Understanding vSRX with Microsoft Azure Cloud
This section presents an overview of vSRX as deployed in the Microsoft Azure cloud.
vSRX is a virtual security appliance that provides security and networking services at the perimeter or edge in virtualized private or public cloud environments. vSRX runs as a virtual machine (VM) on a standard x86 server. vSRX is built on the Junos operating system (Junos OS) and delivers networking and security features similar to those available on the software releases for the SRX Series Services Gateways.
The vSRX provides you with a complete Next-Generation Firewall (NGFW) solution, including core firewall, VPN, NAT, advanced Layer 4 through Layer 7 security services such as Application Security, intrusion detection and prevention (IPS), and UTM features including Enhanced Web Filtering and Anti-Virus. Combined with Sky ATP, the vSRX offers a cloud-based advanced anti-malware service with dynamic analysis to protect against sophisticated malware, and provides built-in machine learning to improve verdict efficacy and decrease time to remediation.
Figure 1 shows the high-level architecture for vSRX.
vSRX Benefits and Use Cases
vSRX on standard x86 servers enables you to quickly introduce new services, deliver customized services to customers, and scale security services based on dynamic needs. vSRX is ideal for public, private, and hybrid cloud environments.
Some of the key benefits of vSRX in a virtualized private or public cloud multitenant environment include:
Stateful firewall protection at the tenant edge
Faster deployment of virtual firewalls into new sites
Ability to run on top of various hypervisors and public cloud infrastructures
Full routing, VPN, core security, and networking capabilities
Application security features (including IPS and App-Secure)
Content security features (including Anti Virus, Web Filtering, Anti Spam, and Content Filtering)
Centralized management with Junos Space Security Director and local management with J-Web Interface
Juniper Networks Sky Advanced Threat Prevention (Sky ATP) integration
vSRX with Microsoft Azure
Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, you can deploy the vSRX to the Microsoft Azure Cloud. Microsoft Azure is Microsoft's application platform for the public cloud. It is an open, flexible, enterprise-grade cloud computing platform for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers. It provides Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) services. You place your virtual machines (VMs) onto Azure virtual networks, where the distributed and virtual networks in Azure help ensure that your private network traffic is logically isolated from traffic on other Azure virtual networks.
You can add a vSRX virtual security appliance to provide networking security features as an application instance within an Azure virtual network. The vSRX protects the workloads that run within the virtual network on the Microsoft Azure Cloud.
You can deploy the vSRX VM in Azure using the following deployment methods:
Azure Marketplace—Deploy the vSRX VM from the Azure Marketplace. The Azure Marketplace provides you with different methods to deploy a vSRX VM in your virtual network. You can choose a customized solution template offered by Juniper Networks to automate the vSRX VM deployment based on specific use cases (for example, a security gateway). A solution template automates the dependencies associated with specific deployment use cases, such as VM settings, virtual network settings (such as multiple subsets for the management interface (fxp0) and two revenue (data) interfaces), and so on. Or, you can select the vSRX VM image and define the deployment settings and dependencies based on your specific networking requirements. Starting in Junos OS Release 15.1X49-D91 for vSRX, you can deploy the vSRX to Microsoft Azure Cloud from the Azure Marketplace.
Azure Marketplace also enables you to discover and subscribe to software that supports regulated workloads through Azure Marketplace for Azure Government Cloud (US).
Azure CLI—Deploy the vSRX VM from the Azure CLI. You can customize the vSRX VM deployment settings and dependencies based on your network requirements in Microsoft Azure Cloud. To help automate and simplify the deployment of the vSRX VM in the Microsoft Azure virtual network, Juniper Networks provides a series of scripts, Azure Resource Manager (ARM) templates and parameter files, and configuration files in a GitHub repository.
Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, you can deploy the vSRX to Microsoft Azure Cloud from the Azure CLI.
In Microsoft Azure, you can host servers and services on the cloud as a pay-as-you-go (PAYG) or bring-your-own-license (BYOL) service.
vSRX PAYG images do not require any Juniper Networks licenses.
Starting in Junos OS Release 15.1X49-D120, vSRX on Microsoft Azure Cloud supports the vSRX Premium-Next Generation Firewall with Anti-Virus Protection bundle for PAYG, available as 1-hour or 1-year subscriptions. This bundle includes:
Standard (STD) features of core security, including core firewall, IPsec VPN, NAT, CoS, and routing services.
Advanced Layer 4 through 7 security services such as AppSecure features of AppID, AppFW, AppQoS, and AppTrack, IPS and rich routing capabilities, including the UTM antivirus feature.
Figure 2 illustrates the deployment of a vSRX in Microsoft Azure.
In the Microsoft Azure, public subnets have access to the Internet gateway, but private subnets do not. vSRX requires two public subnets and one or more private subnets for each individual instance group. The public subnets consist of one for the management interface (fxp0) and one for a revenue (data) interface. The private subnets, connected to the other vSRX interfaces, ensure that all traffic between applications on the private subnets and the Internet must pass through the vSRX instance.
For a glossary of Microsoft Azure terms see Microsoft Azure glossary.