support perpetual licenses.

•

Subscription license–A subscription license is an annual license that allows you to use the licensed software feature for the matching duration. Subscriptions might involve periodic downloads of content (such as for IDP threat signature files). Subscription licenses start when you retrieve the license key or 30 days after purchase if you have not retrieved the license key. At the end of the license period, you need to renew the license to continue using it.

NOTE: All subscription licenses are renewable. To renew a subscription license, purchase a new subscription of the same license. For more information, see Subscription - Register and Install .

vSRX Guide for Contrail

Individual (á la carte) Feature Licenses

Every vSRX instance requires at least one standard license to support the desired throughput rate. Beyond that, you can select from a range of individual feature licenses that provide additional security feature sets. The feature license must match the standard license rate.

NOTE: AWS and Microsoft Azure do not support individual licenses.

For example, if you need AppSecure and Sophos antivirus features at 1 Gbps of throughput for a year, you could purchase the following individual licenses:

•

VSRX-STD-1G-1—Provides the standard feature set and 1 Gbps of throughput.

• VSRX-CS-1G-1—Provides the advanced features.

Bundled Licenses

Bundled licenses simplify the license management by combining one or more individual licenses into a single bundled license. Instead of installing and managing a standard throughput license and one or more individual advanced feature licenses, you can purchase one of the bundle license options and manage one license instead.

For example, if you need AppSecure and Sophos antivirus features at 1 Gbps of throughput for a year, you could purchase the single bundled VSRX-CS-B-1G-1 license, which includes the STD throughput license. This means you only need to manage one license instead of two individual licenses.

Stacking Licenses

You can combine individual or bundled licenses to combine features or build up the overall supplied throughput for the vSRX instance.

For example, you can combine a 1-Gbps license and a 2-Gbps license to have 3 Gbps of throughput for the vSRX instance. You can also combine individual licenses, such as

Sophos antivirus (SAV) and Websense Enhanced Web Filtering (EWF) to get both sets of security features.

NOTE: Individual licenses require a STD license with the same throughput rate.

vSRX License Keys Components

A license key consists of two parts:

•

License ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, it is given a license ID.

• License data—Block of binary data that defines and stores all license key objects.

Chapter 6: vSRX Licensing

For example, in the following typical license key, the string E413XXXX57 is the license ID, and the trailing block of data is the license data:

E413XXXX57 aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa

aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff

The license data conveys the customer ID and the software serial number (Juniper

Networks support reference number) to the vSRX instance.

License Management Fields Summary

The Licenses window displays a summary of licensed features that are configured on the vSRX instance and a list of licenses that are installed on the vSRX instance.

To view the license details, select Maintain>Licenses in the J-Web user interface. The

Licenses window appears as shown in

Figure 22 on page 77 .

Figure 22: J-Web Licenses Window Showing Installed Licenses

You can also view the details of a license in the CLI using the show system license command. The following sample shows details of an evaluation license in the CLI:

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

anti_spam_key_sbl 0 1 0 2016-04-15

08:00:00 CST

idp-sig 0 1 0 2016-04-15

08:00:00 CST

appid-sig 0 1 0 2016-04-15

08:00:00 CST

av_key_sophos_engine 0 3 0 2016-07-29

vSRX Guide for Contrail

08:00:00 CST

wf_key_websense_ewf 0 1 0 2016-04-15

08:00:00 CST

Virtual Appliance 1 1 0 2016-04-25

08:00:00 CST

Licenses installed:

License identifier: E420588955

License version: 4

Software Serial Number: 20150625

Customer ID: vSRX-JuniperEval

Features:

Virtual Appliance - Virtual Appliance

count-down, Original validity: 60 days

The information on the license management page is summarized in

Table 14 on page 78 .

Table 14: Summary of License Management Fields

Field Name Definition

Feature Summary

Feature

Licenses Used

Licenses Installed

Licenses Needed

Licenses expires on

Name of the licensed feature:

•

Features —Software feature licenses.

All features

—All-inclusive licenses.

Number of licenses currently being used on the vSRX instance. Usage is determined by the configuration. If a feature license exists and that feature is configured, the license is considered used.

Number of licenses installed on the vSRX instance for the particular feature.

Number of licenses required for legal use of the feature. Usage is determined by the configuration on the vSRX instance: If a feature is configured and the license for that feature is not installed, a license is needed.

Date the license expires.

Installed Licenses

State

Version

Group

Unique alphanumeric ID of the license.

Valid

—The installed license key is valid.

Invalid —The installed license key is not valid.

Numeric version number of the license key.

If the license defines a group license, this field displays the group definition.

NOTE: Because group licenses are currently unsupported, this field is always blank.

Chapter 6: vSRX Licensing

Table 14: Summary of License Management Fields (continued)

Field Name Definition

Enabled Features

Expiration

Name of the feature that is enabled with the particular license.

Date the license expires.

Software serial number The serial number is a unique 14-digit number that Juniper Networks uses to identify your particular software installation. You can find the software serial number in the Software Serial Number Certificate attached to the e-mail that was sent when you ordered your Juniper

Networks software or license. You can also use the show system license command to find the software serial number.

Customer ID ID that identifies the registered user.

Managing Licenses for vSRX

Before you begin, ensure that you have retrieved the license key from the Juniper License

Management System (LMS).

This section includes the following topics:

•

vSRX Evaluation License Installation Process on page 79

•

Adding a New License Key with J-Web on page 80

•

Adding a New License Key from the CLI on page 81

•

Updating vSRX Licenses on page 82

•

Deleting a License with J-Web on page 83

•

Deleting a License with the CLI on page 84

•

License Warning Messages on page 84

vSRX Evaluation License Installation Process

Juniper Networks provides a 60-day evaluation license for vSRX standard features. When you download and install the vSRX image, you are entitled to use this evaluation license for 60 days as a trial. In addition to the 60-day vSRX evaluation license, there is a 30-day advanced security features trial license for vSRX that is required for advanced security features such as UTM, IDP, and AppSecure.

You can download the 30-day advanced security feature trial license from the vSRX Free

Trial License Page .

There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention

vSRX Guide for Contrail

Installation of the advanced security feature trial license is similar to the regular license installation performed from the CLI (see

“Adding a New License Key from the CLI” on page 81

NOTE: The 30-day evaluation license period begins on the day you enable enhanced security features after installing evaluation licenses.

To continue using vSRX features after an optional 30-day evaluation period, you must purchase and install the license. Otherwise, the features are disabled.

For details about the 60- and 30-day license evaluation periods for the vSRX see

“vSRX

Feature Licenses Overview” on page 71

Adding a New License Key with J-Web

To install a license using the J-Web interface:

Select Maintain>Licenses on the J-Web user interface. The Licenses window is displayed as shown in

Figure 23 on page 80

Figure 23: J-Web Licenses Window

Under Installed Licenses, click Add. The Add License window is displayed as shown in

Figure 24 on page 81 .

Figure 24: Add License Window

Chapter 6: vSRX Licensing

Do one of the following, using a blank line to separate multiple license keys:

• Enter the full URL to the destination file containing the license key in the License

File URL box.

•

Paste the license key text, in plaintext format, in the License Key Text box.

Click OK to add the license key. The License Details window is displayed as shown in

Figure 25 on page 81 .

Figure 25: License Details Window

The license key is installed and activated on the vSRX instance.

Adding a New License Key from the CLI

You can add a license key from a local file, from a remote URL, or from the terminal.

To install a license from the CLI:

Use the request system license add operational mode command to either add the license from a local file or remote URL that contains the license key, or to manually paste the license key in the terminal.

user@vsrx> request system license add terminal

[Type ^D at a new line to end input,

vSRX Guide for Contrail

enter blank line between each license key]

E413XXXX57 aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa

aaaaaa bbbbbb cccccc dddddd eeeeee ffffff

cccccc bbbbbb dddddd aaaaaa ffffff

E413XXXX57: successfully added add license complete (no errors)

NOTE: You can save the license key to a file and upload the file to the vSRX file system through FTP or Secure Copy (SCP), and then use the request system license add file-name command to install the license.

Optionally, use the show system license command to view details of the licenses.

root@host> show system license

License usage: Licenses Licenses Licenses Expiry

Feature name used installed needed wf key websense ewf 1 0 1 invalid

Licenses installed: none

The license key is installed and activated on the vSRX instance.

Updating vSRX Licenses

You can update the vSRX licenses using either of the following two methods:

•

Automatic license update using the CLI

•

Manual license update using the CLI

As a prerequisite, you must install at least one valid license key on your vSRX instance for required features. License auto-update is performed based on the valid software serial number and customer ID embedded in the license key.

To enable automatic license updates from the CLI:

Contact your account team or Juniper Networks Customer Care to extend the validity period of existing license keys and obtain the URL for a valid update server.

Once you have successfully extended your license key and received the update server

URL, configure the auto-update parameter: user@host> set system license autoupdate url https://ae1.juniper.net/

Configure renew options (if required). The following sample allows vSRX to contact the license server 30 days before the current license expires and sends an automatic update request every 6 hours.

Chapter 6: vSRX Licensing user@host> set system license renew before-expiration 30 user@host> set system license renew interval 6

To manually update the licenses from the CLI:

Use the following command to update the license keys manually: user@host> request system license update <url.of.license.server>

This command sends a license update request to the license server immediately.

NOTE: The request system license update command will always use the default Juniper license server: https://ae1.juniper.net

Check the status of the license by entering the show system license command.

Deleting a License with J-Web

To delete a license using the J-Web interface:

Select Maintain>Licenses.

Select the check box of the license or licenses you want to delete as shown in

Figure 26 on page 83 .

Figure 26: Deleting a License

Click Delete.

Click OK to confirm your deletion as shown in

Figure 27 on page 84

vSRX Guide for Contrail

Figure 27: Delete Licenses Window

The license you deleted is removed.

Deleting a License with the CLI

To delete a license using the CLI:

From operational mode, for each license, enter the following command and specify the license ID. You can delete only one license at a time.

user@host> request system license delete <license-key-identifier>

Or you can use the following command to delete all installed licenses.

user@host> request system license delete all

Type yes when you are prompted to confirm the deletion.

Delete license JUNOS606279 ? [yes,no] (no)

The license you deleted is removed.

License Warning Messages

You must purchase a new license or renew your existing subscription-based license to have a seamless transition from the old license to the new one.

The following conditions occur when a license expires on vSRX:

• Evaluation license for the core expires—Packet forwarding on vSRX is disabled. However, you can manage vSRX through the fxp0 management interface, and the CLI configuration is preserved.

• Subscription-based licenses for advanced security features expire but subscription-based licenses for core services are active—A 30-day grace period begins, allowing the user to continue using advanced security features. After the grace period, advanced security features are disabled. Basic features are always available in the vSRX. After subscription-based licenses for core services expire, a warning message is displayed to notify the user, but basic features will remain preserved for the user.

•

Subscription-based license for core features expires but subscription-based license for advanced security features is active—A warning message is displayed to notify the user. However, you can continue to use the basic features on the vSRX. Advanced security features are disabled when the subscription-based license for advanced security features expires, but basic features will remain preserved for the user.

Chapter 6: vSRX Licensing

NOTE: All subscription licenses are renewable. To renew a subscription license, purchase a new subscription of the same license. For more information, see

Subscription - Register and Install

To use features that require a license, you must install and configure a license. After the license expires, warning messages are displayed in the system log and on the J-Web dashboard.

When a license expires, the System Alarms section of the J-Web dashboard displays a message stating that the license has expired as shown in

Figure 28 on page 85

Figure 28: J-Web Dashboard for License Expiry Warning

When a license expires, the following message appears when you log in:

Virtual Appliance License is invalid

vSRX License Model Numbers

The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of features. Each license includes a list of features that the license enables along with information about those features.

For information about purchasing software licenses, contact your Juniper Networks sales representative at http://www.juniper.net/in/en/contact-us/ .

vSRX licenses are based on application packages and processing capacity.

Bandwidth (throughput) licenses allow you to use a single instance of the software for up to the maximum throughput specified in the license entitlement. Throughput licenses can be combined on a single instance of the software so that the maximum throughput for that instance is the aggregate of all the throughput licenses assigned to that instance.

A throughput license cannot be split across multiple instances. Throughput licenses are identified in the license entitlement in megabits per second (Mbps), or gigabits per second

(Gbps).

vSRX provides bandwidth in the following capacities (throughput per instance): 10 Mbps,

100 Mbps, 1 Gbps, 2 Gbps, 4 Gbps, 10 Gbps, and 20 Gbps. Each of these bandwidth tiers is offered with four different packages along with bandwidth based, a la carte, advanced

Layer 7 security services SKUs.

vSRX Guide for Contrail

Table 15 on page 86

describes the features available with the various license packages.

Table 15: vSRX Licensing Package Types

License

Type Description Duration

Secure Cloud

Connect

(SCC)

Includes the following features:

•

IPsec VPN (site-to-site VPN)

NAT

CoS

Routing services – BGP, OSPF, DHCP,

J-Flow, IPv4, and IPv6

Foundation – Static routing, management (J-Web, CLI, and

NETCONF), on-box logging, diagnostics

• Software platform – KVM, Openstack,

ESXi 6.0, Contrail

Both perpetual and subscription license options are available.

See

Table 16 on page 88

for SCC bandwidth SKUs available for vSRX.

STD Includes the following features:

•

Core security – firewall, ALG, screens, user firewall

IPsec VPN (site-to-site VPN)

•

NAT

CoS

•

Multicast services – IP Multicast (PIM,

IGMP)

Routing services – BGP, OSPF, DHCP,

J-Flow, IPv4, and IPv6

•

High availability

Foundation – Static routing, management (J-Web, CLI, and

NETCONF), on-box logging, diagnostics

•

Software platform – KVM, Openstack,

ESXi 6.0, Contrail

Both perpetual and subscription license options are available.

See

Table 17 on page 89

for STD bandwidth SKUs available for vSRX.

ASCB and

ASECB

Includes all STD features bundled with the following additional AppSecure features:

Subscription licenses only.

•

AppID

AppFW

AppQoS

AppTrack

See

Table 18 on page 90

for bandwidth SKUs available for vSRX with AppSecure and IPS features.

CS-B Includes all STD features bundled with

ASEC features and the addition of UTM capabilities:

•

Antispam

Antivirus

Content filtering

Web filtering

Subscription licenses only.

See

Table 20 on page 92

for CS-B bandwidth SKUs available for vSRX.

Chapter 6: vSRX Licensing

Table 15: vSRX Licensing Package Types (continued)

License

Type Description Duration

Individual (a la carte)

Advanced

Security

Services (

ASEC, S-AV,

W-EWF, CS)

Individual (a la carte) Layer 7 security services licenses including:

•

Sophos antivirus

Websense enhanced Web filtering

AppSecure and IPS

Content Security (CS)

Subscription licenses only.

See

Table 19 on page 91

for

AppSecure and IPS SKUs available for vSRX.

See

Table 22 on page 94

for

Sophos antivirus bandwidth SKUs available for vSRX.

Table 23 on page 95

lists the Web filtering subscription licenses available for vSRX.

NOTE: License stacking is allowed. So, for example, to license 20 Mbps of throughput for the standard (STD) feature set perpetually, use 2

VSRX-10M-STD licenses.

Table 17 on page 89

lists the standard bandwidth licenses available for vSRX.

vSRX Guide for Contrail

Table 16: Secure Cloud Connect (SCC) vSRX Bandwidth Licenses

SCC Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX SCC package (1-year,

3-year, or perpetual)

VSRX-10M-SCC

VSRX-10M-SCC-1

VSRX-10M-SCC-3

VSRX-100M-SCC

VSRX-100M-SCC-1

VSRX-100M-SCC-3

VSRX-1G-SCC

VSRX-1G-SCC-1

VSRX-1G-SCC-3

VSRX-2G-SCC

VSRX-2G-SCC-1

VSRX-2G-SCC-3

VSRX-4G-SCC

VSRX-4G-SCC-1

VSRX-4G-SCC-3

VSRX-10G-SCC

VSRX-10G-SCC-1

VSRX-10G-SCC-3

VSRX-20G-SCC

VSRX-20G-SCC-1

VSRX-20G-SCC-3

Chapter 6: vSRX Licensing

Table 17: Standard (STD) vSRX Bandwidth Licenses

STD Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX standard package (1 year, 3 years, and perpetual)

VSRX-10M-STD

VSRX-10M-STD-1

VSRX-10M-STD-3

VSRX-100M-STD

VSRX-100M-STD-1

VSRX-100M-STD-3

VSRX-1G-STD

VSRX-1G-STD-1

VSRX-1G-STD-3

VSRX-2G-STD

VSRX-2G-STD-1

VSRX-2G-STD-3

VSRX-4G-STD

VSRX-4G-STD-1

VSRX-4G-STD-3

VSRX-10G-STD

VSRX-10G-STD-1

VSRX-10G-STD-3

VSRX-20G-STD

VSRX-20G-STD-1

VSRX-20G-STD-3

Table 18 on page 90

lists the bandwidth licenses available for vSRX bundled with

AppSecure and IPS features.

vSRX Guide for Contrail

Table 18: vSRX AppSecure and IPS Bundled (ASCB and ASECB) Bandwidth

Licenses

ASCB / ASECB Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX AppSecure package includes all features in the STD package with IPS and AppSecure (1-year or 3-year subscription)

VSRX-10M-ASECB-1

VSRX-10M-ASECB-3

VSRX-100M-ASCB-1

VSRX-100M-ASCB-3

VSRX-1G-ASECB-1

VSRX-1G-ASECB-3

VSRX-2G-ASECB-1

VSRX-2G-ASECB-3

VSRX-4G-ASECB-1

VSRX-4G-ASECB-3

VSRX-10G-ASECB-1

VSRX-10G-ASECB-3

VSRX-20G-ASECB-1

VSRX-20G-ASECB-3

Table 19 on page 91

lists the individual (a la cart) subscription licenses available for vSRX with AppSecure and IPS features.

Chapter 6: vSRX Licensing

Table 19: Individual vSRX AppSecure and IPS Subscription Licenses

ASEC Licenses Model Number

10M/100M/1G/2G/4G/10G/20G subscription—vSRX AppSecure package includes IPS and AppSecure (1-year or

3-year subscription)

VSRX-10M-ASEC-1

VSRX-10M-ASEC-3

VSRX-100M-ASEC-1

VSRX-100M-ASEC-3

VSRX-1G-ASEC-1

VSRX-1G-ASEC-3

VSRX-2G-ASEC-1

VSRX-2G-ASEC-3

VSRX-4G-ASEC-1

VSRX-4G-ASEC-3

VSRX-10G-ASEC-1

VSRX-10G-ASEC-3

VSRX-20G-ASEC-1

VSRX-20G-ASEC-3

Table 20 on page 92

lists the Content Security bundled (CS-B) bandwidth licenses available for vSRX.

vSRX Guide for Contrail

Table 20: vSRX Content Security Bundled (CS-B) Bandwidth Licenses

CS Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX CS package includes all features in STD, IPS, and AppSecure, enhanced Web filtering, Sophos antivirus, antispam, content filtering, (1-year or

3-year subscription).

VSRX-10M-CS-B-1

VSRX-10M-CS-B-3

VSRX-100M-CS-B-1

VSRX-100M-CS-B-3

VSRX-1G-CS-B-1

VSRX-1G-CS-B-3

VSRX-2G-CS-B-1

VSRX-2G-CS-B-3

VSRX-4G-CS-B-1

VSRX-4G-CS-B-3

VSRX-10G-CS-B-1

VSRX-10G-CS-B-3

VSRX-20G-CS-B-1

VSRX-20G-CS-B-3

Table 21 on page 93

lists the individual (a la carte) CS subscription licenses available for vSRX.

Chapter 6: vSRX Licensing

Table 21: vSRX Individual Content Security (CS) Subscription Licenses

CS Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX CS package includes enhanced Web filtering, Sophos antivirus, antispam, AppSecure and IPS (1-year or

3-year subscription).

VSRX-10M-CS-1

VSRX-10M-CS-3

VSRX-100M-CS-1

VSRX-100M-CS-3

VSRX-1G-CS-1

VSRX-1G-CS-3

VSRX-2G-CS-1

VSRX-2G-CS-3

VSRX-4G-CS-1

VSRX-4G-CS-3

VSRX-10G-CS-1

VSRX-10G-CS-3

VSRX-20G-CS-1

VSRX-20G-CS-3

Table 22 on page 94

lists the individual (a la carte) Sophos antivirus (S-AV) bandwidth licenses available for vSRX.

vSRX Guide for Contrail

Table 22: vSRX Individual Sophos Antivirus (S-AV) Bandwidth Licenses

S-AV Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX S-AV license (1-year or 3-year subscription).

VSRX-10M-S-AV-1

VSRX-10M-S-AV-3

VSRX-100M-S-AV-1

VSRX-100M-S-AV-3

VSRX-1G-S-AV-1

VSRX-1G-S-AV-3

VSRX-2G-S-AV-1

VSRX-2G-S-AV-3

VSRX-4G-S-AV-1

VSRX-4G-S-AV-3

VSRX-10G-S-AV-1

VSRX-10G-S-AV-3

VSRX-20G-S-AV-1

VSRX-20G-S-AV-3

Table 23 on page 95

lists the individual (a la carte) enhanced Web filtering (W-EWF) subscription licenses available for vSRX.

Chapter 6: vSRX Licensing

Table 23: vSRX Individual Enhanced Web Filtering (W-EWF) Bandwidth

Licenses

W-EWF Licenses Model Number

10M/100M/1G/2G/4G/10G/20G throughput—vSRX W-EWF license

(1-year or 3 year subscription).

VSRX-10M-W-EWF-1

VSRX-10M-W-EWF-3

VSRX-100M-WEWF-1

VSRX-100M-WEWF-3

VSRX-1G-W-EWF-1

VSRX-1G-W-EWF-3

VSRX-2G-W-EWF-1

VSRX-2G-W-EWF-3

VSRX-4G-W-EWF-1

VSRX-4G-W-EWF-3

VSRX-10G-W-EWF-1

VSRX-10G-W-EWF-3

VSRX-20G-W-EWF-1

VSRX-20G-W-EWF-3

vSRX Guide for Contrail

CHAPTER 7

Junos OS Features on vSRX

•

vSRX Feature Considerations on page 97

•

SRX Series Features Not Supported on vSRX on page 98

vSRX Feature Considerations

vSRX inherits most of the branch SRX Series features with the following considerations shown in

Table 24 on page 97 .

Table 24: vSRX Feature Considerations

Feature Description

Chassis cluster

IDP

ISSU

Generally, on SRX Series instances, the cluster ID and node ID are written into EEPROM. For the vSRX VM, the IDs are saved in boot/loader.conf

and read during initialization.

The IDP feature is subscription based and must be purchased.

After purchase, you can activate the IDP feature with the license key.

For SRX Series IDP configuration details, see:

Understanding Intrusion Detection and Prevention for SRX

Series

In J-Web, use the following steps to add or edit an IPS rule:

Click Security > IDP > Policy > Add .

2. In the Add IPS Rule window, select

All instead of

Any for the

Direction field to list all the FTP attacks.

ISSU is not supported on vSRX for all VPN and non-VPN features.

vSRX Guide for Contrail

Table 24: vSRX Feature Considerations (continued)

Feature Description

Transparent mode

UTM

The known behaviors for transparent mode support on vSRX are:

• The default MAC learning table size is restricted to 16,383 entries.

• VMware vSwitch does not support MAC learning. It also floods traffic to the secondary node. The traffic is silently dropped by the flow on the secondary node.

For information on configuring transparent mode vSRX, see:

Layer 2 Bridging and Transparent Mode Overview

The UTM feature is subscription based and must be purchased.

After purchase, you can activate the UTM feature with the license key.

For SRX Series UTM configuration details, see:

Unified Threat Management Overview

For SRX Series UTM antispam configuration details, see:

Antispam Filtering Overview

SRX Series Features Not Supported on vSRX

vSRX inherits many features from the Series product line.

Table 25 on page 98

lists SRX

Series features that are not applicable in a virtualized environment, that are not currently supported, or that have qualified support on vSRX.

Table 25: SRX Series Features Not Supported on vSRX

SRX Series Feature vSRX Notes

Application Layer Gateways

Avaya H.323

Not supported

Authentication with IC Series Devices

Layer 2 enforcement in UAC deployments

Not supported

NOTE: UAC-IDP and UAC-UTM also are not supported.

Chassis Cluster Support

NOTE: Support for chassis clustering to provide network node redundancy is only available on a vSRX deployment in VMware, KVM, and Windows Hyper-V Server 2016.

Chapter 7: Junos OS Features on vSRX

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Chassis cluster for VirtIO driver

Only supported with KVM

NOTE: The link status of VirtIO interfaces is always reported as

UP, so a vSRX chassis cluster cannot receive link up and link down messages from VirtIO interfaces.

Dual control links

In-band and low-impact cluster upgrades

Not supported

LAG and LACP (Layer 2 and

Layer 3)

Not supported

Layer 2 Ethernet switching Not supported

Low-latency firewall Not supported

PPPoE over redundant

Ethernet interface

NOTE: Starting in Junos OS

Release 15.1X49-D100, the vSRX supports

Point-to-Point Protocol over a redundant Ethernet interface (PPPoE).

Not supported

SR-IOV interfaces Not supported (see the Known

Behavior section of the vSRX

Release Notes for more information about SR-IOV limitations).

Class of Service

High-priority queue on SPC Not supported

Tunnels Only GRE and IP-IP tunnels supported

Data Plane Security Log Messages (Stream Mode)

TLS protocol

Diagnostics Tools

Not supported

vSRX Guide for Contrail

100

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Flow monitoring cflowd version 9

NOTE: Starting in Junos OS

Release 15.1X49-D80, the vSRX supports J-Flow version 9 flow monitoring on a chassis cluster.

Not supported

Ping Ethernet (CFM) Not supported

Traceroute Ethernet (CFM) Not supported

DNS Proxy

Dynamic DNS Not supported

Ethernet Link Aggregation

LACP in standalone or chassis cluster mode

Not supported

Layer 3 LAG on routed ports Not supported

Static LAG in standalone or chassis cluster mode

Not supported

Ethernet Link Fault Management

Physical interface (encapsulations)

Not supported ethernet-ccc ethernet-tcc extended-vlan-ccc extended-vlan-tcc

Interface family ccc

, tcc ethernet-switching

Not supported

Flow-Based and Packet-Based Processing

End-to-end packet debugging

Not supported

Network processor bundling Not supported

Services offloading Not supported

Chapter 7: Junos OS Features on vSRX

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Interfaces

Aggregated Ethernet interface

Not supported

IEEE 802.1X dynamic VLAN assignment

Not supported

IEEE 802.1X MAC bypass Not supported

IEEE 802.1X port-based authentication control with multisupplicant support

Not supported

Interleaving using MLFR

PoE

PPP interface

Not supported

PPPoE-based radio-to-router protocol

Not supported

PPPoE interface

NOTE: Starting in Junos OS

Release 15.1X49-D100, the vSRX supports

Point-to-Point Protocol over

Ethernet (PPPoE) interface.

Not supported

Promiscuous mode on interfaces

Only supported if enabled on the hypervisor

IP Security and VPNs

Acadia - Clientless VPN

DVPN

Hardware IPsec (bulk crypto) Cavium/RMI

Not supported

IPsec tunnel termination in routing instances

Supported on virtual router only

Multicast for AutoVPN Not supported

Suite B implementation for

IPsec VPN

Not supported

101

vSRX Guide for Contrail

102

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

IPv6 Support

DS-Lite concentrator (aka

AFTR)

DS-Lite initiator (aka B4)

Not supported

J-Web

Enhanced routing configuration

Not supported

New Setup Wizard (for new configurations)

Not supported

PPPoE Wizard Not supported

Remote VPN Wizard

Rescue link on dashboard

Not supported

UTM configuration for

Kaspersky antivirus and the default Web filtering profile

Not supported

Log File Formats for System (Control Plane) Logs

Binary format (binary)

WELF

Miscellaneous

Not supported

GPRS

NOTE: Starting in Junos OS

Release 15.1X49-D70 and

Junos OS Release 17.3R1, the vSRX supports GPRS.

Not supported

Hardware acceleration

Logical systems

Outbound SSH

Not supported

Remote instance access

USB modem

Wireless LAN

Not supported

Chapter 7: Junos OS Features on vSRX

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

MPLS

CCC and TCC

Layer 2 VPNs for Ethernet connections

Network Address Translation

Maximize persistent NAT bindings

Packet Capture

Packet capture

Not supported

Only if promiscuous mode is enabled on the hypervisor

Not supported

Only supported on physical interfaces and tunnel interfaces, such as gr, ip, and st0. Packet capture is not supported on redundant Ethernet interfaces

(reth).

Routing

BGP extensions for IPv6

BGP Flowspec

BGP route reflector

Bidirectional Forwarding

Detection (BFD) for BGP

CRTP

Not supported

Switching

Layer 3 Q-in-Q VLAN tagging Not supported

Transparent Mode

UTM

Unified Threat Management

Express AV

Kaspersky AV

Upgrading and Rebooting

Not supported

Autorecovery Not supported

Boot instance configuration Not supported

103

vSRX Guide for Contrail

Table 25: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Boot instance recovery

Dual-root partitioning

Not supported

User Interfaces

NSM

SRC application

Not supported

Junos Space Virtual Director Only supported with VMware

CHAPTER 8

Troubleshooting

•

Finding the Software Serial Number for vSRX on page 105

Finding the Software Serial Number for vSRX

You need the software serial number to open a support case or to renew a vSRX license.

Use the show system license command to find the vSRX software serial number.

vsrx> show system license

License usage:

Licenses Licenses Licenses Expiry

Feature name used installed needed

Virtual Appliance 1 1 0 58 days

Licenses installed:

License identifier: E420588955

License version: 4

Software Serial Number: 20150625

Customer ID: vSRX-JuniperEval

Features:

Virtual Appliance - Virtual Appliance

count-down, Original validity: 60 days

License identifier: JUNOS657051

License version: 4

Software Serial Number: 9XXXXAXXXXXXX9

Customer ID: MyCompany

Features:

Virtual Appliance - Virtual Appliance

permanent

105

vSRX Guide for Contrail