Configure Service Chaining With PNF

This section shows how to create Layer 3 PNF service chains for inter-LR traffic.

Service Chaining Using a PNF

Service Chaining provides security control and enforcement through a physical firewall on traffic between virtual networks that are attached to logical routers. By default, virtual networks attached to the same logical router can communicate only using Layer 3 routing. Virtual networks connected to different logical routers cannot communicate. Service chaining using a firewall (a physical network function) between the logical routers allows virtual networks on separate logical routers to communicate and to communicate in a secure way.

For CEM service chaining you insert a physical network function (PNF) device between two logical routers on a border spine or border leaf device. The PNF device allows for Layer 3 communication between the logical routers. Only Juniper SRX Services Gateways are supported as PNF devices.

Figure 1 shows a logical view of service chaining. VLANs provide connectivity between the logical routers and the PNF device. EBGP advertises routes between the logical routers and the PNF.

Figure 1: Logical View of Service Chaining Network architecture diagram with SRX Series PNF service chaining. Arrows show route flow between left and right spine devices, PNF, and VRFs.

Network architecture diagram with SRX Series PNF service chaining. Arrows show route flow between left and right spine devices, PNF, and VRFs.

In a topology that uses border leaf devices, attach the PNF to the border leaf devices as shown in Figure 2.

Figure 2: PNF in Topology with Border Leaf Network diagram of a data center topology with two QFX5110 spine switches, four leaf switches, Ethernet connections, BMS devices, Contrail Cluster, PNF SRX5400, and management tools.

Network diagram of a data center topology with two QFX5110 spine switches, four leaf switches, Ethernet connections, BMS devices, Contrail Cluster, PNF SRX5400, and management tools.

Service Chaining Configuration Overview

In this example we are configuring service chaining In the following topology to provide inter-LR routing on the blue and green networks as shown in Figure 3. SRX4k and SRX5k Services Gateways are supported as managed PNFs. Our PNF is an SRX5400 Services Gateway.

Figure 3: Inter-LR Service Chaining

Data center network diagram with Juniper Networks equipment showing a spine-leaf architecture. Two QFX10002 spine switches connect to four QFX5100 leaf switches, each linked to bare metal servers. SRX5400 device acts as a security gateway. VLANs and Virtual Port Groups organize traffic. Logical routers connect VLANs, and management tools Contrail Command and Contrail Insights are present. Solid lines indicate physical connections; dashed lines show logical traffic flows.

The virtual networks show in Figure 3 have already been configured. See Configure Virtual Networks for Multi-tenant Service Operations. We are adding PNF service chaining so that devices on each network can communicate with each other as shown with the purple line.

To configure service chaining for inter-LR traffic:

Onboard an SRX device as the PNF device connected to an existing fabric—you can connect the PNF device to a border spine or a border leaf.
Assign PNF service chaining device role to the PNF device and to the border spines or border leaf devices that connect to the PNF device.
Connect the PNF to the fabric using a PNF service template.
Connect the right and left LRs by configuring VLANs and EBGP peering between the PNF and the LRs using a PNF service instance.

Onboard an SRX Services Gateway as the PNF Device

This section shows how to use Contrail Command to integrate an SRX device into our data center fabric to serve as a PNF device.

This configuration assumes that you have already created your fabric. You must use the Brownfield Wizard to onboard the PNF device. You can’t onboard a PNF using the Greenfield Wizard.

SRX clusters are not supported for PNF service chaining.

To selectively onboard an SRX Series router as a PNF device onto an existing fabric:

Select Infrastructure > Fabrics, and then select the fabric to which you want to add the SRX Series gateway.
Select Action > Brownfield Wizard.

On the Create Fabric screen, configure the Management subnet, then select Additional Configuration, and enter the PNF ServiceChain subnets.

In this example, we are assigning 10.1.1.15/32 as the Management subnet and 10.100.0.0/24 as the PNF ServiceChain subnet. The Management subnet searches for the device. The PNF ServiceChain subnet establishes the EBGP session between the PNF device and the spine.

Contrail Command interface for creating a network fabric, showing steps like Create Fabric, Device discovery, and more. Admin user configures CIDR block 10.100.0.0/24.

Name	DC1
Overlay ASN	64532
Node Profile	Select the SRX device
VLAN-ID Fabric-Wide Significance	Check box
Management subnets (used to search for the device)	10.1.1.15
PNF ServiceChain subnets (subnet used to establish EBGP session between the PNF device and the spine)	10.200.0.0/24

Click Next, and then click Finish.

Assign Device Roles for the PNF Device

In this procedure we will assign the PNF service chaining role for the spine or border leaf devices that connect to the PNF.

To assign roles:

On the Fabric Devices summary screen, select the PNF device, and then select Action>Reconfigure Roles.
Next to the PNF device, select Assign Roles.
Assign the Physical Role as pnf and assign the Routing Bridging Roles as PNF-Servicechain role and click Assign.

Create a PNF Service Template

The service template provides Contrail Command with information about how the PNF device attaches to the spine or border leaf device. In our example, we are using the following interface numbers:

Network topology illustrating service chaining with SRX Series PNF connecting left and right spine devices via VRFs and interfaces xe-0/0/34:0, xe-2/2/1, xe-2/2/2.

To create a PNF service template:

Click Services>Catalog.
The VNF Service Instances page is displayed.
Click the PNF tab.
The Create PNF Service Template page is displayed.
Click Create and select Instance (with Template) from the list that appears.

Enter the following information in the PNF Service Template pane and click Create.

Field	Value
Name	PNF
PNF Device	vSRX1-05
PNF Left Interface	ge-0/0/0
PNF Left Fabric	DC1
PNF Left Attachment Points (Attachment points on the spine or border leaf.)	Specify how the spine or border leaf device attaches to the left interface of the PNF device: Physical Router—QFX1-05 Left Interface—xe-0/0/1
PNF Right Interface	ge-0/0/1
PNF Right Fabric	DC1
PNF Right Attachment Points (Attachment points on the spine or border leaf.)	Specify how the spine or border leaf device attaches to the right interface of the PNF device: Physical Router—QFX2-06 Right Interface—xe-0/0/2

Click Next and the PNF service instance configuration screen appears.

A PNF service instance defines how logical routers are interconnected and how BGP reachability is exchanged between the PNF and the logical routers. The configuration includes VLANs that are created between the PNF and the logical routers along with EBGP peering.

Figure 4: Completed PNF Configuration Network topology with service chaining using EBGP, featuring logical routers VRFs, SRX Series PNF, VLANs 201 and 202 for traffic routing and segmentation.

Network topology with service chaining using EBGP, featuring logical routers VRFs, SRX Series PNF, VLANs 201 and 202 for traffic routing and segmentation.

To create a PNF Service Instance:

Navigate to Services > Deployments, and select the PNF tab.

The PNF Service Instances screen displays.
Select Create Instance.

Configure the screen as shown here: