Related Documentation
- SRX Series
- Example: Configuring Logical Systems Security Profiles
- Understanding the Master Logical System and the Master Administrator Role
- Understanding User Logical Systems and the User Logical System Administrator Role
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
Understanding Logical System Security Profiles
Logical systems allow you to virtually divide a supported SRX Series device into multiple devices, isolating one from another, securing them from intrusion and attacks, and protecting them from faulty conditions outside their own contexts. To protect logical systems, security resources are configured in a manner similar to how they are configured for a discrete device. However, as the master administrator, you must allocate the kinds and amounts of security resources to logical systems. The logical system administrator allocates resources for his own logical system.
An SRX Series device running logical systems can be partitioned into user logical systems, an interconnect logical system, if desired, and the default master logical system. When the system is initialized, the master logical system is created at the root level. All system resources are assigned to it, effectively creating a default master logical system security profile. To distribute security resources across logical systems, the master administrator creates security profiles that specify the kinds and amounts of resources to be allocated to a logical system that the security profile is bound to. Only the master administrator can configure security profiles and bind them to logical systems. The user logical system administrator configures these resources for his logical system.
Logical systems are defined largely by the resources allocated to them, including security components, interfaces, routing instances, static routes, and dynamic routing protocols. When the master administrator configures a user logical system, he binds a security profile to it. Any attempt to commit a configuration for a user logical system without a security profile bound to it will fail.
This topic includes the following sections:
Logical Systems Security Profiles
As master administrator, you can configure a single security profile to assign resources to a specific logical system, use the same security profile for more than one logical system, or use a mix of both methods. You can configure up to 32 security profiles on an SRX Series device running logical systems. When you reach the limit, you must delete a security profile and commit the configuration change before you can create and commit another security profile. In many cases fewer security profiles are needed because you might bind a single security profile to more than one logical system.
Security profiles allow you to:
- Share the device’s resources, including policies,
zones, addresses and address books, flow sessions, and various forms
of NAT, among all logical systems appropriately. You can dedicate
various amounts of a resource to the logical systems and allow them
to compete for use of the free resources.
Security profiles protect against one logical system exhausting a resource that is required at the same time by other logical systems. Security profiles protect critical system resources and maintain a fair level of performance among user logical systems when the device is experiencing heavy traffic flow. They defend against one user logical system dominating the use of resources and depriving other user logical systems of them.
- Configure the device in a scalable way to allow for future creation of additional user logical systems.
You must delete a logical system’s security profile before you delete that logical system.
How the System Assesses Resources Assignment and Use Across Logical Systems
To provision a logical system with security resources, you, as a master administrator, configure a security profile that specifies for each resource:
- A reserved quota that guarantees that the specified resource amount is always available to the logical system.
- A maximum allowed quota. If a logical system requires more of a resource than its reserved amount allows, it can utilize resources configured for the global maximum amount if they are available—that is, if they are not allocated to other logical systems. The maximum allowed quota specifies the portion of the free global resources that the logical system can use. The maximum allowed quota does not guarantee that the amount specified for the resource in the security profile is available. Logical systems must compete for global resources.
If a reserved quota is not configured for a resource, the default value is 0. If a maximum allowed quota is not configured for a resource, the default value is the global system quota for the resource (global system quotas are platform-dependent). The master administrator must configure appropriate maximum allowed quota values in the security profiles so the maximum resource usage of a specific logical system does not negatively impact other logical systems configured on the device. The master administrator must configure the appropriate maximum-allowed quota values in the security profiles so that the maximum resource usage of a specific logical system does not negatively impact other logical systems configured on the device.
The system maintains a count of all allocated resources that are reserved, used, and made available again when a logical system is deleted. This count determines whether resources are available to use for new logical systems or to increase the amount of the resources allocated to existing logical systems through their security profiles.
When a user logical system is deleted, its reserved resource allocations are released for use by other logical systems.
Resources configured in security profiles are characterized as static modular resources or dynamic resources. For static resources, we recommend setting a maximum quota for a resource equal or close to the amount specified as its reserved quota, to allow for scalable configuration of logical systems. A high maximum quota for a resource might give a logical system greater flexibility through access to a larger amount of that resource, but it would constrain the amount available to allocate to a new user logical system.
The difference between reserved and maximum allowed amounts for a dynamic resource is not important because dynamic resources are aged out and do not deplete the pool available for assignment to other logical systems.
The following resources can be specified in a security profile:
- Security policies, including schedulers
- Security zones
- Addresses and address books for security policies
- Application firewall rule sets
- Application firewall rules
- Firewall authentication
- Flow sessions and gates
- NAT, including:
- Cone NAT bindings
- NAT destination rule
- NAT destination pool
- NAT IP address in source pool without port address translation (PAT)
- NAT IP address in source pool with PAT
- NAT port overloading
- NAT source pool
- NAT source rule
- NAT static rule
 | Note: All resources except flow sessions are static. |
You can modify a logical system security profile dynamically while the security profile is assigned to other logical systems. However, to ensure that the system resource quota is not exceeded, the system takes the following actions:
- If a static quota is changed, system daemons that maintain
logical system counts for resources specified in security profiles
revalidate the security profile. This check identifies the number
of resources assigned across all logical systems to determine whether
the allocated resources, including their increased amounts, are available.
These quota checks are the same quota checks that the system performs when you add a new user logical system and bind a security profile to it. The are also performed when you bind a different security profile from the security profile that is presently assigned to it to an existing user logical system (or the master logical system).
- If a dynamic quota is changed, no check is performed, but the new quota is imposed on future resource usage.
Cases: Assessments of Reserved Resources Assigned through Security Profiles
To understand how the system assesses allocation of reserved resources through security profiles, consider the following three cases that address allocation of one resource, zones. To keep the example simple, 10 zones are allocated in security-profile-1: 4 reserved zones and 6 maximum zones. This example assumes that the full maximum amount specified–six zones–is available for the user logical systems. The system maximum number of zones is 10.
These cases address configuration across logical systems. They test to see whether a configuration will succeed or fail when it is committed based on allocation of zones.
Table 1 shows the security profiles and their zone allocations.
Table 1: Security Profiles Used for Reserved Resource Assessments
Two Security Profiles Used in the Configuration Cases |
|---|
security-profile-1
Note: Later the master administrator dynamically increases the reserved zone count specified in this profile. |
master-logical-system-profile
|
Table 2 shows three cases that illustrate how the system assesses reserved resources for zones across logical systems based on security profile configurations.
- The configuration for the first case succeeds because the cumulative reserved resource quota for zones configured in the security profiles bound to all logical systems is 8, which is less than the system maximum resource quota.
- The configuration for the second case fails because the cumulative reserved resource quota for zones configured in the security profiles bound to all logical systems is 12, which is greater than the system maximum resource quota.
- The configuration for the third case fails because the cumulative reserved resource quota for zones configured in the security profiles bound to all logical systems is 12, which is greater than the system maximum resource quota.
Table 2: Reserved Resource Allocation Assessment Across Logical Systems
Reserved Resource Quota Checks Across Logical Systems |
|---|
Example 1: Succeeds This configuration is within bounds: 4+4+0=8, maximum capacity =10. Security Profiles Used
|
Example 2: Fails This configuration is out of bounds: 4+4+4=12, maximum capacity =10.
Security Profiles
|
Example 3: Fails This configuration is out of bounds: 6+6=12, maximum capacity =10. The master administrator modifies the reserved zones quota in security-profile-1, increasing the count to 6.
|
Related Documentation
- SRX Series
- Example: Configuring Logical Systems Security Profiles
- Understanding the Master Logical System and the Master Administrator Role
- Understanding User Logical Systems and the User Logical System Administrator Role
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
