Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Requirements for vSRX Virtual Firewall on Contrail

Software Requirements

Table 1 lists the system software requirement specifications when deploying vSRX Virtual Firewall on Juniper Networks Contrail. The table outlines the Junos OS release in which a particular software specification for deploying vSRX Virtual Firewall on KVM was introduced. You will need to download a specific Junos OS release to take advantage of certain features.

Table 1: Specifications for vSRX Virtual Firewall on Juniper Networks Contrail

Component

Specification

Junos OS Release Introduced

Hypervisor support

Linux KVM

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1

Memory

4 GB

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1

8 GB

Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1

Disk space

20 GB IDE drive

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1

vCPUs

2 vCPUs

Note:

The Contrail compute node must bare metal since vSRX Virtual Firewall as a VNF does not support nested virtualization.

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1

5 vCPUs

Note:

The Contrail compute node must bare metal since vSRX Virtual Firewall as a VNF does not support nested virtualization.

Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1

vNICs

Up to 16 vNICs

  • Virtio

  • SR-IOV

    Note:

    We recommend the Intel X520/X540 physical NICs for SR-IOV support on vSRX Virtual Firewall. For SR-IOV limitations, see the Known Behavior section of the vSRX Virtual Firewall Release Notes.

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1

Table 2 lists the software specifications on the vSRX Virtual Firewall.

Table 2: Software Specifications for vSRX Virtual Firewall 3.0 on Juniper Networks Contrail

Flavor Name

vCPU

Junos OS Release Introduced

Hypervisor support

Linux KVM

Junos OS Release 18.2R1 or later release

Memory

4 GB

Junos OS Release 18.2R1 or later release

8 GB

Junos OS Release 18.2R1 or later release

Disk space

20 GB IDE drive

Junos OS Release 18.2R1 or later release

vCPUs

2 vCPUs

Junos OS Release 18.2R1 or later release

5 vCPUs

Junos OS Release 18.2R1 or later release

vNICs

Up to 16 vNICs

  • Virtio

  • SR-IOV

    Note:

    We recommend the Intel X520 physical NICs for SR-IOV support on small flavor vSRX Virtual Firewall, Intel X710 for Medium flavor vSRX Virtual Firewall.

Junos OS Release 18.2R1 or later release

Contrail Recommendations for vSRX Virtual Firewall

Table 3 lists the recommended software versions to run vSRX Virtual Firewall on Contrail.

Table 3: Contrail Recommendations for vSRX Virtual Firewall

Software

Version

Supported Release

Contrail

2.20

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1 or later release

3.1

Junos OS Release 15.1X49-D60 and Junos OS Release 17.3R1 or later release

3.5

Junos OS Release 18.4R1

OpenStack

Juno or Icehouse

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1 or later release

Juno or Kilo

Junos OS Release 15.1X49-D60 and Junos OS Release 17.3R1 or later release

Host OS

Ubuntu 14.04.2

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1 or later release

Linux Kernel

3.16

Junos OS Release 15.1X49-D20 and Junos OS Release 17.3R1 or later release

Note:

We recommend that you enable hardware-based virtualization on the host machine. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support. See Contrail - Server Requirements to review any additional requirements for Contrail.

Table 4 lists the contrail recommendations for vSRX Virtual Firewall.

Table 4: Contrail Recommendations for vSRX Virtual Firewall 3.0

Software

Version

Supported Release

Contrail

3.1

Junos OS Release 18.2R1 or later release

3.2

Junos OS Release 18.2R1 or later release

5.X

Junos OS Release 19.3R1 or later release

OpenStack

Centos 7 or 8

Junos OS Release 18.2R1 or later release

Host OS

Ubuntu 14.04.2

Junos OS Release 18.2R1 or later release

Linux Kernel

Queens or later

Junos OS Release 18.2R1 or later release

Hardware Recommendations

Table 5 lists the hardware specifications for the host machine that runs the vSRX Virtual Firewall VM.

Table 5: Hardware Specifications for the Host Machine

Component

Specification

Host memory size

4 GB (minimum) .

Host processor type

Intel x86_64 multicore CPU

Note:

DPDK requires Intel Virtualization VT-x/VT-d support in the CPU. See About Intel Virtualization Technology.

Virtual network adapter

VMXNet3 device or VMWare Virtual NIC

Note:

Virtual Machine Communication Interface (VMCI) communication channel is internal to the ESXi hypervisor and the vSRX Virtual Firewall VM.

Best Practices for Improving vSRX Virtual Firewall Performance

Review the following practices to improve vSRX Virtual Firewall performance.

NUMA Nodes

The x86 server architecture consists of multiple sockets and multiple cores within a socket. Each socket also has memory that is used to store packets during I/O transfers from the NIC to the host. To efficiently read packets from memory, guest applications and associated peripherals (such as the NIC) should reside within a single socket. A penalty is associated with spanning CPU sockets for memory accesses, which might result in nondeterministic performance. For vSRX Virtual Firewall, we recommend that all vCPUs for the vSRX Virtual Firewall VM are in the same physical non-uniform memory access (NUMA) node for optimal performance.

CAUTION:

The packet forwarding engine (PFE) on the vSRX Virtual Firewall might become unresponsive if the NUMA nodes topology properties in OpenStack includes the line hw:numa_nodes=2 to spread the instance’s vCPUs across multiple host NUMA nodes. We recommend that you remove the hw:numa_nodes=2 line from OpenStack to ensure that the PFE functions properly.

PCI NIC-to-VM Mapping

If the node on which vSRX Virtual Firewall is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. On a Linux host OS, install the hwloc package and use the lstopo command to view information about relative physical NIC locations. On some servers where this information is not available, refer to the hardware documentation for the slot-to-NUMA node topology.

Mapping Virtual Interfaces to a vSRX Virtual Firewall VM

To determine which virtual interfaces on your Linux host OS map to a vSRX Virtual Firewall VM:

  1. Use the virsh list command on your Linux host OS to list the running VMs.

  2. Use the virsh domiflist vsrx-name command to list the virtual interfaces on that vSRX Virtual Firewall VM.

    Note:

    The first virtual interface maps to the fxp0 interface in Junos OS.

Interface Mapping for vSRX Virtual Firewall on Contrail

Each network adapter defined for a vSRX Virtual Firewall is mapped to a specific interface, depending on whether the vSRX Virtual Firewall instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX Virtual Firewall are shown in Table 6 and Table 7.

Note the following:

  • In standalone mode:

    • fxp0 is the out-of-band management interface.

    • ge-0/0/0 is the first traffic (revenue) interface.

  • In cluster mode:

    • fxp0 is the out-of-band management interface.

    • em0 is the cluster control link for both nodes.

    • Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.

Table 6 shows the interface names and mappings for a standalone vSRX Virtual Firewall VM.

Table 6: Interface Names for a Standalone vSRX Virtual Firewall VM

Network Adapter

Interface Name in Junos OS for vSRX Virtual Firewall

1

fxp0

2

ge-0/0/0

3

ge-0/0/1

4

ge-0/0/2

5

ge-0/0/3

6

ge-0/0/4

7

ge-0/0/5

8

ge-0/0/6

Table 7 shows the interface names and mappings for a pair of vSRX Virtual Firewall VMs in a cluster (node 0 and node 1).

Table 7: Interface Names for a vSRX Virtual Firewall Cluster Pair

Network Adapter

Interface Name in Junos OS for vSRX Virtual Firewall

1

fxp0 (node 0 and 1)

2

em0 (node 0 and 1)

3

ge-0/0/0 (node 0)ge-7/0/0 (node 1)

4

ge-0/0/1 (node 0)ge-7/0/1 (node 1)

5

ge-0/0/2 (node 0)ge-7/0/2 (node 1)

6

ge-0/0/3 (node 0)ge-7/0/3 (node 1)

7

ge-0/0/4 (node 0)ge-7/0/4 (node 1)

8

ge-0/0/5 (node 0)ge-7/0/5 (node 1)

vSRX Virtual Firewall Default Settings on Contrail

vSRX Virtual Firewall requires the following basic configuration settings:

  • Interfaces must be assigned IP addresses.

  • Interfaces must be bound to zones.

  • Policies must be configured between zones to permit or deny traffic.

Table 8 lists the factory default settings for the vSRX Virtual Firewall security policies.

Table 8: Factory Default Settings for Security Policies

Source Zone

Destination Zone

Policy Action

trust

untrust

permit

trust

trust

permit

untrust

trust

deny