Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Deploy Juniper Security Director Using VMware vSphere

This topic guides you through the Juniper Security Director VM deployment using VMware vSphere.

Before You Begin

  • If you are not familiar using VMware vSphere, see VMware Documentation and select the appropriate VMware vSphere version.

  • Choose the size of the VM, see Hardware Requirements.

  • You must have 4 dedicated IP addresses and ensure that you have access to SMTP, NTP, and DNS servers, see Software Requirements.

    Note:

    If the deployment is a regulated/air-gapped environment, ensure that the VM also has access to signatures.juniper.net for IDP/Applications Signatures download.

To deploy Juniper Security Director VM using VMware vSphere:

Step 1: Download the OVA and the Software Bundle

  1. Download the Juniper Security Director OVA (.ova file) from https://support.juniper.net/support/downloads/?p=security-director-on-prem to a Web server or your local machine.

  2. Download the Juniper Security Director Software Bundle (.tgz file) to your local machine from https://support.juniper.net/support/downloads/?p=security-director-on-prem and then transfer the file to your staging server.

    A staging server is an intermediate server where the software bundle is downloaded and is accessible from the VM.

    The staging server must support software bundle download from the Juniper Security Director VM through Secure Copy Protocol (SCP). Before you deploy the VM, you must have the details of the staging server, including the SCP username and password.

Step 2: Deploy the VM

  1. Open the vSphere Client.

  2. Right-click the inventory object that is a valid parent object of a VM and select Deploy OVF Template.

  3. On the Select an OVF template page:

    • Enter the webserver OVA URL, where you have downloaded the OVA. The system might warn you about source verification. Click Yes.

      Note:

      Ensure that firewall rules do not block image access from the vSphere cluster.

      OR
    • Select the Local file option and click UPLOAD FILES to choose the OVA file from your local machine.

  4. On the Select a name and folder page, enter the VM name and the location.

  5. On the Select a compute resource page, select the compute resource for the host on which the VM will be deployed.

  6. On the Review details page, review the details of the resources to be provisioned.

  7. On the Select storage page, select the storage for the configuration and the virtual disk format. We recommend you to use virtual disk format as Thick provision.

    Note:

    We do not recommend thin provisioning. If you choose thin provisioning and the actual disk space available is low, the system might encounter problems once the disk is full.

  8. On the Select networks page, select the network to configure IP allocation for static addressing.

  9. On the Customize template page, configure Juniper Security Director on-premise OVA parameters.

    Note: Prepare all details for the Custom template page in advance. The OVF template will timeout after 6 to 7 minutes.
    Note:
    • The cliadmin user password field does not strictly validate password requirements. However, during the installation process, the system enforces strict validations and rejects the password that does not meet the specified requirements, causing installation failure. To avoid issues during installation, ensure that the password meets these criteria:

      • Must be at least 8 characters long and not more than 32 characters.

      • Must not be dictionary words.

      • Must include at least three of the following:

        • Numbers (0-9)

        • Uppercase letters (A-Z)

        • Lowercase letters (a-z)

        • Special characters (~!@#$%^&*()_-+={}[];:"'<,>.?/|\)

    • We recommend you to use FQDN.

  10. On the Ready to complete page, review all the details and if required, go back and edit the VM parameters. These network parameters cannot be changed from the VM configuration after successful installation. However, network parameters can be changed from the CLI. Click Finish to begin the OVA deployment.

    You can monitor the OVA deployment progress status in the Recent Tasks window at the bottom of your screen till it is 100% complete. The Status column shows the deployment complete percentage.

    Congratulations! Now the OVA deployment is complete.

  11. (Optional) Once you've deployed the OVA, create a snapshot. Snapshot is useful if you need to rollback after the software bundle automatically installs. Select the VM and from the Actions menu navigate toSnapshots > TAKE SNAPSHOT.

  12. Click the triangle icon to power on the VM.

    Note:

    By default, the VM will be deployed with the smallest resource configuration as mentioned in Hardware Requirements. Adjust the resources to match other resource configurations using the VMware Edit VM settings.

    For a successful installation, the resource allocation must match Hardware Requirements.

Once the VM powers on, navigate to the Summary tab and click LAUNCH WEB CONSOLE to monitor the software bundle installation status.

Note:

Avoid performing any operation on the console until the installation is complete.

You can view the installation progress on the console. After the installation is complete, the console displays Successfully installed software bundle on the cluster.

A successful installation requires approximately 30 minutes. If the installation lasts longer, check the Web console for potential errors. You can ssh to the VM IP using the cliadmin user and the password you configured during the OVA deployment. Then, use the show bundle install status command to check the installation status.

To rectify errors, power off the VM, then navigate to Configure and click vApp options to modify the parameters and then power on the VM.

Congratulations! The software bundle installation is now complete.

Step 3: Verify and Troubleshoot

To verify if the installation is successful, you must log into the VM IP through an SSH connection. VM IP is the value provided in the IP address field in Step 9. Use the following default credentials:

User: cliadmin

Password: abc123

After you have logged in, you will be prompted to change the default credentials.

Log in with your new credentials and run the following commands:

  • show service healthmonitor status command to view the installation status.

  • list /var/log/cluster-manager command to list the log file.

  • show file /var/log/cluster-manager/cluster-manager-service.log command to view the content of the log file.

  • remotecopy /var/log/cluster-manager/cluster-manager-service.log <username>@<hostname>:<remote path to copy the log file> command to copy the file to a remote location for troubleshooting.

Troubleshoot Using UI

You can generate and download the system logs for issues related to feature groups such as device management, policy management, and log analytics. A feature group is a logical grouping of related microservices whose logs are required to debug an issue.

Before You Begin

See Log In to the Juniper Security Director Web UI.

To generate the system logs:

  1. Select Administration > System Management > System Logs.

    The System Logs page is displayed.

  2. Select the feature group.

  3. In the Timespan drop-down field, select the period for which you want to generate the logs.

  4. Click Generate Log Package.

    A job is created for the log generation process. The details are displayed on the top of the page. Select Administration > Jobs to view the job. On the Jobs page, you can monitor the status of log generation process.

    After the job is finished, a link is created on the System Logs page to download the logs. System logs will be downloaded as a tgz file and shared with the Juniper Networks support team to analyze the root cause of the issue.