Deploying the vSRX as an Advanced Security Service in a VMware NSX Environment

After adding the NSX Manager, you must register the vSRX VM as a Juniper security service with the NSX Manager.

To register the vSRX instance as a Juniper security service:

1. Select the NSX Manager for which service needs to be registered, right-click or from the More list, select Register Security Service.

   The Register Security Service page appears, as shown in Figure 4.

   Figure 4: Register Security Service Page

2. In the Service Name field, enter the name of the Juniper security service.

3. From the vSRX OVF URL list, select the available vSRX OVF image that you copied to the Policy Enforcer machine.

4. In the vSRX Root Password field, enter the root password of the vSRX instance. The same root password will be set for all the vSRX instances deployed in NSX.

5. In the Description field, enter a description.

6. Click Register.

   A confirmation message indicates whether the registration is successful or not.

The vSRX instance registered as a new service in the vSphere Web Client environment. The vSRX is added as a network service that can be deployed by the NSX Manager.

In the vSphere Web Client, verify the following:

• Click Networking & Security and then click Service Definitions. Click the Services tab and verify that <service-name> v1.0 is listed in the table (the newly registered vSRX VM) along with the Security Director as the Service Manager, as shown in Figure 5.

  Figure 5: Service Definitions Page

• Click the Service Managers tab and verify that the Security Director is listed with a status of In Service, as shown in Figure 6.

  Figure 6: vSphere Web Client Service Manager Page

The NSX Manager and its inventory are now synchronized with the Security Director. All shared objects (such as security groups) are synchronized between the NSX Manager and Security Director. The shared objects include the IP addresses of all VMs in ESXi hosts, including the vSRX agent VMs. Security Director creates a dynamic address group(DAG) for each security group synchronized from the NSX Manager, along with the addresses of each member of the security group.

After you register a Juniper security service in the NSX Manager, the NSX Manager uses the vSRX agent VM to communicate the service status. The NSX Manager transmits messages to the Security Director when any changes or activities are happening in the NSX Manager that are related to the Juniper security service.

To deploy the vSRX agent VM as a security service for a vSphere cluster:

1. From the vSphere Web Client, click Networking & Security and then click Installation.

   The Installation page appears.

2. Click the Service Deployments tab and then click the New Service Deployment (+) icon. The Deploy Network & Security Services page appears, as shown in Figure 8.

   Figure 8: Deploy Network and Security Services Page

3. From the Select services & schedule page, select <service-name> v1.0 as the service to deploy and then click Next.

4. From the Select clusters page, select the data center and one or more clusters on which the vSRX agent VM is to be deployed, and then click Next.

5. From the Select storage and Management Network page:

   • Select the datastore on which to allocate shared storage for the vSRX agent VM, as shown in Figure 9. ESXi hosts should be configured so that they can access shared storage. If you select Specified on-host, ensure that the datastore for the ESXi host is specified in the Agent VM Settings of the ESXi host in the cluster. See the VMware documentation for details.

     Figure 9: Select Storage and Management Network Page

   • Select the network that you intend to use for traffic to the vSRX agent VM. If you select Specified on-host, ensure that the network to be used is specified in the Agent VM Settings > Network property of the ESXi host in the cluster. See the VMware documentation for details.

   Note:

   The datastore and network must be configured for each ESXi host in the cluster.

   For IP assignment, you can choose an IP pool to assign a range of IP addresses from a selected static IP pool or create a new static IP pool.

6. Click Next to access the Ready to complete page, and then click Finish to publish the changes and deploy the vSRX agent VM security services to the specified cluster. From the Service Deployments tab, you will see that the Juniper security service has been successfully deployed on the selected vSphere cluster.

7. From the vSphere Web Client, click Hosts and Clusters and verify that vSRX agent VMs are listed as service-name v1.0 in the vSphere Web Client inventory and created for each ESXi host in the vSphere cluster.

   Note:

   service-name is the name provided at the time of service registration.

8. The Security Director automatically discovers all the deployed vSRX VM agents by using the device-initiated discovery. A new firewall and IPS group policies are created and all devices are assigned to these group policies.

   Note:

   The Security Director creates predefined IPS policies with a single IPS template. You can either add more IPS templates or convert the predefined IPS policies to custom IPS policies.

When you add an ESXi host in the vSphere cluster, NSX Manager automatically detects that the new ESXi host and adds the Juniper security service vSRX agent VM for it.

When you return to Security Director > Devices > Security Devices, you can view the active configuration for the vSRX agent VMs, as shown in Figure 15.

Figure 15: Security Devices Page

The NSX Manager is aware of the security groups that the Juniper security service monitors. If any changes occur in the security group, the NSX Manager notifies the Security Director about those changes. If membership changes, the NSX Manager notifies the Security Director of the changes and the Security Director updates its database based on the new membership.