Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Migrating Legacy Configurations to the Current vSRX Architecture

Migrating IBM Cloud™ Juniper vSRX configurations from the legacy to the current architecture requires careful consideration.

vSRX 18.4 deployments leverage the current architecture in most cases. This includes the vSRX 18.4 1G SR-IOV offering. The older vSRX 18.4 1G Standard offering is based on Linux Bridging and has different network configurations on the Ubuntu host, the KVM hypervisor, and in the vSRX configuration. The host and KVM settings do not require any special migration steps, as the automation process handles the configuration changes. However, if you want to import the vSRX configuration from the legacy architecture into the current vSRX configuration, you likely need to refactor some of the configuration.

Migrating 1G vSRX Standalone Configurations

There are some steps you potentially need to convert vSRX configuration settings on a Standalone 18.4 1G Public+Private Linux Bridge (legacy architecture) instance to a Standalone 18.4 1G Public+Private SR-IOV (current architecture) instance. You can find a sample default configuration for SR-IOV based current architecture Default Configuration of a sample 1G Standalone SR-IOV Public and Private vSRX Gateway.

The following is a sample default configuration for the Linux Bridge (legacy architecture). The example shows vSRX instances that were provisioned in different Datacenter pods. As a result, the transit VLAN’s (native-vlan-id) are different.

Converting the Interface Section

In the above 1G Public+Private Standalone example, the current architecture adds aggregated interfaces ae0 and ae1. These should map to what the legacy architecture defines as ge-0/0/0 (private / ae0) and ge-0/0/1 (public / ae1). Additionally, the new architecture adds ge-0/0/2 and ge-0/0/3 to support redundancy within the vSRX interfaces. In the old architecture, redundancy existed at the host (Hypervisor) bond interfaces (bond0 private / bond1 public). In the current architecture, SR-IOV VF’s that map directly to the ge interfaces are used for redundancy.

You can compare these vSRX configuration differences in vSRX Standalone interface (current architecture) and vSRX Standalone interface (legacy architecture).

Any private VLAN’s that were previously configured for ge-0/0/0 need to be routed through ae0. In addition, any public VLAN’s that you previously configured for ge-0/0/1 need to be routed through ae1.

Converting the Zones Section

Any default security zones that previously referenced ge-0/0/0 and ge-0/0/1 should now use the ae0.0 (SL-PRIVATE) and ae1.0 (SL-PUBLIC) interfaces. The same changes also apply to any zones that previously referenced ge-0/0/0 and ge-0/0/1.

Other Changes

  • The aggregated device configuration requires the following addition in the current architecture:

    set chassis aggregated-devices ethernet device-count 10

  • The JWEB configuration will also include the aggregated interfaces as well:

    set system services web-management https interface ae1.0

    set system services web-management https interface ae0.0

Migrating 1G vSRX High Availability configurations

For High Availability configurations, the main vSRX changes when importing configurations from the legacy architecture to the current architecture are small changes to the interface mappings.

The 1G SR-IOV HA configuration for the current architecture adds additional vSRX interfaces for redundancy, instead of using the host (hypervisor) bond interfaces. This is possible as the host now uses SR-IOV VF’s that can be mapped directly to the vSRX interfaces. Configurations that were exported from the legacy architecture will need to take this into account if they are imported into the current architecture.

For vSRX configuration for the current architecture for 1G HA, see vSRX High Availability interfaces (current architecture) and for vSRX configuration for the legacy architecture for 1G HA, see vSRX High Availability interfaces (legacy architecture).

The extra ge-0/* and ge-7/* interfaces were added and associated with the existing reth interfaces which have been present in both the legacy and current architecture. These allow for redundancy within the vSRX configuration. Redundancy is also configured for the fab interfaces as well.