Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

cSRX Pods With External Network

Know About cSRX Pods with External Network

You can connect cSRX Container Firewall with external network with two additional interfaces. Both interfaces are attached into srxpfe and handled by FLOW.

cSRX can leverage Linux native CNI to connect to external network.

cSRX use Multus plugin to support multiple interfaces connect to the external network. Applications which monitor network traffic are directly connected to the physical network. You can use the macvlan network driver to assign a MAC address to each container’s virtual network interface, making it appear to be a physical network interface directly connected to the physical network. In this case, you need to designate a physical interface on your Docker host to use for the macvlan, as well as the subnet and gateway of the macvlan. You can even isolate your macvlan networks using different physical network interfaces.

Connect cSRX to External Network

macvlan functions like a switch that is already connected to the host interface. A host interface gets enslaved with the virtual interfaces sharing the physical device but having distinct MAC addresses. Since each macvlan interface has its own MAC address, it makes it easy to use with existing DHCP servers already present on the network.

To connect cSRX with external network using macvlan:

Figure 1: Connecting cSRX Container Firewall to External Network with Macvlan PluginConnecting cSRX Container Firewall to External Network with Macvlan Plugin
Figure 2: cSRX Container Firewall in External NetworkcSRX Container Firewall in External Network
  1. Create the network-conf-1.yaml file and add the text content.
  2. Create the network-conf-1-1.yaml file and add the text content. .
  3. Create the network-conf-2-1.yaml and add the text content. .
  4. Create the network-conf-2.yaml file and add the text content.
  5. Create the cSRX.yaml file and add the text content.

Configure Nodeport Service for cSRX Pods

You can deploy cSRX with Nodeport service type. All the traffic is forwarded to worker node by Kubernetes in the external network.

To create a NodePort service:

  1. Create the cSRX Pod yaml file and expose it as service on NodePort.
  2. To access cSRX:

    root@kubernetes-master:~#ssh -p 30122 root@192.168.42.81