vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure

Compartments help you organize and control access to your resources. A compartment is a collection of related resources (such as cloud networks, compute instances, or block volumes) that can be accessed only by those groups that have been given permission by an administrator in your organization. For example, one compartment could contain all the servers and storage volumes that make up the production version of your company's Human Resources system. Only users with permission to that compartment can manage those servers and volumes.

• Open the navigation menu. Under Core Infrastructure, go to Networking and click Virtual Cloud Networks.

• Select the Sandbox compartment (or the compartment designated by your administrator) from the list on the left. If the Sandbox compartment does not exist, you can create. For more information, see Creating a Compartment.

1. From the main menu click Object Storage.

   Figure 2: Object Storage

2. Select the compartment in which you want to create the bucket. If you have a bucket already, click the name of “your bucket”. Or create a bucket.

   Figure 3: Create Bucket
   

3. Then Click Upload Objects.

   Provide the required information when a pop-up window appears.

   Figure 4: Upload Objects

   View Object Details: After the .oci image is loaded, choose the object right click the object and select View Object Details.

   Figure 5: View Object Details
   
   Note:

   There will be an URL path for this object as OCI ID, which can be used in the during importing images.

You will then launch your instance into one of the subnets of your VCN and connect to it.

1. Open the Navigation menu. Under Core Infrastructure, go to Networking and click Virtual Cloud Networks.

2. Click Create VCN and enter the data for VCN Name, Compartment, select an IPv4 VCN CIDR Block, Public Subnet CIDR Block. Accept the defaults for any other fields and click Create VCN.

Figure 6: Create Virtual Cloud Network

Figure 7: CIDR Block

The cloud network created will have resources such as Internet and NAT gateway, Service gateway with access to the Oracle Services Network, A regional public subnet with access to the internet gateway, and A regional private subnet with access to the NAT gateway and service gateway.

vSRX Virtual Firewall requires two public subnets and one or more private subnets for each individual instance group. One public subnet is for the management interface (fxp0), and the other is for a revenue (data) interface. The private subnets, connected to the other vSRX Virtual Firewall interfaces, ensure that all traffic between applications on the private subnets and the internet must pass through the vSRX Virtual Firewall instance.

1. Open the navigation menu. Under Core Infrastructure, select Compute and click Instances, and then click on Create Instance.

2. Figure 13: Create Compute Instance

3. On the Create Instance page, enter the name of your instance.

4. Choose an operating system or image source: Click Change Image and then click Image Source to select the image that you want to use. Select Custom Images and choose the image from the compartment. OCI vSRX Virtual Firewall image you want and then click Select Image.

   .

   Instance type – Virtual Machine.

5. Choose Instance Shape: Click Change Shape to select the standard predefined OCI shape. Select the VM standard 2.4 which has 4 NICs and 4 OCPUs and click Selcect Shape.

   Note:

   vSRX Virtual Firewall needs a minimum of 2 vCPUs to launch.

   

6. Under Networking tab select the virtual cloud network compartment, virtual cloud network, subnet compartments, subnet.

7. To create a public IP address for the instance, select the Assign a public IPv4 address option.

   Note:

   Accept default options for Availability Domain, Instance Type, and Instance Shape.

8. Add SSH keys: Under Add SSH keys tab, you can paste a public key by selecting the Paste public keys option and paste the public SSH key that was generated or you can create a new SSH key to access the vSRX Virtual Firewall and then click Create.

After a few minutes, we can ssh the instance using the public IP allocated for the instance (this would be displayed on the instance). Reboot the instance after adding interfaces.

The instance is displayed in the Console in a provisioning state. Expect provisioning to take several minutes before the status updates to Running. Do not refresh the page. After the instance is running, allow another few minutes for the operating system to boot before you attempt to connect. When you are ready to connect to the instance, make a note of both the public IP address and the initial password.

After the instance is provisioned, details about it appear in the instance list as shown below.

Figure 14: vSRX Virtual Firewall Instance Launched in OCI

Network interfaces need to be added after the instance has been created.

1. Click Attached VNICs and select Create VNIC (ge000 -public and ge001-private). Select the subnet that was created and click Save Changes to add VNICs to the instance.

   Note:

   Order of attaching network interfaces is important. You must map the first network interface to fxp0, then the second interface to ge-0/0/0, then to ge-0/0/1 and so on.

   Figure 15: Attached VNICs