Requirements for vSRX on VMware

Software Specifications

Table 1 lists the system software requirement specifications when deploying vSRX on VMware. The table outlines the Junos OS release in which a particular software specification for deploying vSRX on VMware was introduced. You must need to download a specific Junos OS release to take advantage of certain features.

Table 2 lists the specifications on the vSRX 3.0 virtual machine (VM).

Hardware Specifications

Table 3 lists the hardware specifications for the host machine that runs the vSRX VM.

Best Practices for Improving vSRX Performance

Review the following practices to improve vSRX performance.

NUMA Nodes

The x86 server architecture consists of multiple sockets and multiple cores within a socket. Each socket also has memory that is used to store packets during I/O transfers from the NIC to the host. To efficiently read packets from memory, guest applications and associated peripherals (such as the NIC) should reside within a single socket. A penalty is associated with spanning CPU sockets for memory accesses, which might result in nondeterministic performance. For vSRX, we recommend that all vCPUs for the vSRX VM are in the same physical non-uniform memory access (NUMA) node for optimal performance.

PCI NIC-to-VM Mapping

If the node on which vSRX is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. Use the esxtop command to view information about relative physical NIC locations. On some servers where this information is not available, refer to the hardware documentation for the slot-to-NUMA node topology.

Interface Mapping for vSRX on VMware

Each network adapter defined for a vSRX is mapped to a specific interface, depending on whether the vSRX instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX are shown in Table 4 and Table 5.

Note the following:

• In standalone mode:

  • fxp0 is the out-of-band management interface.

  • ge-0/0/0 is the first traffic (revenue) interface.

• In cluster mode:

  • fxp0 is the out-of-band management interface.

  • em0 is the cluster control link for both nodes.

  • Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 4 shows the interface names and mappings for a standalone vSRX VM.

Table 5 shows the interface names and mappings for a pair of vSRX VMs in a cluster (node 0 and node 1).

vSRX Default Settings on VMware

• Interfaces must be assigned IP addresses.

• Interfaces must be bound to zones.

• Policies must be configured between zones to permit or deny traffic.

Table 6 lists the factory default settings for the vSRX security policies.