Licenses for vSRX

vSRX Feature Licenses Overview

Some Junos OS software features require a license to activate the feature.

To enable a licensed feature, you need to purchase, install, manage, and verify a license key that corresponds to each licensed feature. To conform to software feature licensing requirements, you must purchase one license per feature per instance. The presence of the appropriate software unlocking key on your virtual instance allows you to configure and use the licensed feature.

If applicable for your vSRX deployment, vSRX pay-as-you-go images do not require any separate licenses.

• vSRX License Procurement and Renewal

• vSRX Evaluation License

• License Types

• Throughput

• License Duration

• Individual (á la carte) Feature Licenses

• Bundled Licenses

• Stacking Licenses

• vSRX License Keys Components

• License Management Fields Summary

vSRX License Procurement and Renewal

Licenses are usually ordered when the software application is purchased, and this information is bound to a customer ID. If you did not order the licenses when you purchased your software application, contact your account team or Juniper Networks Customer Care for assistance.

Licenses can be procured from the Juniper Networks License Management System (LMS).

For license renewal, use the show system license command to find the Juniper vSRX software serial number that you use to renew a license.

Do not use the show chassis hardware command to get the serial number on vSRX, because that command is only appropriate for the physical SRX Series devices. Also, the license for advanced security features available on the physical SRX Series devices cannot be used with vSRX deployments.

If you are performing a software downgrade with licenses installed, you will see an error message in the CLI when you try to configure the licensed features or run the show system license status command.

We recommend deleting existing licenses before performing a software downgrade.

vSRX Evaluation License

To speed deployment of licensed features, the vSRX software image provides you with a 60-day product evaluation license and a 30-day advanced security features license, both of which allow you to use vSRX and licensed features for a specified period without having to install a license key.

Table 1 lists vSRX evaluation license types.

Product Evaluation License

The vSRX software image includes a 60-day trial license. When you download and install the vSRX image, you are entitled to use this trial license for 60 days. It is intended as an evaluation license for using vSRX. This product-unlocking license is required to use the basic functions of the vSRX, such as networking, routing, and basic security features (such as stateful firewall).

The use of the 60-day trial license does not include vSRX support unless you already have a pre-existing vSRX support contract. If you require support during this 60-day evaluation period, please work with your Juniper Account team or go to the J-Net Community forum (https://forums.juniper.net/) and view the Support topics under the vSRX category.

Within 30 days of the license expiration date, a license expiration warning appears each time you log in to the vSRX instance. After the product evaluation license expires, you will not be able to use the vSRX; it will be disabled and flow configuration options will not work (the vSRX will stop forwarding traffic). At this point, only management interfaces and CLI configurations are preserved.

Advanced Security Features Evaluation License

The advanced security features license is a 30-day trial license for vSRX that is required for advanced security features such as UTM, IDP, and AppSecure. You can download the trial license for advanced security features from the vSRX Free Trial License Page.

The 30-day trial license period begins on the day you enable the enhanced security features after you install the 60-day product evaluation license for vSRX. To continue using vSRX features after the 30-day license period expires, you must purchase and install the license; otherwise, the features are disabled. If the license for advanced security features expires while the evaluation license (product unlocking license) is still valid, only the advanced security features that require a license are disabled.

The UTM advanced features have a slightly different trial license strategy. UTM does not requires 30-day trial license but only a 30-day grace period. Once the 30-day advanced security features trial license expires, Juniper Networks supports a 30-day grace period for you to continue using UTM features. The 30-day grace period goes into effect after the 30-trial license expires.

There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention (ATP). This is a second license that you can apply for a 30-day period in addition to the advanced security features license for vSRX to enable the Juniper Sky ATP features. You can download the Juniper Sky ATP trial license from the vSRX Free Trial License Page.

License Types

Juniper Networks provides a variety of licenses for both basic firewall features and advanced security features for different throughputs and durations.

If you want to use vSRX to provide basic firewall features, you can use standard (basic) licenses. However, to use some of the more advanced security features, such as AppSecure, IDP, and UTM, you might need to purchase advanced features licenses.

• Throughput—All licenses have an associated throughput. Throughput rates include 1 Gbps, 2 Gbps, and 4 Gbps on most platforms.

• Features—Licenses are available for different combinations of feature sets, from standard (STD) through Content Security Bundled (CSB).

• Individual or bundled—Licenses can be individual (á la carte) licenses for a set of features, or can be bundled together to provide a broad range of features in one easy license to maintain.

  Individual licenses are not supported.

• Duration—All licenses have an associated time duration. You can purchase basic licenses as perpetual (never expire) or subscription based (1-year or 3-year duration). All vSRX licenses are subscription based.

• New or renewal—All subscription licenses are either new (first-time purchase) or renewals (extending the license duration when the initial new subscription license is about to expire).

Figure 1 shows a sample license SKU and identifies how each field maps to these categories.

Figure 1: Sample vSRX License SKU

These categories of licenses can also be combined, or stacked, to provide more flexibility for your vSRX use cases.

Throughput

Bandwidth or throughput license types allow you to use a single instance of the software for up to the maximum throughput specified in the license entitlement. Throughput can be combined on a single instance of the software so that the maximum throughput for that instance is the aggregate of all the throughput licenses assigned to that instance. A throughput license cannot be split across multiple instances. Throughput is identified in the license entitlement in megabits per second (Mbps), or gigabits per second (Gbps).

For example, if you want 3 Gbps of throughput for a vSRX instance using the STD features, you would purchase a 1G STD license and a 2G STD license and install both on the vSRX. If you wanted 2 Gbps of throughput on two vSRX instances acting as a chassis cluster, you could not use the same 2 Gbps license on both vSRX instances. You would need to purchase one set of licenses for each vSRX instance in the cluster.

License Duration

• Perpetual license–A perpetual license allows you to use the licensed software indefinitely. Perpetual licenses do not require renewals. Perpetual licenses do not include maintenance and upgrade support. You must purchase that separately, vSRX software releases such as vSRX for Nutanix do not support perpetual licenses.

• Subscription license–A subscription license is an annual license that allows you to use the licensed software feature for the matching duration. Subscriptions might involve periodic downloads of content (such as for IDP threat signature files). Subscription licenses start when you retrieve the license key or 30 days after purchase if you have not retrieved the license key. At the end of the license period, you need to renew the license to continue using it.

  All subscription licenses are renewable. To renew a subscription license, purchase a new subscription of the same license. For more information, see Subscription - Register and Install.

Individual (á la carte) Feature Licenses

Every vSRX instance requires at least one standard license to support the desired throughput rate. Beyond that, you can select from a range of individual feature licenses that provide additional security feature sets. The feature license must match the standard license rate.

Individual licenses are not supported.

• VSRX-STD-1G-1—Provides the standard feature set and 1 Gbps of throughput.

• VSRX-CS-1G-1—Provides the advanced features.

Bundled Licenses

Bundled licenses simplify the license management by combining one or more individual licenses into a single bundled license. Instead of installing and managing a standard throughput license and one or more individual advanced feature licenses, you can purchase one of the bundle license options and manage one license instead.

For example, if you need AppSecure and Sophos antivirus features at 1 Gbps of throughput for a year, you could purchase the single bundled VSRX-CS-B-1G-1 license, which includes the STD throughput license. This means you only need to manage one license instead of two individual licenses.

Stacking Licenses

You can combine individual or bundled licenses to combine features or build up the overall supplied throughput for the vSRX instance.

For example, you can combine a 1-Gbps license and a 2-Gbps license to have 3 Gbps of throughput for the vSRX instance. You can also combine individual licenses, such as Sophos antivirus (SAV) and Websense Enhanced Web Filtering (EWF) to get both sets of security features.

Individual licenses require an STD license with the same throughput rate.

vSRX License Keys Components

A license key consists of two parts:

• License ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, it is given a license ID.

• License data—Block of binary data that defines and stores all license key objects.

For example, in the following typical license key, the string E413XXXX57 is the license ID, and the trailing block of data is the license data:

The license data conveys the customer ID and the software serial number (Juniper Networks support reference number) to the vSRX instance.

License Management Fields Summary

The Licenses window displays a summary of licensed features that are configured on the vSRX instance and a list of licenses that are installed on the vSRX instance.

To view the license details, select Maintain>Licenses in the J-Web user interface. The Licenses window appears as shown in Figure 2.

Figure 2: J-Web Licenses Window Showing Installed Licenses

You can also view the details of a license in the CLI using the show system license command. The following sample shows details of an evaluation license in the CLI:

The information on the license management page is summarized in Table 2.

Managing Licenses for vSRX

• vSRX Evaluation License Installation Process

• Adding a New License Key with J-Web

• Adding a New License Key from the CLI

• View vSRX License Information

• Updating vSRX Licenses

• Deleting a License with J-Web

• Deleting a License with the CLI

• License Warning Messages

vSRX Evaluation License Installation Process

Juniper Networks provides a 60-day evaluation license for vSRX standard features. When you download and install the vSRX image, you are entitled to use this evaluation license for 60 days as a trial. In addition to the 60-day vSRX evaluation license, there is a 30-day advanced security features trial license for vSRX that is required for advanced security features such as UTM, IDP, and AppSecure.

You can download the 30-day advanced security feature trial license from the vSRX Free Trial License Page.

There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention (ATP). This is a second license that you can apply for a 30-day period in addition to the advanced security features license for vSRX to enable the Sky ATP features. You can download the Sky ATP trial license from the vSRX Free Trial License Page

Installation of the advanced security feature trial license is similar to the regular license installation performed from the CLI (see Adding a New License Key from the CLI).

Within 30 days of the license expiration date, a license expiration warning appears each time you log in to the vSRX instance. After the product evaluation license expires, you will not be able to use the vSRX; it will be disabled and flow configuration options will not work (the vSRX will stop forwarding traffic). At this point, only management interfaces and CLI configurations are preserved.

The 30-day evaluation license period begins on the day you enable enhanced security features after installing evaluation licenses.

To continue using vSRX features after an optional 30-day evaluation period, you must purchase and install the license. Otherwise, the features are disabled.

For details about the 60- and 30-day license evaluation periods for the vSRX see vSRX Feature Licenses Overview .

Adding a New License Key with J-Web

1. Select Maintain>Licenses on the J-Web user interface. The Licenses window is displayed as shown in Figure 3.

   Figure 3: J-Web Licenses Window

   

2. Under Installed Licenses, click Add. The Add License window is displayed as shown in Figure 4.

   Figure 4: Add License Window

   

3. Do one of the following, using a blank line to separate multiple license keys:

   • Enter the full URL to the destination file containing the license key in the License File URL box.

   • Paste the license key text, in plaintext format, in the License Key Text box.

4. Click OK to add the license key. The License Details window is displayed as shown in Figure 5.

   Figure 5: License Details Window

   

The license key is installed and activated on the vSRX instance.

Adding a New License Key from the CLI

You can add a license key from a local file, from a remote URL, or from the terminal.

1. Use the request system license add operational mode command to either add the license from a local file or remote URL that contains the license key, or to manually paste the license key in the terminal.
   user@vsrx> request system license add terminal

   You can save the license key to a file and upload the file to the vSRX file system through FTP or Secure Copy (SCP), and then use the request system license add file-name command to install the license.

2. Optionally, use the show system license command to view details of the licenses.

The license key is installed and activated on the vSRX instance.

View vSRX License Information

You can view the vSRX license information using either of the following two methods:

• Serial Number Entitlement

• Juniper Agile Licensing Portal

1. Navigate to the Serial Number Entitlement.
2. Enter the Serial Number or Software Support Reference Number or Contract ID in the data input field.
3. Click View Entitlement Information to see the vSRX license information for the given Serial Number or Software Support Reference Number or Contract ID.

1. Log in to the Juniper Agile Licensing Portal.
2. Navigate to My Entitlements section to see the vSRX license information.

Updating vSRX Licenses

You can update the vSRX licenses using either of the following two methods:

• Automatic license update using the CLI

• Manual license update using the CLI

As a prerequisite, you must install at least one valid license key on your vSRX instance for required features. Automatic license updates as well as manual license updates are performed based on a valid software serial number and customer ID embedded in the license key.

1. Contact your account team or Juniper Networks Customer Care to extend the validity period of existing license keys and obtain the URL for a valid update server.
2. Once you have successfully extended your license key and received the update server URL, configure the auto-update parameter:
3. Configure renew options (if required). The following sample allows vSRX to contact the license server 30 days before the current license expires and sends an automatic update request every 6 hours.

1. Use the following command to update the license keys manually:

   This command sends a license update request to the license server immediately.

   The request system license update command will always use the default Juniper license server: https://ae1.juniper.net

2. Check the status of the license by entering the show system license command.

Deleting a License with J-Web

1. Select Maintain>Licenses.
2. Select the check box of the license or licenses you want to delete as shown in Figure 6.

   Figure 6: Deleting a License

   

3. Click Delete.
4. Click OK to confirm your deletion as shown in Figure 7.

   Figure 7: Delete Licenses Window

   

   The license you deleted is removed.

Deleting a License with the CLI

1. From operational mode, for each license, enter the following command and specify the license ID. You can delete only one license at a time.

   Or you can use the following command to delete all installed licenses.
2. Type yes when you are prompted to confirm the deletion.

   The license you deleted is removed.

License Warning Messages

You must purchase a new license or renew your existing subscription-based license to have a seamless transition from the old license to the new one.

The following conditions occur when a license expires on vSRX:

• Evaluation license for the core expires—Packet forwarding on vSRX is disabled. However, you can manage vSRX through the fxp0 management interface, and the CLI configuration is preserved.

• Subscription-based licenses for advanced security features expire but subscription-based licenses for core services are active—A 30-day grace period begins, allowing the user to continue using advanced security features. After the grace period, advanced security features are disabled. Basic features are always available in the vSRX. After subscription-based licenses for core services expire, a warning message is displayed to notify the user, but basic features will remain preserved for the user.

• Subscription-based license for core features expires but subscription-based license for advanced security features is active—A warning message is displayed to notify the user. However, you can continue to use the basic features on the vSRX. Advanced security features are disabled when the subscription-based license for advanced security features expires, but basic features will remain preserved for the user.

All advanced and premium licenses are offered as subscriptions. Subscription licenses are available in 1 year, 3 years, or 5 years terms. After the order fulfilment, the subscription period begins after the completion of 30 days grace period.

Table 3 describes the subscription terms for purchase and number of months to use the license.

All subscription licenses are renewable. To renew a subscription license, purchase a new subscription of the same license. For more information, see Subscription - Register and Install .

To use features that require a license, you must install and configure a license. After the license expires, warning messages are displayed in the system log and on the J-Web dashboard.

When a license expires, the System Alarms section of the J-Web dashboard displays a message stating that the license has expired as shown in Figure 8.

Figure 8: J-Web Dashboard for License Expiry Warning

When a license expires, the following message appears when you log in:

vSRX License Model Numbers

The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of features. Each license includes a list of features that the license enables along with information about those features.

For information about purchasing software licenses, contact your Juniper Networks sales representative at https://www.juniper.net/in/en/contact-us/.

vSRX licenses are based on application packages and processing capacity.

vSRX provides bandwidth in the following capacities (throughput per instance): 1 Gbps, 2 Gbps, and 4 Gbps. Each of these bandwidth tiers is offered with three different packages.

Table 4 describes the features available with the various license packages.

License stacking is allowed. So, for example, to license 3 Gbps of throughput for the standard (STD) feature set for 1 year, use a VSRX-1G-STD-CLD-1 license and a VSRX-2G-STD-CLD-1.

vSRX License Model Numbers for Contrail, KVM, Microsoft Hyper-V, and VMware

The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of features. Each license includes a list of features that the license enables along with information about those features.

For information about purchasing software licenses, contact your Juniper Networks sales representative at https://www.juniper.net/in/en/contact-us/.

vSRX licenses are based on application packages and processing capacity.

Bandwidth (throughput) licenses allow you to use a single instance of the software for up to the maximum throughput specified in the license entitlement. Throughput licenses can be combined on a single instance of the software so that the maximum throughput for that instance is the aggregate of all the throughput licenses assigned to that instance. A throughput license cannot be split across multiple instances. Throughput licenses are identified in the license entitlement in megabits per second (Mbps), or gigabits per second (Gbps).

vSRX provides bandwidth in the following capacities (throughput per instance): 100 Mbps, 1 Gbps, 2 Gbps, 4 Gbps, 10 Gbps, and 20 Gbps. Each of these bandwidth tiers is offered with four different packages along with bandwidth based, a la carte, advanced Layer 7 security services SKUs.

Table 5 describes the features available with the various license packages.

License stacking is allowed. For example, to license 3 Gbps of throughput for the standard (STD) feature set for 1 year, use a VSRX-1G-STD-1 license and a VSRX-2G-STD-1.

Table 6 lists the standard bandwidth licenses available for vSRX.

Table 7 lists the bandwidth licenses available for vSRX bundled with AppSecure and IPS features.

Table 8 lists the individual (a la cart) subscription licenses available for vSRX with AppSecure and IPS features.

Table 9 lists the Content Security Bundled (CSB) bandwidth licenses available for vSRX.

Table 10 lists the individual (a la carte) CS subscription licenses available for vSRX.

Table 11 lists the individual (a la carte) Sophos antivirus (S-AV) bandwidth licenses available for vSRX.

Table 12 lists the individual (a la carte) enhanced Web filtering (W-EWF) subscription licenses available for vSRX.