Juniper Networks vSRX virtual security appliance Administration guide

PDF

Dokument

vSRX Administration Guide for VMware

Release

15.1X49

Modified: 2015-11-06

Juniper Networks, Inc.

1133 Innovation Way

Sunnyvale, California 94089

USA

408-745-2000 www.juniper.net

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United

States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

vSRX Administration Guide for VMware

15.1X49

The information in this document is current as of the date on the title page.

YEAR 2000 NOTICE

Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.

END USER LICENSE AGREEMENT

The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.juniper.net/support/eula.html

. By downloading, installing or using such software, you agree to the terms and conditions of that EULA.

Chapter 1

Chapter 2

Chapter 3

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Supported Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Documentation Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Requesting Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Opening a Case with JTAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Understanding vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Understanding vSRX with VMware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Interface Naming and Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Configuring vSRX Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring and Deploying vSRX Instances Using Junos Space Virtual

Director . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring vSRX Using the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Configuring vSRX Using the J-Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Accessing the J-Web Interface and Configuring vSRX . . . . . . . . . . . . . . . . . . . 27

Applying the Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Chassis Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Configuring a vSRX Chassis Cluster in Junos OS . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Chassis Cluster Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Enabling Chassis Cluster Formation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Chassis Cluster Quick Setup with J-Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Manually Configuring a Chassis Cluster with J-Web . . . . . . . . . . . . . . . . . . . . 34

vSRX Cluster Staging and Provisioning for VMware . . . . . . . . . . . . . . . . . . . . . . . . 40

Deploying the VMs and Additional Network Interfaces . . . . . . . . . . . . . . . . . 40

Creating the Control Link Connection Using VMware . . . . . . . . . . . . . . . . . . . 40

Creating the Fabric Link Connection Using VMware . . . . . . . . . . . . . . . . . . . . 43

Creating the Data Interfaces Using VMware . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Prestaging the Configuration from the Console . . . . . . . . . . . . . . . . . . . . . . . . 47

Connecting and Installing the Staging Configuration . . . . . . . . . . . . . . . . . . . 47

Deploying vSRX Chassis Cluster Nodes at Different ESXi Hosts Using dvSwitch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

iii

vSRX Administration Guide for VMware

Chapter 4

Chapter 5

Managing vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Monitoring and Managing vSRX Instances Using Junos Space Virtual Director . . . 51

Viewing Connection Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Discover Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Managing Security Policies for Virtual Machines Using Junos Space Security

Director . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

List of Figures

Chapter 2

Chapter 3

Configuring vSRX Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Figure 1: J-Web Setup Wizard Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Figure 2: J-Web Configuration Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Configuring Chassis Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Figure 3: Promiscuous Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Figure 4: Control vSwitch Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Figure 5: Virtual Machine Properties for the Control vSwitch . . . . . . . . . . . . . . . . . 43

Figure 6: Control Interface Connected through the Control vSwitch . . . . . . . . . . . 43

Figure 7: Fabric vSwitch Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Figure 8: Virtual Machine Properties for the Fabric vSwitch . . . . . . . . . . . . . . . . . . 45

Figure 9: Fabric Interface Connected Through the Fabric vSwitch . . . . . . . . . . . . 46

Figure 10: dvPortGroup3 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Figure 11: dvPortGroup6 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

List of Tables

Chapter 1

Chapter 2

Chapter 3

About the Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Table 1: Notice Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Table 2: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Table 3: SRX Series Features Not Supported on vSRX . . . . . . . . . . . . . . . . . . . . . . 16

Table 4: vSRX Feature Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Table 5: Interface Names for a Standalone vSRX . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Table 6: Interface Names for a vSRX Cluster Pair . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Configuring vSRX Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Table 7: Device Name and User Account Information . . . . . . . . . . . . . . . . . . . . . . 29

Table 8: System Time Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Configuring Chassis Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Table 9: Chassis Cluster Configuration Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Table 10: Edit Node Setting Configuration Details . . . . . . . . . . . . . . . . . . . . . . . . . 36

Table 11: Add HA Cluster Interface Configuration Details . . . . . . . . . . . . . . . . . . . . 37

Table 12: Add Redundancy Groups Configuration Details . . . . . . . . . . . . . . . . . . . 38

Table 13: Hardware Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

vii

About the Documentation

•

Documentation and Release Notes on page ix

•

Supported Platforms on page ix

•

Documentation Conventions on page ix

•

Documentation Feedback on page xi

•

Requesting Technical Support on page xii

Documentation and Release Notes

To obtain the most current version of all Juniper Networks

® technical documentation, see the product documentation page on the Juniper Networks website at http://www.juniper.net/techpubs/ .

If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes.

Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at http://www.juniper.net/books .

Supported Platforms

For the features described in this document, the following platforms are supported:

• vSRX

Documentation Conventions

Table 1 on page x

defines notice icons used in this guide.

vSRX Administration Guide for VMware

Table 1: Notice Icons

Icon Meaning

Informational note

Caution

Warning

Laser warning

Tip

Best practice

Description

Indicates important features or instructions.

Indicates a situation that might result in loss of data or hardware damage.

Alerts you to the risk of personal injury or death.

Alerts you to the risk of personal injury from a laser.

Indicates helpful information.

Alerts you to a recommended use or implementation.

Table 2 on page x

defines the text and syntax conventions used in this guide.

Table 2: Text and Syntax Conventions

Convention Description Examples

Bold text like this

Fixed-width text like this

Italic text like this

Represents text that you type.

To enter configuration mode, type the configure command: user@host> configure

Represents output that appears on the terminal screen.

user@host> show chassis alarms

No alarms currently active

• Introduces or emphasizes important new terms.

•

Identifies guide names.

Identifies RFC and Internet draft titles.

•

A policy term is a named structure that defines match conditions and actions.

Junos OS CLI User Guide

RFC 1997, BGP Communities Attribute

Represents variables (options for which you substitute a value) in commands or configuration statements.

Configure the machine’s domain name:

[edit] root@# set system domain-name

domain-name

About the Documentation

Table 2: Text and Syntax Conventions (continued)

Convention Description

Text like this

< > (angle brackets)

| (pipe symbol)

Examples

Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components.

•

To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level.

The console port is labeled CONSOLE .

Encloses optional keywords or variables.

stub <default-metric metric>;

Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity.

broadcast | multicast

(string1 | string2 | string3)

# (pound sign)

[ ] (square brackets)

Indention and braces ( { } )

; (semicolon)

Indicates a comment specified on the same line as the configuration statement to which it applies.

rsvp { # Required for dynamic MPLS only

Encloses a variable for which you can substitute one or more values.

Identifies a level in the configuration hierarchy.

Identifies a leaf statement at a configuration hierarchy level.

community name members [

community-ids ]

[edit] routing-options { static { route default { nexthop address; retain;

}

GUI Conventions

Bold text like this

> (bold right angle bracket)

Represents graphical user interface (GUI) items you click or select.

•

In the Logical Interfaces box, select

All Interfaces .

To cancel the configuration, click

Cancel

Separates levels in a hierarchy of menu selections.

In the configuration editor hierarchy, select Protocols>Ospf.

Documentation Feedback

We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods:

• Online feedback rating system—On any page at the Juniper Networks Technical

Documentation site at http://www.juniper.net/techpubs/index.html

, simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at http://www.juniper.net/techpubs/feedback/ .

vSRX Administration Guide for VMware

•

E-mail—Send your comments to [email protected]. Include the document or topic name, URL or page number, and software version (if applicable).

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance

Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf

•

Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/ .

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day,

7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

•

Find CSC offerings: http://www.juniper.net/customers/support/

• Search for known bugs: http://www2.juniper.net/kb/

• Find product documentation: http://www.juniper.net/techpubs/

• Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/

• Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: http://kb.juniper.net/InfoCenter/

•

Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/

•

Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/

To verify service entitlement by product serial number, use our Serial Number Entitlement

(SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/

Opening a Case with JTAC

You can open a case with JTAC on the Web or by telephone.

•

Use the Case Management tool in the CSC at http://www.juniper.net/cm/

•

Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

About the Documentation

For international or direct-dial options in countries without toll-free numbers, see http://www.juniper.net/support/requesting-support.html

xiii

CHAPTER 1

Overview

•

Understanding vSRX on page 15

•

Understanding vSRX with VMware on page 15

•

SRX Series Features Not Supported on vSRX on page 16

•

vSRX Feature Considerations on page 21

•

Interface Naming and Mapping on page 22

Understanding vSRX

vSRX is a virtual security appliance that provides security and networking services at the perimeter or edge in virtualized private or public cloud environments. vSRX runs as a virtual machine (VM) on a standard x86 server.

vSRX enables advanced security and routing at the network edge in a multitenant virtualized environment. vSRX is built on Junos OS and delivers networking and security features similar to those available on SRX Series Services Gateways for the branch.

Some of the key benefits of vSRX in virtualized private or public cloud multitenant environments include:

•

Stateful firewall protection at the tenant edge

•

Faster deployment of virtual firewalls

• Full routing, VPN, and networking capabilities

• Centralized and local management

NOTE: vSRX supports SCSI-based or IDE-based disk images.

Understanding vSRX with VMware

VMware vSphere is a virtualization environment for systems supporting the x86 architecture. VMware ESXi

® is the hypervisor used to create and run virtual machines

(VMs) and virtual appliances on a host machine. The VMware vCenter Server

® is a service that manages the resources of multiple ESXi hosts.

vSRX Administration Guide for VMware

The VMware vSphere Web Client is used to deploy the vSRX VM.

Documentation

•

Understanding vSRX on page 15

SRX Series Features Not Supported on vSRX

vSRX inherits many features from the SRX Series product line.

Table 3 on page 16

lists

SRX features that are not applicable in a virtualized environment, that are not currently supported, or that have qualified support on vSRX.

Table 3: SRX Series Features Not Supported on vSRX

SRX Series Feature vSRX Notes

Application Layer Gateways

Avaya H.323

Not supported

Authentication with IC Series Devices

Layer 2 enforcement in UAC deployments

Not supported

NOTE: UAC-IDP and UAC-UTM also are not supported.

Chassis Cluster Support

Chassis cluster for VirtIO driver

Only supported with KVM

NOTE: The link status of VirtIO interfaces is always reported as

UP, so a vSRX chassis cluster cannot receive link up and link down messages from VirtIO interfaces.

Not supported

Dual control links

In-band and low-impact cluster upgrades

LAG and LACP (Layer 2 and

Layer 3)

Not supported

Layer 2 Ethernet switching Not supported

Low-latency firewall Not supported

PPPoE over redundant

Ethernet interface

Not supported

Chapter 1: Overview

Table 3: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

SR-IOV interfaces Not supported (see the Known

Behavior section of the

vSRX

Release Notes

for more information about SR-IOV limitations).

Class of Service

High-priority queue on SPC Not supported

Tunnels Only GRE and IP-IP tunnels supported

Data Plane Security Log Messages (Stream Mode)

TLS protocol

Diagnostics Tools

Not supported

Flow monitoring cflowd version 9

Ping Ethernet (CFM)

Not supported

Traceroute Ethernet (CFM) Not supported

DNS Proxy

Dynamic DNS Not supported

Ethernet Link Aggregation

LACP in standalone or chassis cluster mode

Not supported

Layer 3 LAG on routed ports Not supported

Static LAG in standalone or chassis cluster mode

Not supported

Ethernet Link Fault Management

Physical interface (encapsulations)

Not supported ethernet-ccc ethernet-tcc extended-vlan-ccc extended-vlan-tcc

Not supported

Interface family ccc, tcc Not supported

vSRX Administration Guide for VMware

Table 3: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes ethernet-switching Not supported

Flow-Based and Packet-Based Processing

End-to-end packet debugging

Not supported

Network processor bundling Not supported

Services offloading Not supported

Interfaces

Aggregated Ethernet interface

PPP interface

PPPoE-based radio-to-router protocol

PPPoE interface

Promiscuous mode on interfaces

Not supported

IEEE 802.1X dynamic VLAN assignment

Not supported

IEEE 802.1X MAC bypass Not supported

IEEE 802.1X port-based authentication control with multisupplicant support

Not supported

Interleaving using MLFR

PoE

Not supported

Only supported if enabled on the hypervisor

IP Security and VPNs

Acadia - Clientless VPN

Auto Discovery VPN

DVPN

Group VPN

Not supported

Chapter 1: Overview

Table 3: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Hardware IPsec (bulk crypto) Cavium/RMI

Not supported

IPsec tunnel termination in routing instances

Supported on virtual router only

Multicast for AutoVPN Not supported

Suite B implementation for

IPsec VPN

Not supported

IPv6 Support

DS-Lite concentrator (aka

AFTR)

DS-Lite initiator (aka B4)

Not supported

J-Web

Enhanced routing configuration

Not supported

New Setup Wizard (for new configurations)

Not supported

PPPoE Wizard

Remote VPN Wizard

Not supported

Rescue link on dashboard Not supported

UTM configuration for

Kaspersky anti-virus and the default web filter profile.

Not supported

Log File Formats for System (Control Plane) Logs

Binary format (binary)

WELF

Miscellaneous

GPRS

Hardware acceleration

Logical systems

Remote device access

Not supported

vSRX Administration Guide for VMware

Table 3: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

USB modem

Wireless LAN

Not supported

MPLS

CCC and TCC

Flow monitoring jflow version 9

Layer 2 VPNs for Ethernet connections

Network Address Translation

Maximize persistent NAT bindings

Packet Capture

Packet capture

Not supported

Only if promiscuous mode is enabled on the hypervisor

Not supported

Only supported on physical interfaces and tunnel interfaces, such as gr, ip, and st0. Packet capture is not supported on redundant Ethernet interfaces

(reth).

Routing

BGP Flowspec

BGP Route Reflector

CRTP

Security Policy Support

User role firewall

Switching

Layer 3 Q-in-Q VLAN

Tagging

Transparent Mode

UTM

Unified Threat Management

Express AV

Kaspersky AV

Not supported

Chapter 1: Overview

Table 3: SRX Series Features Not Supported on vSRX (continued)

SRX Series Feature vSRX Notes

Upgrading and Rebooting

Autorecovery

Boot device configuration

Boot device recovery

Dual-root partitioning

User Interfaces

Not supported

NSM Not supported

SRC application Not supported

Junos Space Virtual Director Only supported with VMware

Documentation

•

Understanding vSRX

vSRX Feature Considerations

vSRX inherits most of the branch SRX Series features with the following considerations shown in

Table 4 on page 21

Table 4: vSRX Feature Considerations

Feature Description

Chassis cluster

IDP

ISSU

Generally, on SRX Series devices, the cluster ID and node ID are written into EEPROM. For the vSRX VM, the IDs are saved in boot/loader.conf

and read during initialization.

The IDP feature is subscription based and must be purchased.

After purchase, you can activate the IDP feature with the license key.

For SRX Series IDP configuration details, see:

Understanding Intrusion Detection and Prevention for SRX

Series

In J-Web, use the following steps to add or edit an IPS rule:

Click Security -> IDP -> Policy -> Add .

2. In the Add IPS Rule window, select

All instead of

Any for the field Direction to list all the FTP attacks.

ISSU is not supported on vSRX for all VPN and non-VPN features.

vSRX Administration Guide for VMware

Table 4: vSRX Feature Considerations (continued)

Feature Description

Transparent mode

UTM

The known behaviors for transparent mode support on vSRX are:

• The default MAC learning table size is restricted to 16,383 entries.

• VMware vSwitch does not support MAC learning. It also floods traffic to the secondary node. The traffic is silently dropped by the flow on the secondary node.

For information on configuring transparent mode vSRX, see:

Layer 2 Bridging and Transparent Mode Overview

The UTM feature is subscription based and must be purchased.

After purchase, you can activate the UTM feature with the license key.

For SRX Series UTM configuration details, see:

Unified Threat Management Overview

For SRX Series UTM Antispam configuration details, see:

Antispam Filtering Overview

Documentation

• Understanding vSRX

Interface Naming and Mapping

Each network adapter defined for a vSRX is mapped to a specific interface, depending on whether the vSRX instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX have changed since the previous release (called Firefly Perimeter), as shown in the following tables. Note the following changes:

•

In standalone mode:

• fxp0 is the out-of-band management interface

• ge-0/0/0 is the first traffic (revenue) interface

• In cluster mode:

• fxp0 is the out-of-band management interface

• em0 is the cluster control link for both nodes

• Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 5 on page 23

shows the interface names and mappings for a standalone vSRX.

Chapter 1: Overview

Table 5: Interface Names for a Standalone vSRX

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX fxp0 ge-0/0/0 ge-0/0/1 ge-0/0/2 ge-0/0/3 ge-0/0/4 ge-0/0/5 ge-0/0/6 ge-0/0/7 ge-0/0/8

Table 6 on page 23

shows the interface names and mappings for a pair of vSRX VMs in a cluster (node 0 and node 1).

Table 6: Interface Names for a vSRX Cluster Pair

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX

4 fxp0 (node 0 and 1) em0 (node 0 and 1) ge-0/0/0 (node 0) ge-7/0/0 (node 1) ge-0/0/1 (node 0) ge-7/0/1 (node 1)

7 ge-0/0/2 (node 0) ge-7/0/2 (node 1) ge-0/0/3 (node 0) ge-7/0/3 (node 1) ge-0/0/4 (node 0) ge-7/0/4 (node 1)

vSRX Administration Guide for VMware

Table 6: Interface Names for a vSRX Cluster Pair (continued)

Network

Adapter Interface Name in Junos OS 15.1X49 for vSRX

10 ge-0/0/5 (node 0) ge-7/0/5 (node 1) ge-0/0/6 (node 0) ge-7/0/6 (node 1) ge-0/0/7 (node 0) ge-7/0/7 (node 1)

CHAPTER 2

Configuring vSRX Basics

•

Configuring and Deploying vSRX Instances Using Junos Space Virtual

Director on page 25

•

Configuring vSRX Using the CLI on page 25

•

Configuring vSRX Using the J-Web Interface on page 26

Configuring and Deploying vSRX Instances Using Junos Space Virtual Director

Junos Space Virtual Director offers a provision template that allows you to configure vSRX instances for individual or batch replicated deployment. The provision template defines all the parameters that a VM requires to execute an instance of vSRX. The template also includes the information about VM parameters such as number of CPUs, memory size, disk space, number of NICs, network addresses, and a minimal amount of device startup configuration information.

NOTE: You can also configure vSRX using other management tools like

J-Web, the CLI, and so on.

Documentation

•

Junos Space Virtual Director Getting Started Guide

•

Understanding vSRX on page 15

Configuring vSRX Using the CLI

To configure vSRX using the CLI:

Verify that the device is powered on.

Start the CLI.

root#cli root@>

Enter configuration mode.

configure

[edit]

vSRX Administration Guide for VMware root@#

Set the root authentication password by entering a cleartext password, an encrypted password, or an SSH public key string (DSA or RSA).

[edit] root@# set system root-authentication plain-text-password

New password: password

Retype new password: password

Configure the hostname.

[edit] root@# set system host-name host-name

Configure the management interface.

[edit] root@# set interfaces fxp0 unit 0 family inet dhcp

Configure the traffic interfaces.

[edit] root@# set interfaces ge-0/0/0 unit 0 family inet dhcp

Configure basic security zones and bind them to traffic interfaces.

[edit] root@# set security zones security-zone trust interfaces ge-0/0/0.0

10.

Verify the configuration.

[edit] root@# commit check configuration check succeeds

11.

Commit the configuration to activate it on the device.

[edit] root@# commit commit complete

12.

Optionally, use the show command to display the configuration to verify that it is correct.

Documentation

•

Getting Started Guide for Branch SRX Series

•

Configuring vSRX Using the J-Web Interface on page 26

Configuring vSRX Using the J-Web Interface

•

Accessing the J-Web Interface and Configuring vSRX on page 27

•

Applying the Configuration on page 30

Chapter 2: Configuring vSRX Basics

Accessing the J-Web Interface and Configuring vSRX

Use the vSRX Junos OS CLI to configure at least the following parameters before you can access the vSRX using J-Web:

•

Configure an IP address on fxp0.

• Configure a default route if the fxp0 IP address is on a different subnet than the host server.

•

Enable web management through the fxp0 interface.

system { services { web-management { http { interface fxp0.0;

}

To configure vSRX using the J-Web Interface:

Launch a Web browser from the management device.

Enter the vSRX interface IP address in the Address box.

Specify the username and password.

Click Log In, and select the Configuration Wizards tab from the left navigation panel.

The J-Web Setup wizard page opens. See

Figure 1 on page 27 .

Figure 1: J-Web Setup Wizard Page

Click Setup.

You can use the Setup wizard to configure a device or edit an existing configuration.

•

Select Edit Existing Configuration if you have already configured the wizard using the factory mode.

• Select Create New Configuration to configure a device using the wizard. See

Figure 2 on page 28 .

vSRX Administration Guide for VMware

Figure 2: J-Web Configuration Page

The following configuration options are available in the guided setup:

•

Basic

Chapter 2: Configuring vSRX Basics

Select basic to configure the device name and user account information as shown in

Table 7 on page 29

•

Device name and user account information

Table 7: Device Name and User Account Information

Field Description

Device name

Root password

Verify password

Type the name of the device. For example: vSRX .

Create a default root user password.

Verify the default root user password.

Operator Add an optional administrative account in addition to the root account.

User role options include:

•

Super User : This user has full system administration rights and can add, modify, and delete settings and users.

Operator

: This user can perform system operations such as a system reset but cannot change the configuration or add or modify users.

Read only : This user can only access the system and view the configuration.

Disabled

: This user cannot access the system.

•

Select either Time Server or Manual.

Table 8 on page 29

lists the system time options.

Table 8: System Time Options

Field Description

Time Server

Host Name Type the hostname of the time server. For example: us.ntp.pool.org

IP Type the IP address of the time server in the IP address entry field. For example: 1 92.168.1.254

NOTE: You can enter either the hostname or the IP address.

Manual

Date

Time

Time Zone (mandatory)

Time Zone

Click the current date in the calendar.

Set the hour, minute, and seconds. Choose AM or PM .

Select the time zone from the list. For example: GMT Greenwich

Mean Time GMT.

vSRX Administration Guide for VMware

•

Expert

Select Expert to configure the basic options as well as the following advanced options:

• Four or more internal zones

•

Internal zone services

•

Application of security policies between internal zones

Click the Need Help icon for detailed configuration information.

You see a success message after the basic configuration is complete.

Applying the Configuration

To apply the configuration settings for vSRX:

Review and ensure that the configuration settings are correct, and click Next. The

Commit Configuration page appears.

Click Apply Settings to apply the configuration changes to vSRX.

Check the connectivity to vSRX, as you might lose connectivity if you have changed the management zone IP. Click the URL for reconnection instructions on how to reconnect to the device.

Click Done to complete the setup.

After successful completion of the setup, you are redirected to the J-Web interface.

CAUTION: After you complete the initial setup, you can relaunch the J-Web

Setup wizard by clicking Configuration>Setup. You can either edit an existing configuration or create a new configuration. If you create a new configuration, the current configuration in vSRX will be deleted.

Documentation

•

Configuring vSRX Using the CLI on page 25

CHAPTER 3

Configuring Chassis Clusters

•

Configuring a vSRX Chassis Cluster in Junos OS on page 31

•

vSRX Cluster Staging and Provisioning for VMware on page 40

•

Deploying vSRX Chassis Cluster Nodes at Different ESXi Hosts Using dvSwitch on page 48

Configuring a vSRX Chassis Cluster in Junos OS

•

Chassis Cluster Overview on page 31

•

Enabling Chassis Cluster Formation on page 32

•

Chassis Cluster Quick Setup with J-Web on page 33

•

Manually Configuring a Chassis Cluster with J-Web on page 34

Chassis Cluster Overview

Chassis cluster groups a pair of the same kind of vSRX instances into a cluster to provide network node redundancy. The devices must be running the same Junos OS release. You connect the control virtual interfaces on the respective nodes to form a control plane that synchronizes the configuration and Junos OS kernel state. The control link (a virtual network or vSwitch) facilitates the redundancy of interfaces and services. Similarly, you connect the data plane on the respective nodes over the fabric virtual interfaces to form a unified data plane. The fabric link (a virtual network or vSwitch) allows for the management of cross-node flow processing and for the management of session redundancy.

The control plane software operates in active/passive mode. When configured as a chassis cluster, one node acts as the primary device and the other as the secondary device to ensure stateful failover of processes and services in the event of a system or hardware failure on the primary device. If the primary device fails, the secondary device takes over processing of control plane traffic.

NOTE: If you configure a chassis cluster across two hosts, disable igmp-snooping on the bridge that each host physical interface belongs to that the control vNICs use. This ensures that the control link heartbeat is received by both nodes in the chassis cluster.

vSRX Administration Guide for VMware

The chassis cluster data plane operates in active/active mode. In a chassis cluster, the data plane updates session information as traffic traverses either device, and it transmits information between the nodes over the fabric link to guarantee that established sessions are not dropped when a failover occurs. In active/active mode, traffic can enter the cluster on one node and exit from the other node.

Chassis cluster functionality includes:

• Resilient system architecture, with a single active control plane for the entire cluster and multiple Packet Forwarding Engines. This architecture presents a single device view of the cluster.

• Synchronization of configuration and dynamic runtime states between nodes within a cluster.

•

Monitoring of physical interfaces, and failover if the failure parameters cross a configured threshold.

• Support for generic routing encapsulation (GRE) and IP-over-IP (IP-IP) tunnels used to route encapsulated IPv4 or IPv6 traffic by means of two internal interfaces, gr-0/0/0 and ip-0/0/0, respectively. Junos OS creates these interfaces at system startup and uses these interfaces only for processing GRE and IP-IP tunnels.

At any given instant, a cluster node can be in one of the following states: hold, primary, secondary-hold, secondary, ineligible, or disabled. Multiple event types, such as interface monitoring, Services Processing Unit (SPU) monitoring, failures, and manual failovers, can trigger a state transition.

Prerequisites

Ensure that your vSRX instances comply with the following prerequisites before you enable chassis clustering:

• Use show version in Junos OS to ensure that both vSRX instances have the same software version.

•

Use show system license in Junos OS to ensure that both vSRX instances have the same licenses installed.

Enabling Chassis Cluster Formation

You create two vSRX instances to form a chassis cluster, and then you set the cluster ID and node ID on each instance to join the cluster. When a vSRX VM joins a cluster, it becomes a node of that cluster. With the exception of unique node settings and management IP addresses, nodes in a cluster share the same configuration.

You can deploy up to 255 chassis clusters in a Layer 2 domain. Clusters and nodes are identified in the following ways:

• The cluster ID (a number from 1 to 255) identifies the cluster.

•

The node ID (a number from 0 to 1) identifies the cluster node.

Chapter 3: Configuring Chassis Clusters

Generally, on SRX Series devices, the cluster ID and node ID are written into EEPROM.

On the vSRX VM, vSRX stores and reads the IDs from boot/loader.conf and uses the IDs to initialize the chassis cluster during startup.

The chassis cluster formation commands for node 0 and node 1 are as follows:

•

On vSRX node 0: user@vsrx0>set chassis cluster cluster-id number node 0 reboot

•

On vSRX node 1: user@vsrx1>set chassis cluster cluster-id number node 1 reboot

NOTE: Use the same cluster ID number for each node in the cluster.

NOTE: The vSRX interface naming and mapping to vNICs changes when you enable chassis clustering.

•

After reboot, on node 0, configure the fabric (data) ports of the cluster that are used to pass real-time objects (RTOs): user@vsrx1>set interfaces fab0 fabric-options member-interfaces ge-0/0/0 user@vsrx1>set interfaces fab1 fabric-options member-interfaces ge-7/0/0

Chassis Cluster Quick Setup with J-Web

To configure chassis cluster from J-Web:

Enter the vSRX node 0 interface IP address in a Web browser.

Enter the vSRX username and password, and click Log In. The J-Web dashboard appears.

Click Configuration Wizards>Chassis Cluster from the left panel. The Chassis Cluster

Setup wizard appears. Follow the steps in the setup wizard to configure the cluster

ID and the two nodes in the cluster, and to verify connectivity.

NOTE: Use the built-in Help icon in J-Web for further details on the Chassis

Cluster Setup wizard.

vSRX Administration Guide for VMware

Manually Configuring a Chassis Cluster with J-Web

You can use the J-Web interface to configure the primary node 0 vSRX device in the cluster. Once you have set the cluster and node IDs and rebooted each vSRX, the following configuration will automatically be synced to the secondary node 1 vSRX device.

Select Configure>Chassis Cluster>Cluster Configuration. The Chassis Cluster configuration page appears.

Table 9 on page 35

explains the contents of the HA Cluster Settings tab.

Table 10 on page 36

explains how to edit the Node Settings tab.

Table 11 on page 37

explains how to add or edit the HA Cluster Interfaces table.

Table 12 on page 38

explains how to add or edit the HA Cluster Redundancy Groups table.

Chapter 3: Configuring Chassis Clusters

Table 9: Chassis Cluster Configuration Page

Field Function

Node Settings

Node ID

Cluster ID

Displays the node ID.

Displays the cluster ID configured for the node.

Host Name

Backup Router

Displays the name of the node.

Displays the router used as a gateway while the Routing Engine is in secondary state for redundancy-group 0 in a chassis cluster.

Management Interface

IP Address

Displays the management interface of the node.

Displays the management IP address of the node.

Status Displays the state of the redundancy group.

•

Primary

–Redundancy group is active.

Secondary –Redundancy group is passive.

Chassis Cluster>HA Cluster Settings>Interfaces

Name Displays the physical interface name.

Member Interfaces/IP

Address

Redundancy Group

Displays the member interface name or IP address configured for an interface.

Displays the redundancy group.

Chassis Cluster>HA Cluster Settings>Redundancy Group

Group Displays the redundancy group identification number.

Preempt

Gratuitous ARP Count

Node Priority

Displays the selected preempt option.

•

True

–Mastership can be preempted based on priority.

False –Mastership cannot be preempted based on priority.

Displays the number of gratuitous ARP requests that a newly elected primary device in a chassis cluster sends out to announce its presence to the other network devices.

Displays the assigned priority for the redundancy group on that node. The eligible node with the highest priority is elected as primary for the redundant group.

vSRX Administration Guide for VMware

Table 10: Edit Node Setting Configuration Details

Field Function Action

Node Settings

Host Name

Backup Router

Specifies the name of the host.

Displays the router used as a gateway while the Routing Engine is in the secondary state for redundancy-group 0 in a chassis cluster.

Enter the name of the host.

Enter the IP address of the backup router.

Destination

Delete

Interface

Add

Delete

Adds the destination address.

Deletes the destination address.

Click

Add

Click Delete .

Specifies the interfaces available for the router.

Select an option.

NOTE: Allows you to add and edit two interfaces for each fabric link.

Specifies the interface IP address.

Enter the interface IP address.

Adds the interface.

Deletes the interface.

Click

Add

Click Delete .

Chapter 3: Configuring Chassis Clusters

Table 11: Add HA Cluster Interface Configuration Details

Field Function Action

Fabric Link > Fabric Link 0 (fab0)

Interface Specifies fabric link 0.

Add

Delete

Adds fabric interface 0.

Deletes fabric interface 0.

Enter the interface IP fabric link

Click

Add

Click

Delete

Fabric Link > Fabric Link 1 (fab1)

Interface Specifies fabric link 1.

Add

Delete

Adds fabric interface 1.

Deletes fabric interface 1.

Enter the interface IP for fabric link 1.

Click

Add

Click

Delete

Redundant Ethernet

Interface Specifies a logical interface consisting of two physical Ethernet interfaces, one on each chassis.

Enter the logical interface.

IP Specifies redundant Ethernet IP address.

Enter redundant Ethernet IP address.

Redundancy Group Specifies redundancy group ID number in the chassis cluster.

Select a redundancy group from the list.

Adds redundant Ethernet IP address.

Click Add .

Add

Delete Deletes redundant Ethernet IP address.

Click

Delete

vSRX Administration Guide for VMware

Table 12: Add Redundancy Groups Configuration Details

Field Function Action

Redundancy Group

Allow preemption of primaryship

Specifies the redundancy group name.

Enter the redundancy group name.

Allows a node with a better priority to initiate a failover for a redundancy group.

NOTE: By default, this feature is disabled. When disabled, a node with a better priority does not initiate a redundancy group failover (unless some other factor, such as faulty network connectivity identified for monitored interfaces, causes a failover).

Gratuitous ARP Count Specifies the number of gratuitous Address Resolution Protocol requests that a newly elected primary sends out on the active redundant Ethernet interface child links to notify network devices of a change in mastership on the redundant Ethernet interface links.

Enter a value from 1 to 16. The default is 4.

node0 priority node1 priority

Specifies the priority value of node0 for a redundancy group.

Enter the node priority number as 0.

Specifies the priority value of node1 for a redundancy group.

Select the node priority number as

Interface Monitor

Interface

Weight

Add

Delete

Specifies the number of redundant Ethernet interfaces to be created for the cluster.

Specifies the weight for the interface to be monitored.

Select the interface from the list.

Deletes interfaces to be monitored by the redundancy group along with their respective weights.

Enter a value from 1 to 125.

Adds interfaces to be monitored by the redundancy group along with their respective weights.

Click

Add

Select the interface from the configured list and click

Delete

IP Monitoring

Weight

Threshold

Specifies the global weight for IP monitoring.

Specifies the global threshold for IP monitoring.

Enter a value from 0 to 255.

Retry Count Specifies the number of retries needed to declare reachability failure.

Enter a value from 5 to 15.

Enter a value from 1 to 30.

Retry Interval Specifies the time interval in seconds between retries.

IPV4 Addresses to be monitored

IP Specifies the IPv4 addresses to be monitored for reachability.

Enter the IPv4 addresses.

Chapter 3: Configuring Chassis Clusters

Table 12: Add Redundancy Groups Configuration Details (continued)

Field Function Action

Weight

Add

Delete

Specifies the weight for the redundancy group interface to be monitored.

Enter the weight.

Interface

Secondary IP address

Specifies the logical interface through which to monitor this IP address.

Enter the logical interface address.

Specifies the source address for monitoring packets on a secondary link.

Enter the secondary IP address.

Adds the IPv4 address to be monitored.

Deletes the IPv4 address to be monitored.

Click

Add

Select the IPv4 address from the list and click Delete .

vSRX Administration Guide for VMware

vSRX Cluster Staging and Provisioning for VMware

Staging and provisioning a vSRX cluster includes the following tasks:

•

Deploying the VMs and Additional Network Interfaces on page 40

•

Creating the Control Link Connection Using VMware on page 40

•

Creating the Fabric Link Connection Using VMware on page 43

•

Creating the Data Interfaces Using VMware on page 46

•

Prestaging the Configuration from the Console on page 47

•

Connecting and Installing the Staging Configuration on page 47

Deploying the VMs and Additional Network Interfaces

The vSRX cluster uses three interfaces exclusively for clustering (the first two are predefined):

•

Out-of-band management interface (fxp0).

• Cluster control link (em0).

• Cluster fabric links (fab0 and fab1). For example, you can specify ge-0/0/0 as fab0 on node0 and ge-7/0/0 as fab1 on node1.

Initially, the VM has only two interfaces. A cluster requires three interfaces (two for the cluster and one for management) and additional interfaces to forward data. You can add interfaces through the VMware vSphere Web Client.

On the VMware vSphere Web Client, click Edit Virtual Machine Settings for each VM to create additional interfaces.

Click Add Hardware and specify the attributes in

Table 13 on page 40 .

Table 13: Hardware Attributes

Attribute Description

Adapter Type

Network label

Select SR-IOV or VMXNET 3 from the list.

Select the network label from the list.

Connect at power on Ensure that there is a check mark next to this option.

Creating the Control Link Connection Using VMware

To connect the control interface through the control vSwitch using the VMware vSphere

Web Client:

Choose Configuration->Networking.

Click Add Networking to create a vSwitch for the control link.

Chapter 3: Configuring Chassis Clusters

Choose the following attributes:

•

Connection Type

•

Virtual Machines

•

Network Access

• Create a vSphere switch

• No physical adapters

• Port Group Properties

•

Network Label: HA Control

•

VLAN ID: None(0)

NOTE:

Port groups are not VLANs. The port group does not segment the vSwitch into separate broadcast domains unless the domains have different

VLAN tags.

•

To use a VLAN as a dedicated vSwitch, you can use the default VLAN tag (0) or specify a VLAN tag.

• To use a VLAN as a shared vSwitch and use a port group, assign a

VLAN tag on the port group for each chassis cluster link.

Right-click on the control network, click Edit Settings , and select Security.

Set the promiscuous mode to Accept, and click OK, as shown in

Figure 3 on page 41 .

Figure 3: Promiscuous Mode

vSRX Administration Guide for VMware

NOTE: You must enable promiscuous mode on the control vSwitch for chassis cluster.

You can use the vSwitch default settings for the remaining parameters.

Click Edit Settings for both vSRX VMs to add the control interface (Network adapter

2) into the control vSwitch.

See

Figure 4 on page 42

for vSwitch properties and

Figure 5 on page 43

for VM properties for the control vSwitch.

Figure 4: Control vSwitch Properties

Chapter 3: Configuring Chassis Clusters

Figure 5: Virtual Machine Properties for the Control vSwitch

The control interface will be connected through the control vSwitch. See

Figure 6 on page 43 .

Figure 6: Control Interface Connected through the Control vSwitch

Creating the Fabric Link Connection Using VMware

To connect the fabric interface through the fabric vSwitch using the VMware vSphere

Web Client:

Choose Configuration->Networking.

Click Add Networking to create a vSwitch for the fabric link.

Choose the following attributes:

• Connection Type

vSRX Administration Guide for VMware

•

Virtual Machines

•

Network Access

• Create a vSphere switch

• No physical adapters

• Port Group Properties

•

Network Label: HA Fabric

•

VLAN ID: None(0)

NOTE:

Port groups are not VLANs. The port group does not segment the vSwitch into separate broadcast domains unless the domains have different

VLAN tags.

•

To use a VLAN as a dedicated vSwitch, you can use the default VLAN tag (0) or specify a VLAN tag.

• To use VLAN as a shared vSwitch and use a port group, assign a VLAN tag on the port group for each chassis cluster link.

Click Properties to enable the following features:

• General

-> Advanced Properties:

•

MTU: 9000

• Security

-> Effective Polices:

•

MAC Address Changes: Accept

• Forged Transmits: Accept

Click Edit Settings for both vSRX VMs to add the fabric interface into the fabric vSwitch.

NOTE: Network adaptor 3 is used in this example, which is configurable in Junos OS.

See

Figure 7 on page 45

for vSwitch properties and

Figure 8 on page 45

for VM properties for the fabric vSwitch.

Figure 7: Fabric vSwitch Properties

Chapter 3: Configuring Chassis Clusters

Figure 8: Virtual Machine Properties for the Fabric vSwitch

The fabric interface will be connected through the fabric vSwitch. See

Figure 9 on page 46

vSRX Administration Guide for VMware

Figure 9: Fabric Interface Connected Through the Fabric vSwitch

Creating the Data Interfaces Using VMware

To map all the data interfaces to the desired networks:

Choose Configuration->Networking.

Click Add Networking to create a vSwitch for fabric link.

Choose the following attributes:

• Connection Type

•

Virtual Machines

•

Network Access

•

Create a vSphere switch

• No physical adapters

• Port Group Properties

• Network Label: chassis cluster Reth

•

VLAN ID: None(0)

Click Properties to enable the following features:

• Security -> Effective Polices:

• MAC Address Changes: Accept

•

Forged Transmits: Accept

The data interface will be connected through the data vSwitch using the above procedure.

Chapter 3: Configuring Chassis Clusters

Prestaging the Configuration from the Console

The following procedure explains the configuration commands required to set up the vSRX chassis cluster. The procedure powers up both nodes, adds the configuration to the cluster, and allows SSH remote access.

Start the CLI.

root#cli root@>

Enter configuration mode.

configure

[edit] root@#

Copy the following commands and paste them into the CLI: set groups node0 interfaces fxp0 unit 0 family inet address 192.168.42.81/24 set groups node0 system hostname vsrx-node0 set groups node1 interfaces fxp0 unit 0 family inet address 192.168.42.82/24 set groups node1 system hostname vsrx-node1 set apply-groups "${node}"

Set the root authentication password by entering a cleartext password, an encrypted password, or an SSH public key string (DSA or RSA).

root@# set system root-authentication plain-text-password

New password: password

Retype new password: password set system root-authentication encrypted-password

"$1$jc3H0Hll$DLHKx7mDUBh8kpkZYmu9p0"

To enable SSH remote access: user@host#set system services ssh

To enable IPv6: user@host#set security forwarding-options family inet6 mode flow-based

This step is optional and requires a system reboot.

Commit the configuration to activate it on the device.

user@host#commit commit complete

When you have finished configuring the device, exit configuration mode.

user@host#exit

Connecting and Installing the Staging Configuration

After the vSRX cluster initial setup, set the cluster ID and the node ID, as described in

“Configuring a vSRX Chassis Cluster in Junos OS” on page 31 .

vSRX Administration Guide for VMware

After reboot, the two nodes are reachable on interface fxp0 with SSH. If the configuration is operational, the show chassis cluster status command displays output similar to that shown in the following sample output.

vsrx> show chassis cluster status

Cluster ID: 1

Node Priority Status Preempt Manual failover

Redundancy group: 0 , Failover count: 1

node0 100 secondary no no

node1 150 primary no no

Redundancy group: 1 , Failover count: 1

node0 100 secondary no no

node1 150 primary no no

A cluster is healthy when the primary and secondary nodes are present and both have a priority greater than 0.

Documentation

•

Deploying vSRX Chassis Cluster Nodes at Different ESXi Hosts Using dvSwitch on page 48

•

Configuring a vSRX Chassis Cluster in Junos OS on page 31

Deploying vSRX Chassis Cluster Nodes at Different ESXi Hosts Using dvSwitch

This method uses the private virtual LAN (PVLAN) feature of dvSwitch. There is no need to change the external switch configurations.

On the VMware vSphere Web Client, for dvSwitch, there are two PVLAN IDs for the primary and secondary VLANs.

Select Community in the menu for the secondary VLAN ID type.

Use the two secondary PVLAN IDs for the vSRX control and fabric links. See

Figure 10 on page 49

and

Figure 11 on page 49 .

Figure 10: dvPortGroup3 Settings

Chapter 3: Configuring Chassis Clusters

Figure 11: dvPortGroup6 Settings

vSRX Administration Guide for VMware

NOTE: The configurations described above must reside at an external switch to which distributed switch uplinks are connected. If the link at the external switch supports native VLAN, then VLAN can be set to none in the distributed switch port group configuration. If native VLAN is not supported on the link, this configuration should have VLAN enabled.

You can also use regular VLAN on a distributed switch to deploy vSRX chassis cluster nodes at different ESXi hosts using dvSwitch. Regular VLAN works similarly to a physical switch. If you want to use regular VLAN instead of PVLAN, disable IGMP snooping for chassis cluster links.

However, use of PVLAN is recommended because:

•

PVLAN does not impose IGMP snooping.

•

PVLAN can save VLAN IDs.

Documentation

•

Understanding vSRX on page 15

•

SRX Series Features Not Supported on vSRX on page 16

CHAPTER 4

Managing vSRX

•

Monitoring and Managing vSRX Instances Using Junos Space Virtual Director on page 51

•

Managing Security Policies for Virtual Machines Using Junos Space Security

Director on page 52

Monitoring and Managing vSRX Instances Using Junos Space Virtual Director

Once a vSRX instance is deployed within a VM host provider, Virtual Director monitors and displays the VM characteristics of each instance. On the Virtual Director user interface, when you click a particular VM from the list, Virtual Director displays all the configured attributes for that VM, a snapshot of all the performance data, and a snapshot of the statistical performance data for the vSRX instance.

When you click a group name for a group of VMs, Virtual Director displays a table of all the data for the VMs in that group. Virtual Director monitors and displays information such as VM status, memory allocated, number of vCPUs, number of vNICs, folder, host, data center, resource pool, CPU usage, and memory usage.

When a configured attribute changes, the monitoring module receives a notification from the virtualization provider and the cache is updated with the new changes.

This topic includes:

•

Viewing Connection Status on page 52

•

Discover Devices on page 52

vSRX Administration Guide for VMware

Viewing Connection Status

To view the connection status of a VM:

Select Virtual Director > Monitor Devices > VM Connection Status.

The VM connection status page displays a list of all the VMs, and provides details such as host, vCenter, data center, cluster, and resource pool. Use the Columns

Cascading menu to select the attribute to appear on the inventory table. You can then monitor the status of a VM for the selected attributes.

Discover Devices

To discover a VM:

Select Virtual Director > Monitor Devices > VM Connection Status.

Click Actions > Discover Device on the inventory page banner.

The Configure VM Instances for Discovery page appears.

Enter the IP address, subnet, and root password.

Click Submit to discover the VM instance.

Documentation

•

Junos Space Virtual Director Getting Started Guide

•

Understanding vSRX on page 15

Managing Security Policies for Virtual Machines Using Junos Space Security Director

Managing enterprise security policy has become extremely complex. The growth in network traffic, including mobile traffic and BYOD, and the emergence of cloud services, have combined into a new array of opportunities for malicious hackers.

Security management can become error-prone and time-consuming if management solutions are slow, difficult to use, or restricted in their granularity of control. Resulting misconfigurations can make the enterprise vulnerable to threats and noncompliant with regulations and policies.

As one of the Junos Space Management Applications, Junos Space Security Director helps organizations improve the reach, ease, and accuracy of security policy administration with a scalable, GUI-based management tool. It automates security provisioning through one centralized Web-based interface to help administrators manage all phases of security policy lifecycle more quickly and intuitively, from policy creation to remediation.

Documentation

•

Security Director Overview

•

Understanding vSRX on page 15