Requirements for vSRX Virtual Firewall on AWS

Minimum System Requirements for AWS

Table 1 lists the minimum system requirements for vSRX Virtual Firewall instances to be deployed on AWS.

Interface Mapping for vSRX Virtual Firewall on AWS

vSRX Virtual Firewall on AWS supports up to a maximum of eight network interfaces, but the actual maximum number of interfaces that can be attached to a vSRX Virtual Firewall instance is dictated by the AWS instance type in which it is launched. For AWS instances that allow more than eight interfaces, vSRX Virtual Firewall will support up to a maximum of eight interfaces only.

The following are the supported C5 instance types :

• c5.large

• c5.xlarge

• c5.2xlarge

• c5.4xlarge

• c5.9xlarge

• c5n.2xlarge

• c5n.4xlarge

• c5n.9xlarge

The following are the supported AMD-based AWS instances:

• C5a.16xlarge

• C5a.8xlarge

• C5a.4xlarge

• C5a.2xlarge

• C5a.xlarge

For more information on instance details such as vCPUs, memory and so on, see Pricing Information

For more information on maximum network interfaces by instance type, see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html .

Table 2 shows a mapping between vSRX Virtual Firewall interface names and their corresponding AWS interface names for up to eight network interfaces. The first network interface is used for the out-of-band management (fxp0) for vSRX Virtual Firewall.

We recommend putting revenue interfaces in routing instances as a best practice to avoid asymmetric routing. Since fxp0 is part of the default (inet.0) routing table, there might be two default routes needed in the same routing instance: one for the fxp0 interface for external management access, and the other for the revenue interfaces for traffic access, resulting in asymmetric routing. Putting the revenue interfaces in a separate routing instance avoids this situation of two default routes in a single routing instance.

vSRX Virtual Firewall Default Settings on AWS

vSRX Virtual Firewall requires the following basic configuration settings:

• Interfaces must be assigned IP addresses.

• Interfaces must be bound to zones.

• Policies must be configured between zones to permit or deny traffic.

• The ENA driver-related component must be ready for vSRX Virtual Firewall.

Table 3 lists the factory-default settings for security policies on the vSRX Virtual Firewall.

Best Practices for Improving vSRX Virtual Firewall Performance

Review the following deployment practices to improve vSRX Virtual Firewall performance:

• Disable the source/destination check for all vSRX Virtual Firewall interfaces.

• Limit public key access permissions to 400 for key pairs.

• Ensure that there are no contradictions between AWS security groups and your vSRX Virtual Firewall configuration.

• Use the c5n instance types on AWS for best throughput on the vSRX Virtual Firewall.

  Note:

  For c5-large instances, AWS uses second generation Intel Xeon Scalable Processors (Cascade Lake) or first generation Intel Xeon Platinum 8000 series (Skylake-SP) processor and for c4-xtra large instances, AWS uses high frequency Intel Xeon E5-2666 v3.

• Ensure traffic flows through multiple interfaces of the vSRX Virtual Firewall for optimal usage of the vCPUs.

• Use vSRX Virtual Firewall NAT to protect your Amazon EC2 instances from direct Internet traffic.