Juniper Networks vSRX Quick Start Guide

PDF

Dokument

vSRX on Contrail Quick Start Guide

Release

15.1X49

Modified: 2016-01-13

Juniper Networks, Inc.

1133 Innovation Way

Sunnyvale, California 94089

USA

408-745-2000 www.juniper.net

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United

States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

vSRX on Contrail Quick Start Guide

15.1X49

The information in this document is current as of the date on the title page.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

END USER LICENSE AGREEMENT

The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.juniper.net/support/eula.html

. By downloading, installing or using such software, you agree to the terms and conditions of that EULA.

Chapter 1

Chapter 2

Chapter 3

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Opening a Case with JTAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 vSRX with Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Enabling Nested Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Creating an Image Flavor with OpenStack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Creating an Image Flavor for vSRX with Horizon . . . . . . . . . . . . . . . . . . . . . . . 17

Creating an Image Flavor for vSRX with the Nova CLI . . . . . . . . . . . . . . . . . . . 18

Uploading the vSRX Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Uploading the vSRX Image with OpenStack Horizon . . . . . . . . . . . . . . . . . . . 20

Upload the vSRX Image with the OpenStack Glance CLI . . . . . . . . . . . . . . . . 22

Configuring vSRX Service Chains in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Overview of Service Chains with vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Understanding Service Chains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Service Chain Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Components of a Service Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Service Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Service Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Network Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Spawning vSRX in a Contrail Service Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Creating a Service Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Creating Left and Right Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Creating a vSRX Service Instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Creating a Network Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Adding a Network Policy to a Virtual Network . . . . . . . . . . . . . . . . . . . . . . . . . 30

Managing vSRX Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Connecting to the vSRX Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Connecting to the vSRX Management Console with Horizon . . . . . . . . . . . . . 33

Connecting to the vSRX Management Console with Contrail . . . . . . . . . . . . . 33

Managing the vSRX VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Powering On the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Pausing the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Restarting the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

iii

vSRX on Contrail Quick Start Guide

Chapter 4

Chapter 5

Powering Off the VM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Deleting the vSRX VM from Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Monitoring vSRX with Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

vSRX Features and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

System Requirements for vSRX on Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Software Environment Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Contrail Recommendations for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Hardware Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Best Practices Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

PCI NIC to VM Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Mapping Virtual Interfaces to a vSRX VM . . . . . . . . . . . . . . . . . . . . . . . . . 39

Interface Naming and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

vSRX Factory Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

List of Figures

Chapter 1

Chapter 2

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Figure 1: OpenStack Flavors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Figure 2: Create a Flavor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Figure 3: OpenStack Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Figure 4: Create an Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Configuring vSRX Service Chains in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Figure 5: vSRX Service Chaining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Figure 6: Contrail Service Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Figure 7: Contrail Add a Service Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Figure 8: Advanced Options - Add Service Template . . . . . . . . . . . . . . . . . . . . . . . 27

Figure 9: Creating a Virtual Network in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Figure 10: Creating a Network Policy in Contrail . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Figure 11: Contrail Virtual Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Figure 12: Adding a Network Policy to a Virtual Network in Contrail . . . . . . . . . . . . 31

List of Tables

Chapter 1

Chapter 4

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Table 1: Notice Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Table 2: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Installing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Table 3: nova flavor-create Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

vSRX Features and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Table 4: Specifications for vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Table 5: Contrail Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Table 6: Hardware Specifications for the Host Machine . . . . . . . . . . . . . . . . . . . . 38

Table 7: Interface Names for a Standalone vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Table 8: Interface Names for a vSRX Cluster Pair . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Table 9: Factory Default Settings for Security Policies . . . . . . . . . . . . . . . . . . . . . . 42

Table 10: SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . . 42

Table 11: vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

vii

About the Documentation

•

Documentation and Release Notes on page ix

•

Documentation Conventions on page ix

•

Documentation Feedback on page xi

•

Requesting Technical Support on page xii

Documentation and Release Notes

To obtain the most current version of all Juniper Networks

® technical documentation, see the product documentation page on the Juniper Networks website at http://www.juniper.net/techpubs/ .

If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes.

Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at http://www.juniper.net/books .

Documentation Conventions

Table 1 on page x

defines notice icons used in this guide.

vSRX on Contrail Quick Start Guide

Table 1: Notice Icons

Icon Meaning

Informational note

Caution

Warning

Laser warning

Tip

Best practice

Description

Indicates important features or instructions.

Indicates a situation that might result in loss of data or hardware damage.

Alerts you to the risk of personal injury or death.

Alerts you to the risk of personal injury from a laser.

Indicates helpful information.

Alerts you to a recommended use or implementation.

Table 2 on page x

defines the text and syntax conventions used in this guide.

Table 2: Text and Syntax Conventions

Convention Description Examples

Bold text like this

Fixed-width text like this

Italic text like this

Represents text that you type.

To enter configuration mode, type the configure command: user@host> configure

Represents output that appears on the terminal screen.

user@host> show chassis alarms

No alarms currently active

• Introduces or emphasizes important new terms.

•

Identifies guide names.

Identifies RFC and Internet draft titles.

•

A policy term is a named structure that defines match conditions and actions.

Junos OS CLI User Guide

RFC 1997, BGP Communities Attribute

Represents variables (options for which you substitute a value) in commands or configuration statements.

Configure the machine’s domain name:

About the Documentation

Table 2: Text and Syntax Conventions (continued)

Convention Description

Text like this

< > (angle brackets)

| (pipe symbol)

Examples

Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components.

•

To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level.

The console port is labeled CONSOLE .

Encloses optional keywords or variables.

stub <default-metric metric>;

Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity.

broadcast | multicast

(string1 | string2 | string3)

# (pound sign)

[ ] (square brackets)

Indention and braces ( { } )

; (semicolon)

Indicates a comment specified on the same line as the configuration statement to which it applies.

rsvp { # Required for dynamic MPLS only

Encloses a variable for which you can substitute one or more values.

Identifies a level in the configuration hierarchy.

Identifies a leaf statement at a configuration hierarchy level.

community name members [

community-ids ]

[edit] routing-options { static { route default { nexthop address; retain;

}

GUI Conventions

Bold text like this

> (bold right angle bracket)

Represents graphical user interface (GUI) items you click or select.

•

In the Logical Interfaces box, select

All Interfaces .

To cancel the configuration, click

Cancel .

Separates levels in a hierarchy of menu selections.

In the configuration editor hierarchy, select Protocols>Ospf.

Documentation Feedback

We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods:

• Online feedback rating system—On any page at the Juniper Networks Technical

Documentation site at http://www.juniper.net/techpubs/index.html

, simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at http://www.juniper.net/techpubs/feedback/ .

vSRX on Contrail Quick Start Guide

• E-mail—Send your comments to [email protected]. Include the document or topic name, URL or page number, and software version (if applicable).

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance

Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf

• Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/ .

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day,

7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

• Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: http://www2.juniper.net/kb/

• Find product documentation: http://www.juniper.net/techpubs/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: http://kb.juniper.net/InfoCenter/

• Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

• Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number Entitlement

(SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

• Use the Case Management tool in the CSC at http://www.juniper.net/cm/ .

• Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

About the Documentation

For international or direct-dial options in countries without toll-free numbers, see http://www.juniper.net/support/requesting-support.html

xiii

CHAPTER 1

Installing vSRX vSRX with Contrail

•

vSRX with Contrail on page 15

•

Enabling Nested Virtualization on page 15

•

Creating an Image Flavor with OpenStack on page 16

•

Uploading the vSRX Image on page 19

Juniper Networks Contrail is an open, standards-based software solution that delivers network virtualization and service automation for federated cloud networks. It provides self-service provisioning, improves network troubleshooting and diagnostics, and enables service chaining for dynamic application environments across enterprise virtual private cloud (VPC), managed Infrastructure as a Service (IaaS), and Networks Functions

Virtualization (NFV) use cases.

You can use Contrail with open cloud orchestration systems such as OpenStack or

CloudStack to instantiate instances of vSRX in a virtual environment. Contrail with vSRX provides network services such as firewall, NAT, and load balancing to virtual networks.

NOTE: vSRX on a KVM hypervisor requires you to enable hardware-based virtualization on a host OS that contains an Intel Virtualization Technology

(VT) capable processor.

Documentation

• Contrail Overview

Enabling Nested Virtualization

We recommend that you enable nested virtualization on your host OS or OpenStack compute node. Nested virtualization is enabled by default on Ubuntu, but is disabled by default on CentOS.

Use the following command to determine if nested virtualization is enabled on your host

OS. The result should be Y.

hostOS# cat /sys/module/kvm_intel/parameters/nested

vSRX on Contrail Quick Start Guide hostOS# Y

NOTE: APIC virtualization (APICv) does not work well with nested VMs such as those used with KVM. On Intel CPUs that support APICv (typically v2 models, for example E5 v2 and E7 v2), you must disable APICv on the host server before deploying vSRX.

To enable nested virtualization on the host OS:

On CentOS, open the /etc/modprobe.d/dist.conf file in your default editor.

hostOS# vi /etc/modprobe.d/dist.conf

On Ubuntu, open the /etc/modprobe.d/qemu-system-x86.conf file in your default editor.

hostOS# vi /etc/modprobe.d/qemu-system-x86.conf

Add the following line to the file: options kvm_intel nested=y

Save the file and reboot the host OS.

Optionally after reboot, verify that nested virtualization is enabled.

hostOS# cat /sys/module/kvm_intel/parameters/nested hostOS# Y

On Intel CPUs that support APICv ( for example, E5 v2 and E7 v2), disable APICv on the host OS.

root@host# sudo rmmod kvm-intel root@host# sudo sh -c “echo ’options kvm-intel enable_apicv=n’ >>

/etc/modprobe.d/dist.conf” root@host# sudo modprobe kvm-intel

Optionally, verify that APICv is now disabled.

root@host# cat /sys/module/kvm_intel/parameters/enable_apicv

Creating an Image Flavor with OpenStack

OpenStack launches instances of images, based on the image installed and VM templates called flavors. Flavors set the memory, vCPU and storage requirements for the image.

You can use the Horizon GUI or the OpenStack nova commands to create flavors for the vSRX VMs.

•

Creating an Image Flavor for vSRX with Horizon on page 17

•

Creating an Image Flavor for vSRX with the Nova CLI on page 18

Chapter 1: Installing vSRX

Creating an Image Flavor for vSRX with Horizon

OpenStack uses VM templates, or flavors, to set the memory, vCPU, and storage requirements for an image. OpenStack includes a default set of flavors, but we recommend that you create a flavor to match the vSRX image requirements.

To create an image flavor for vSRX with Horizon:

From the Horizon GUI, select your project, and select Admin>System Panel>Flavors.

The list of existing image flavors appears, as shown in

Figure 1 on page 17

Figure 1: OpenStack Flavors

Click Create Flavor. The Create Flavor dialog box appears, as shown in

Figure 2 on page 18 .

vSRX on Contrail Quick Start Guide

Figure 2: Create a Flavor

Enter a name in the Name box for this vSRX flavor.

Enter the appropriate value in the vCPUs box for your configuration. The minimum required for vSRX is 2 vCPUs.

Enter the appropriate value in the RAM MB box. The minimum required for vSRX is

4096 MB.

Enter the appropriate value in the Root Disk GB box. The minimum required for vSRX is 16 GB.

Enter the appropriate values in the Emphemeral Disk GB and Swap Disk MB boxes.

The minimum required for vSRX is 0 for each.

Click Create Flavor. The flavor appears on the Flavors tab.

Creating an Image Flavor for vSRX with the Nova CLI

To create an image flavor for vSRX with the nova CLI command:

Use the nova flavor-create command on the OpenStack compute node that will host the vSRX VM. See

Table 3 on page 19

for a list of mandatory parameters.

Chapter 1: Installing vSRX

NOTE: See the official OpenStack documentation for a complete description of available options for the nova flavor-create command.

Table 3: nova flavor-create Command

Command Option Description

--is-public true flavor_name auto ram_megabytes disk_gigabytes

Set the flavor as publicly available.

Name the vSRX flavor.

Select auto to automatically assign the flavor ID.

Allocate RAM for the VM, in megabytes.

Specify disk storage size for the VM.

vcpus Allocate the number of vCPUs for the vSRX VM.

NOTE: Use nova help flavor-create for more details on the command options.

Optionally, use the nova flavor-list to verify the flavors.

The following example creates a vSRX flavor with 4096 MB RAM, 2 vCPUs, and disk storage up to 16 GB:

$ nova flavor-create --is-public true vsrx_flavor auto 4096 16 2

Documentation

• OpenStack End User Guide

Uploading the vSRX Image

Contrail integrates with OpenStack for public, private, or hybrid cloud orchestration. You can install the vSRX image and use this installed image to provide security services in a service chain with Contrail.

Before installing vSRX, ensure that you have installed either Contrail and, optionally,

OpenStack Glance.

• Contrail - Installation Overview

• OpenStack - Add the Image Service (glance)

You can upload the vSRX image with either Horizon, the OpenStack GUI dashboard, or

Glance, the OpenStack CLI-based image services project.

vSRX on Contrail Quick Start Guide

NOTE: See Migration, Upgrade, and Downgrade in the vSRX Release Notes to upgrade an existing vSRX instance.

•

Uploading the vSRX Image with OpenStack Horizon on page 20

Upload the vSRX Image with the OpenStack Glance CLI on page 22

Uploading the vSRX Image with OpenStack Horizon

To upload a vSRX image with Horizon:

From the Horizon GUI, select your project, and select Compute>Images. The list of existing images appears, as shown in

Figure 3 on page 20

Figure 3: OpenStack Images

Click Create Image. The Create Image dialog box appears, as shown in

Figure 4 on page 21

Figure 4: Create an Image

Chapter 1: Installing vSRX

Enter a name for the vSRX image, and enter the image location.

Select QCOW2- QEMU Emulator from the Format list.

Enter the appropriate value in the Minimum Disk (GB) box for your configuration. The minimum required for vSRX is 16 GB.

Enter the appropriate value in the Minimum RAM (MB) box. The minimium required for vSRX is 4096 MB.

Select Public.

Click Create Image. OpenStack uploads the image to the image service. The image appears on the Images tab.

vSRX on Contrail Quick Start Guide

NOTE: The default vSRX VM login ID is root with no password. By default, vSRX is assigned a DHCP-based IP address if a DHCP server is available on the network.

Upload the vSRX Image with the OpenStack Glance CLI

To upload a vSRX image with the Glance CLI:

Use wget to download the vSRX image to the compute node.

Use glance image-create to add the image to the image service with a base configuration for disk, format, and memory requirements. Use glance help image-create for complete details on this command-line tool.

For example, the following command adds the vSRX QCOW2 image to the image service with 16 GB disk space and 4096 MB of RAM: glance image-create --name='vSRX image' --is-public=true

--container-format=bare --disk-format=qcow2 --min-disk=16 --min-ram=4096

--file=media-srx-ffp-vsrx-vmdisk-15.1X49-D30.qcow2

NOTE: vSRX requires at least 16 GB of disk space and 4096 MB of RAM.

NOTE: The default vSRX VM login ID is root with no password. By default, vSRX is assigned a DHCP-based IP address if a DHCP server is available on the network.

Documentation

• Contrail - Installation Overview

• OpenStack Installation Guide for Ubuntu 14.04

• OpenStack - Add the Image Service (glance)

• OpenStack - Upload and Manage Images

• OpenStack - Manage images (glance)

• Migration, Upgrade, and Downgrade

CHAPTER 2

Configuring vSRX Service Chains in

Contrail

•

Overview of Service Chains with vSRX on page 23

•

Spawning vSRX in a Contrail Service Chain on page 25

Overview of Service Chains with vSRX

You can use Contrail to chain various Layer 2 through Layer 7 services such as firewall,

NAT, and IDP through one or more vSRX VMs. For example, you can insert a vSRX firewall

VM between two other virtual machines (VMs). By using vSRX and service chains, you can tailor the security needs to a targeted virtual network and VM set. This provides agility and scalability in line with the fluidity of cloud network environments.

•

Understanding Service Chains on page 23

•

Service Chain Modes on page 24

•

Components of a Service Chain on page 24

Understanding Service Chains

To create a service through vSRX, you instantiate one or more vSRX VMs to dynamically apply single or multiple services to network traffic.

Figure 5 on page 24

shows a basic service chain with a single vSRX VM. The vSRX service

VM spawns a service, such as a firewall. The left interface (left IF) points to the internal end customer, who uses the service; and the right interface (right IF) points to the external network or Internet. You can also instantiate multiple vSRX VMs to chain multiple services together. For example, you could add an IDP service after the firewall.

vSRX on Contrail Quick Start Guide

Figure 5: vSRX Service Chaining

When you create a service chain, Contrail creates tunnels across the underlay network that span all services in the chain.

Service Chain Modes

You can configure the following service modes:

• Transparent or bridge mode—Used for services that do not modify the packet. Also known as bump-in-the-wire or Layer 2 mode. Examples include Layer 2 firewall and

IDP.

• In-network or routed mode—Provides a gateway service that routes packets between the service instance interfaces. Examples include NAT, Layer 3 firewall, and load balancing.

• In-network-nat mode—Similar to in-network mode; however, packets from the left

(private) network are not routed to the right (public) source network. In-network-nat mode is particularly useful for NAT services.

NOTE: Ensure that you define the service policy with the private network on the left and public on the right in order to get the public routes (usually the default) advertised into the left network.

Components of a Service Chain

Service chaining requires the following configuration components to build the chain:

• Service template

• Virtual networks

• Service instance

• Network policy

Service Templates

Service templates map out the basic configuration that Contrail uses to instantiate a service instance, or VM. Within Contrail, you configure service templates in the scope of a domain, and you can use the templates on all projects within a domain. You can use a template to launch multiple service instances of the same type in different projects within

Chapter 2: Configuring vSRX Service Chains in Contrail a domain. Within a service template, you select the service mode, a vSRX image name for the VM that will provide the service, and an ordered list of interfaces for the service.

vSRX service VMs require the management interface to be the first interface in that ordered list. You can use OpenStack Horizon or Glance to add the vSRX image. You also select the OpenStack flavor to associate with all service instances that use the service template. An OpenStack flavor defines the number of vCPUs, storage, and memory you can assign to a VM. OpenStack includes default flavors, and you can create new flavors in the OpenStack dashboard.

Virtual Networks

Virtual networks provide the link between the service instance and the network traffic in the virtualized environment. You can create the virtual networks in Contrail or OpenStack and use those networks to direct traffic to or through the service instance.

Service Instances

A service instance is the instantiation of the selected service template to create one or more VMs that provide the service (for example, a firewall). When you create a service instance, you select a service template that defines the instance. You also associate the interfaces in the service template with the virtual networks needed to direct traffic into and out of the service instance. If you enable service scaling in the selected service template, you can instantiate more than one VM when you create the service instance.

Network Policies

By default, all traffic in a virtual network remains isolated. You configure a network policy to allow traffic between virtual networks and through the service instance. The network policy filters traffic to and from the service VM based on the rules you configure. You select the service instance VM and the virtual networks for the right and left interfaces of that VM that the network policy applies to. As a final step. you associate the network policy with each virtual network the policy applies to.

Documentation

• Contrail - Service Chaining

Spawning vSRX in a Contrail Service Chain

Ensure that you have installed Contrail and have loaded the vSRX images with OpenStack

Horizon or Glance.

• Installation Overview (Contrail)

• Add the Image Service (glance)

You can use Contrail to chain various Layer 2 through Layer 7 services such as firewall,

NAT, and IDP through vSRX VMs.

•

Creating a Service Template on page 26

•

Creating Left and Right Virtual Networks on page 28

•

Creating a vSRX Service Instance on page 29

vSRX on Contrail Quick Start Guide

•

Creating a Network Policy on page 29

•

Adding a Network Policy to a Virtual Network on page 30

Creating a Service Template

To create a service template:

From Contrail, select Configure>Services>Service Templates. The list of existing service templates appears, as shown in

Figure 6 on page 26

Figure 6: Contrail Service Templates

Click + to create a new service template. The Add Service Template dialog box appears, as shown in

Figure 7 on page 26

Figure 7: Contrail Add a Service Template

Chapter 2: Configuring vSRX Service Chains in Contrail

Add a name for the service template in the Name box.

Select the appropriate service mode and service type from the lists.

Select the vSRX image from the Image Name list. This is the image you installed previously in the OpenStack image service.

Click + to add three interfaces.

Select Management for the first interface type, Left for the second interface type, and

Right for the third interface type. You associate the left and right interfaces with the left and right virtual networks when you create the service instance. Any additional interfaces must be of type Other.

Expand Advanced Options and select an instance flavor from the Instance Flavor list, as shown in

Figure 8 on page 27

. You can use an appropriate default flavor from

OpenStack or a custom flavor you created previously for vSRX.

Figure 8: Advanced Options - Add Service Template

Optionally, check Scaling to create multiple identical vSRX instances from this service template for load balancing.

10.

Click Save to create this new service template.

See Contrail - Creating an In-Network or In-Network-NAT Service Chain for more details.

vSRX on Contrail Quick Start Guide

Creating Left and Right Virtual Networks

Ensure that you have IP Address Management (IPAM) set up for your project.

To create a virtual network:

From Contrail, select Configure>Networking>Networks. The list of existing networks appears.

Verify that your project is displayed as active in the upper right Project list, and click

+ to create a new virtual network. The Create Network dialog box appears, as shown in

Figure 9 on page 28

Figure 9: Creating a Virtual Network in Contrail

Enter a name for the left virtual network.

Do not select a network policy yet. You create the network policy after you create the service instance and then you update this virtual network to add the policy.

Expand Subnet and click + to add IPAM to this virtual network.

Select the appropriate IPAM from the list.

Set the CIDR and Gateway fields.

Expand Advanced Options and select appropriate options for your network.

Click Save. The new virtual network appears in the list of configured networks.

Repeat this procedure for the right virtual network.

See Contrail - Creating a Virtual Network for more details

Chapter 2: Configuring vSRX Service Chains in Contrail

Creating a vSRX Service Instance

To create a vSRX service instance:

Select Configure>Services>Service Instances. The list of existing service instances appears.

Click + to create a new service instance. The Create Service Instance dialog box appears.

Enter a name for the service instance.

Select the service template you created for vSRX from the Services Template list.

This service template includes the vSRX image used to provide the service.

Select Management from the Interface 1 list. Management must be the first interface for vSRX service instances.

Select Left from the Interface 2 list, and Right from the Interface 3 list.

Select Auto Configured for the Management interface.

Select the left virtual network for the left interface, and the right virtual network for the right interface.

Click Save to save this service instance. Contrail launches the vSRX VM for this service instance.

10.

Optionally, select Configure>Services>Service Instances to view this new vSRX instance status. You can expand the row for this instance in the table and click View Console to access the vSRX console port.

NOTE: You can also view this service instance from the OpenStack Instances table, but you should only use Contrail to delete service instances.

See Contrail - Creating an In-Network or In-Network-NAT Service Chain for more details.

Creating a Network Policy

To create a network policy:

Select Configure>Networking>Policies. The table of policies appears.

Click + to create a new policy. The Create Policy dialog box appears, as shown in

Figure 10 on page 30 .

vSRX on Contrail Quick Start Guide

Figure 10: Creating a Network Policy in Contrail

Name the policy.

Click + to create a new rule for this policy.

Select the left virtual network you created from the Source list and select the right virtual network from the Destination list.

Select the appropriate protocol from the Protocol list and select the source and destination ports for this policy.

Select Services and select the vSRX instance you want to apply this policy to.

Optionally, add more policy rules to this policy.

Click Save to create this policy.

See Conrail - Creating a Network Policy for more details.

Adding a Network Policy to a Virtual Network

To add a network policy to a virtual network:

Select Configure>Networking, and select the settings icon to the right of the virtual network you want to add a network policy to, as shown in

Figure 11 on page 30 .

Figure 11: Contrail Virtual Networks

Click Edit. The Edit Networks dialog box appears, as shown in

Figure 12 on page 31

Chapter 2: Configuring vSRX Service Chains in Contrail

Figure 12: Adding a Network Policy to a Virtual Network in Contrail

Select the appropriate policy from the Networks Policy(s) list.

Click Save to save this change.

Repeat this procedure for the other virtual network in this service chain.

See Contrail - Associating a Network to a Policy for more details.

Documentation

• Contrail - Creating an In-Network or In-Network-NAT Service Chain

• Contrail - Installation Overview

vSRX on Contrail Quick Start Guide

CHAPTER 3

Managing vSRX Instances

•

Connecting to the vSRX Management Console on page 33

•

Managing the vSRX VM on page 34

•

Monitoring vSRX with Contrail on page 35

Connecting to the vSRX Management Console

Ensure that you have launched the vSRX VM with Contrail.

You can connect to the vSRX console through OpenStack or Contrail.

•

Connecting to the vSRX Management Console with Horizon on page 33

•

Connecting to the vSRX Management Console with Contrail on page 33

Connecting to the vSRX Management Console with Horizon

To connect to the vSRX console with OpenStack Horizon:

From the Horizon GUI, select your project, and select Compute>Instances. The list of existing instances appears.

From the Actions column, select Console from the More list. The vSRX console appears, and you can log in to the management port for the vSRX instance.

Connecting to the vSRX Management Console with Contrail

To connect to the vSRX console of a vSRX VM with Contrail:

From the Contrail GUI, select your project, and select Configure>Services>Service

Instances . The list of existing service instances appears.

Click on the left arrow next to the vSRX VM to expand to the Service Instance Details view.

Click the View Console link on the right. The vSRX console appears, and you can log in to the management port for the vSRX.

Documentation

• OpenStack End User Guide

• Contrail - Creating an In-Network or In-Network-NAT Service Chain

vSRX on Contrail Quick Start Guide

Managing the vSRX VM

Each vSRX instance is an independent virtual machine (VM) that you can power on, pause, or shut down.

•

Powering On the VM on page 34

•

Pausing the VM on page 34

•

Restarting the VM on page 34

•

Powering Off the VM on page 34

•

Deleting the vSRX VM from Contrail on page 35

Powering On the VM

To power on the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM you want to power on.

From the Actions column, select Start Instance from the list.

Pausing the VM

To pause the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM that you want to pause.

From the Actions column, select Pause Instance from the list.

Restarting the VM

To restart the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM that you want to reboot.

Select Soft Reboot Instance from the More list to restart the VM.

Powering Off the VM

To power off the VM:

From the Horizon GUI for your project, select Compute>Instances. The list of existing instances appears.

Check the VM you want to power off.

Chapter 3: Managing vSRX Instances

From the Actions column, select Console from the list. The console opens.

From the console, power off the VM.

user@host>request system power-off

Deleting the vSRX VM from Contrail

BEST PRACTICE: We recommend that you use Contrail to delete any VMs used in service chains created by Contrail.

To delete the VM from Contrail:

From the Contrail GUI for your project, select Configure>Services>Service Instances.

The list of existing service instances appears.

Select the VM that you want to delete.

Click trash icon on the upper right menu to delete the selected VMs.

Documentation

• OpenStack End User Guide

Monitoring vSRX with Contrail

To monitor basic statistics on the vSRX VM with Contrail:

On Contrail, select Monitor>Networking>Instances. The list of existing VMs appears.

Expand the row for the VM that you want to monitor. The CPU and memory statistics appear.

On Contrail, select Monitor>Networking>Networks. The list of existing virtual networks appears.

Expand the row for the virtual network that you want to monitor and select Traffic

Statistics . The traffic and throughput statistics appear.

Documentation

• Contrail - Monitor Networking

vSRX on Contrail Quick Start Guide

CHAPTER 4

vSRX Features and Requirements

•

System Requirements for vSRX on Contrail on page 37

•

Interface Naming and Mapping on page 40

•

vSRX Factory Default Settings on page 42

•

SRX Series Features Not Supported on vSRX on page 42

•

vSRX Feature Considerations on page 47

System Requirements for vSRX on Contrail

•

Software Environment Requirements on page 37

•

Hardware Recommendations on page 38

•

Best Practices Recommendations on page 39

Software Environment Requirements

Table 4 on page 37

lists the system software requirement specifications for the vSRX environment.

Table 4: Specifications for vSRX

Component Specification

Hypervisor support

Memory

Disk space vCPUs

Linux KVM

4 GB

16 GB IDE drive

2 vNICs Up to 8

vSRX on Contrail Quick Start Guide

Table 4: Specifications for vSRX (continued)

Component Specification

Virtual NIC types SR-IOV

Virtio

NOTE: We recommend the Intel X710/XL710 or X520/X540 physical

NICs for SR-IOV support on vSRX.

For SR-IOV limitations, see the Known Behavior section of the vSRX

Release Notes

Contrail Recommendations for vSRX

Table 5 on page 38

lists the recommended software versions to run vSRX on Contrail.

Table 5: Contrail Recommendations

Software Version

Contrail

OpenStack

Host OS

Linux Kernel

2.20

Juno or Icehouse

Ubuntu 14.04.2

3.16

Hardware Recommendations

Table 6 on page 38

lists the hardware specifications for the host machine that runs the vSRX virtual machine (VM).

NOTE: See Contrail - Server Requirements to review any additional requirements for Contrail.

Table 6: Hardware Specifications for the Host Machine

Component Specification

Host memory size

Host processor type

Physical NIC

Minimum 4 GB x86_64 multicore CPU

NOTE: DPDK requires Intel Virtualization VT-x/VT-d support in the CPU. See About Intel Virtualization Technology.

Intel X710/XL710 or X520/X540 physical NICs for SR-IOV support on vSRX

Chapter 4: vSRX Features and Requirements

NOTE: We recommend that you enable hardware-based virtualization on the host machine. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support

To determine the Junos OS features supported on vSRX, use the Juniper Networks Feature

Explorer, a Web-based application that helps you to explore and compare Junos OS feature information to find the right software release and hardware platform for your network. Find Feature Explorer here:

Feature Explorer: vSRX

Best Practices Recommendations

vSRX deployments can be complex, and there is a great deal of variability in the specifics of possible deployments. The following recommendations might apply to and improve performance and function in your particular circumstances.

PCI NIC to VM Mapping

If the node on which vSRX is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. On a Linux host OS, install the hwloc package and use the lstopo command to provide information about relative physical NIC locations. Move the vSRX VM to a slot on the server that is connected to the PCI NIC that vSRX VM uses.

On some servers where this information is not available or not supported, refer to the hardware documentation for the slot-to-NUMA node topology.

Mapping Virtual Interfaces to a vSRX VM

To determine which virtual interfaces on your Linux host OS map to a vSRX virtual machine

(VM):

Use the virsh list command on your Linux host OS to list the running VMs.

hostOS# virsh list

Id Name State

----------------------------------------------------

9 centos1 running

15 centos2 running

16 centos3 running

48 vsrx running

50 1117-2 running

51 1117-3 running

Use the virsh domiflist vsrx-name command to list the virtual interfaces on that vSRX

VM.

hostOS# virsh domiflist vsrx

Interface Type Source Model MAC

------------------------------------------------------vnet1 bridge brem2 virtio 52:54:00:8f:75:a5 vnet2 bridge br1 virtio 52:54:00:12:37:62 vnet3 bridge brconnect virtio 52:54:00:b2:cd:f4

vSRX on Contrail Quick Start Guide

NOTE: The first virtual interface maps to the fxp0 interface in the Junos

OS.

Documentation

• About Intel Virtualization Technology

• DPDK Release Notes

• Contrail - Server Requirements

Interface Naming and Mapping

Each network adapter defined for a vSRX is mapped to a specific interface, depending on whether the vSRX instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX have changed since the previous release (called Firefly Perimeter), as shown in the following tables. Note the following changes:

• In standalone mode:

• fxp0 is the out-of-band management interface

• ge-0/0/0 is the first traffic (revenue) interface

• In cluster mode:

• fxp0 is the out-of-band management interface

• em0 is the cluster control link for both nodes

• Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 7 on page 40

shows the interface names and mappings for a standalone vSRX.

Table 7: Interface Names for a Standalone vSRX

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX fxp0 ge-0/0/0 ge-0/0/1

6 ge-0/0/2 ge-0/0/3 ge-0/0/4

Chapter 4: vSRX Features and Requirements

Table 7: Interface Names for a Standalone vSRX (continued)

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX ge-0/0/5 ge-0/0/6 ge-0/0/7 ge-0/0/8

Table 8 on page 41

shows the interface names and mappings for a pair of vSRX VMs in a cluster (node 0 and node 1).

Table 8: Interface Names for a vSRX Cluster Pair

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX

5 fxp0 (node 0 and 1) em0 (node 0 and 1) ge-0/0/0 (node 0) ge-7/0/0 (node 1) ge-0/0/1 (node 0) ge-7/0/1 (node 1) ge-0/0/2 (node 0) ge-7/0/2 (node 1)

10 ge-0/0/3 (node 0) ge-7/0/3 (node 1) ge-0/0/4 (node 0) ge-7/0/4 (node 1) ge-0/0/5 (node 0) ge-7/0/5 (node 1) ge-0/0/6 (node 0) ge-7/0/6 (node 1) ge-0/0/7 (node 0) ge-7/0/7 (node 1)

vSRX on Contrail Quick Start Guide

vSRX Factory Default Settings

vSRX requires the following basic configuration settings:

• Interfaces must be assigned IP addresses.

• Interfaces must be bound to zones.

• Policies must be configured between zones to permit or deny traffic.

NOTE: The management interface, fxp0, requires the following:

• KVM uses the virtIO vNIC and requires promiscuous mode on the bridge.

Use the ifconfig bridge-name promisc command on the host OS to enable promiscuous mode on the Linux bridge.

Table 9 on page 42

lists the factory default settings for the vSRX security policies.

Table 9: Factory Default Settings for Security Policies

Source Zone Destination Zone Policy Action trust trust untrust untrust trust trust permit permit deny

SRX Series Features Not Supported on vSRX

vSRX inherits many features from the SRX Series product line.

Table 10 on page 42

lists

SRX features that are not applicable in a virtualized environment, that are not currently supported, or that have qualified support on vSRX.

Table 10: SRX Series Features Not Supported on vSRX

SRX Series Feature vSRX Notes

Application Layer Gateways

Avaya H.323

Not supported

Authentication with IC Series Devices

Layer 2 enforcement in UAC deployments

Not supported

NOTE: UAC-IDP and UAC-UTM also are not supported.

Chassis Cluster Support

Chapter 4: vSRX Features and Requirements

Table 10: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Chassis cluster for VirtIO driver

Only supported with KVM

NOTE: The link status of VirtIO interfaces is always reported as

UP, so a vSRX chassis cluster cannot receive link up and link down messages from VirtIO interfaces.

Dual control links

In-band and low-impact cluster upgrades

Not supported

LAG and LACP (Layer 2 and

Layer 3)

Not supported

Layer 2 Ethernet switching Not supported

Low-latency firewall Not supported

PPPoE over redundant

Ethernet interface

SR-IOV interfaces

Not supported

Not supported (see the Known

Behavior section of the vSRX

Release Notes for more information about SR-IOV limitations).

Class of Service

Data Plane Security Log Messages (Stream Mode)

TLS protocol

Diagnostics Tools

Not supported

Flow monitoring cflowd version 9

Ping Ethernet (CFM)

Not supported

Traceroute Ethernet (CFM) Not supported

DNS Proxy

High-priority queue on SPC Not supported

Tunnels Only GRE and IP-IP tunnels supported

vSRX on Contrail Quick Start Guide

Table 10: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Dynamic DNS Not supported

Ethernet Link Aggregation

LACP in standalone or chassis cluster mode

Not supported

Layer 3 LAG on routed ports Not supported

Static LAG in standalone or chassis cluster mode

Not supported

Ethernet Link Fault Management

Physical interface (encapsulations)

Not supported ethernet-ccc ethernet-tcc extended-vlan-ccc extended-vlan-tcc

Not supported

Interface family ccc, tcc ethernet-switching

Not supported

Flow-Based and Packet-Based Processing

End-to-end packet debugging

Not supported

Network processor bundling Not supported

Services offloading Not supported

Interfaces

Aggregated Ethernet interface

Not supported

IEEE 802.1X dynamic VLAN assignment

Not supported

IEEE 802.1X MAC bypass Not supported

IEEE 802.1X port-based authentication control with multisupplicant support

Not supported

Chapter 4: vSRX Features and Requirements

Table 10: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Interleaving using MLFR

PoE

PPP interface

PPPoE-based radio-to-router protocol

Not supported

PPPoE interface

Promiscuous mode on interfaces

Not supported

Only supported if enabled on the hypervisor

IP Security and VPNs

Acadia - Clientless VPN Not supported

Auto Discovery VPN

DVPN

Group VPN

Hardware IPsec (bulk crypto) Cavium/RMI

Not supported

IPsec tunnel termination in routing instances

Supported on virtual router only

Multicast for AutoVPN Not supported

Suite B implementation for

IPsec VPN

Not supported

IPv6 Support

DS-Lite concentrator (aka

AFTR)

DS-Lite initiator (aka B4)

Not supported

J-Web

Enhanced routing configuration

Not supported

New Setup Wizard (for new configurations)

Not supported

vSRX on Contrail Quick Start Guide

Table 10: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

PPPoE Wizard

Remote VPN Wizard

Not supported

Rescue link on dashboard Not supported

UTM configuration for

Kaspersky anti-virus and the default Web filtering profile.

Not supported

Log File Formats for System (Control Plane) Logs

Binary format (binary)

WELF

Miscellaneous

GPRS

Hardware acceleration

Logical systems

Remote device access

USB modem

Wireless LAN

MPLS

CCC and TCC

Layer 2 VPNs for Ethernet connections

Network Address Translation

Maximize persistent NAT bindings

Packet Capture

Packet capture

Not supported

Only if promiscuous mode is enabled on the hypervisor

Not supported

Only supported on physical interfaces and tunnel interfaces, such as gr, ip, and st0. Packet capture is not supported on redundant Ethernet interfaces

(reth).

Routing

Chapter 4: vSRX Features and Requirements

Table 10: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

BGP Flowspec

BGP Route Reflector

CRTP

Not supported

Security Policy Support

User role firewall Not supported

Switching

Transparent Mode

UTM

Unified Threat Management

Express AV

Kaspersky AV

Upgrading and Rebooting

Autorecovery

Boot device configuration

Boot device recovery

Dual-root partitioning

User Interfaces

Layer 3 Q-in-Q VLAN

Tagging

Not supported

NSM Not supported

SRC application Not supported

Junos Space Virtual Director Only supported with VMware

vSRX Feature Considerations

vSRX inherits most of the branch SRX Series features with the following considerations shown in

Table 11 on page 48

vSRX on Contrail Quick Start Guide

Table 11: vSRX Feature Considerations

Feature Description

Chassis cluster

IDP

ISSU

Generally, on SRX Series devices, the cluster ID and node ID are written into EEPROM. For the vSRX VM, the IDs are saved in boot/loader.conf

and read during initialization.

The IDP feature is subscription based and must be purchased.

After purchase, you can activate the IDP feature with the license key.

For SRX Series IDP configuration details, see:

Understanding Intrusion Detection and Prevention for SRX

Series

In J-Web, use the following steps to add or edit an IPS rule:

Click Security -> IDP -> Policy -> Add .

2. In the Add IPS Rule window, select All instead of Any for the field Direction to list all the FTP attacks.

ISSU is not supported on vSRX for all VPN and non-VPN features.

Transparent mode

UTM

The known behaviors for transparent mode support on vSRX are:

• The default MAC learning table size is restricted to 16,383 entries.

• VMware vSwitch does not support MAC learning. It also floods traffic to the secondary node. The traffic is silently dropped by the flow on the secondary node.

For information on configuring transparent mode vSRX, see:

Layer 2 Bridging and Transparent Mode Overview

The UTM feature is subscription based and must be purchased.

After purchase, you can activate the UTM feature with the license key.

For SRX Series UTM configuration details, see:

Unified Threat Management Overview

For SRX Series UTM Antispam configuration details, see:

Antispam Filtering Overview

CHAPTER 5

Index

•

Index on page 51

vSRX on Contrail Quick Start Guide

Index

Symbols

#, comments in configuration statements.....................

( ), in syntax descriptions.......................................................

< >, in syntax descriptions.....................................................

[ ], in configuration statements...........................................

{ }, in configuration statements..........................................

| (pipe), in syntax descriptions............................................

B

braces, in configuration statements..................................

brackets

angle, in syntax descriptions........................................

xi square, in configuration statements.........................

C

comments, in configuration statements.........................

Contrail

adding service policy to virtual networks.............

creating a service instance.........................................

creating a service policy..............................................

creating service chain...................................................

creating service template...........................................

creating virtual networks.............................................

monitoring vSRX............................................................

understanding..................................................................

uploading vSRX...............................................................

vSRX console...................................................................

conventions

text and syntax...................................................................

curly braces, in configuration statements.......................

customer support....................................................................

xii contacting JTAC...............................................................

xii

D

documentation

comments on....................................................................

F

factory default settings.........................................................

feature considerations..........................................................

features not supported on vSRX.......................................

font conventions........................................................................

H

host OS........................................................................................

M

manuals

comments on....................................................................

N

nova

creating image flavor.....................................................

O

OpenStack

creating image flavor...............................................

17 ,

understanding..................................................................

uploading vSRX...............................................................

vSRX console...................................................................

P

parentheses, in syntax descriptions..................................

R

RAM maximum..........................................................................

S

Specifications vSRX....................................................................................

support, technical See technical support

syntax conventions...................................................................

T

technical support contacting JTAC...............................................................

xii

V

vCPUs maximum..........................................................................

vNICs maximum..........................................................................

vSRX creating image flavor......................................................

creating service chain...................................................

hardware requirements................................................

installing with Glance...................................................

installing with Horizon.................................................

management console..................................................

monitoring with Contrail..............................................

vSRX on Contrail Quick Start Guide

RAM.....................................................................................

37 specifications...................................................................

uploading...........................................................................

vCPUs..................................................................................

vNICs...................................................................................

vSRX on Contrail Quick Start Guide

Table of Contents

List of Figures

List of Tables

About the Documentation

Documentation and Release Notes

Documentation Conventions

Table 1: Notice Icons

Table 2: Text and Syntax Conventions

Table 2: Text and Syntax Conventions (continued)

Documentation Feedback

Requesting Technical Support

Self-Help Online Tools and Resources

Opening a Case with JTAC

CHAPTER 1

Installing vSRX vSRX with Contrail

Enabling Nested Virtualization

Creating an Image Flavor with OpenStack

Creating an Image Flavor for vSRX with Horizon

Figure 1: OpenStack Flavors

Figure 2: Create a Flavor

Creating an Image Flavor for vSRX with the Nova CLI

Table 3: nova flavor-create Command

Uploading the vSRX Image

Uploading the vSRX Image with OpenStack Horizon

Figure 3: OpenStack Images

Figure 4: Create an Image

Upload the vSRX Image with the OpenStack Glance CLI

CHAPTER 2

Configuring vSRX Service Chains in

Contrail

Overview of Service Chains with vSRX

Understanding Service Chains

Figure 5: vSRX Service Chaining

Service Chain Modes

Components of a Service Chain

Spawning vSRX in a Contrail Service Chain

Creating a Service Template

Figure 6: Contrail Service Templates

Figure 7: Contrail Add a Service Template

Figure 8: Advanced Options - Add Service Template

Creating Left and Right Virtual Networks

Figure 9: Creating a Virtual Network in Contrail

Creating a vSRX Service Instance

Creating a Network Policy

Figure 10: Creating a Network Policy in Contrail

Adding a Network Policy to a Virtual Network

Figure 11: Contrail Virtual Networks

Figure 12: Adding a Network Policy to a Virtual Network in Contrail

CHAPTER 3

Managing vSRX Instances

Connecting to the vSRX Management Console

Connecting to the vSRX Management Console with Horizon

Connecting to the vSRX Management Console with Contrail

Managing the vSRX VM

Powering On the VM

Pausing the VM

Restarting the VM

Powering Off the VM

Deleting the vSRX VM from Contrail

Monitoring vSRX with Contrail

CHAPTER 4

vSRX Features and Requirements

System Requirements for vSRX on Contrail

Software Environment Requirements

Table 4: Specifications for vSRX

Table 4: Specifications for vSRX (continued)

Table 5: Contrail Recommendations

Hardware Recommendations

Table 6: Hardware Specifications for the Host Machine

Best Practices Recommendations

Interface Naming and Mapping

Table 7: Interface Names for a Standalone vSRX

Table 7: Interface Names for a Standalone vSRX (continued)

Table 8: Interface Names for a vSRX Cluster Pair

vSRX Factory Default Settings

Table 9: Factory Default Settings for Security Policies

SRX Series Features Not Supported on vSRX

Table 10: SRX Series Features Not Supported on vSRX

Table 10: SRX Series Features Not Supported on vSRX (continued)