close

keyboard_arrow_left

Table of Contents Expand all

play_arrow vSRX Virtual Firewall Deployment for KVM
- play_arrow Overview
  - Understand vSRX Virtual Firewall with KVM
  - Requirements for vSRX Virtual Firewall on KVM
- play_arrow Install vSRX Virtual Firewall in KVM
- play_arrow vSRX Virtual Firewall VM Management with KVM
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters on KVM
play_arrow vSRX Virtual Firewall Deployment for VMware
- play_arrow Overview
  - Understand vSRX Virtual Firewall with VMware
  - Requirements for vSRX Virtual Firewall on VMware
- play_arrow Install vSRX Virtual Firewall in VMware
- play_arrow vSRX Virtual Firewall VM Management with VMware
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters in VMware
play_arrow vSRX Virtual Firewall Deployment for Microsoft Hyper-V
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Hyper-V
  - Requirements for vSRX Virtual Firewall on Microsoft Hyper-V
- play_arrow Install vSRX Virtual Firewall in Microsoft Hyper-V
- play_arrow vSRX Virtual Firewall VM Management with Microsoft Hyper-V
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters
  - vSRX Virtual Firewall Cluster Staging and Provisioning in Hyper-V
  - Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS
play_arrow vSRX Virtual Firewall Deployment for Contrail
- play_arrow Overview of vSRX Virtual Firewall Service Chains in Contrail
- play_arrow Install vSRX Virtual Firewall in Contrail
- play_arrow vSRX Virtual Firewall VM Management with Contrail
play_arrow vSRX Virtual Firewall Deployment for Nutanix
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Nutanix
  - Requirements for vSRX Virtual Firewall on Nutanix
- play_arrow Install vSRX Virtual Firewall in Nutanix
  - Launch and Deploy vSRX Virtual Firewall in Nutanix AHV Cluster
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
play_arrow vSRX Virtual Firewall Deployment for AWS
play_arrow vSRX Virtual Firewall Deployment for Microsoft Azure
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Azure Cloud
  - Requirements for vSRX Virtual Firewall on Microsoft Azure
- play_arrow Deploy vSRX Virtual Firewall from the Azure Portal
- play_arrow Deploy vSRX Virtual Firewall from the Azure CLI
  - Before You Deploy vSRX Virtual Firewall Using the Azure CLI
  - Deploy vSRX Virtual Firewall from the Azure CLI
- play_arrow Configure and Manage vSRX Virtual Firewall for Microsoft Azure
- play_arrow Configure Azure Features on vSRX Virtual Firewall and Use Cases
play_arrow vSRX Virtual Firewall Deployment for Google Cloud Platform
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Google Cloud
  - Requirements for vSRX Virtual Firewall on Google Cloud Platform
- play_arrow Install vSRX Virtual Firewall in Google Cloud
play_arrow vSRX Virtual Firewall Deployment for IBM Cloud
- play_arrow Overview
- play_arrow Installing and Configuring vSRX Virtual Firewall in IBM
- play_arrow Managing vSRX Virtual Firewall in IBM Cloud
  - vSRX Virtual Firewall Configuration and Management Tools
  - Managing Security Policies for Virtual Machines Using Junos Space Security Director
- play_arrow Monitoring and Troubleshooting
  - Technical Support
play_arrow vSRX Virtual Firewall Deployment for OCI
- play_arrow Overview
  - Understanding vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Requirements for vSRX Virtual Firewall on Oracle Cloud Infrastructure
- play_arrow Installing vSRX Virtual Firewall in OCI
  - vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
- play_arrow vSRX Virtual Firewall Licensing
  - Licenses for vSRX Virtual Firewall

list Table of Contents

English

Configure vSRX Virtual Firewall Using the CLI

date_range 27-May-23

arrow_backward

arrow_forward

Understand vSRX Virtual Firewall on AWS Preconfiguration and Factory Defaults

vSRX Virtual Firewall on AWS deploys with the following preconfiguration defaults:

SSH access with the RSA key pair configured during the installation
No password access allowed for SSH access
The management (fxp0) interface is preconfigured with the AWS Elastic IP and default route

Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, the following example summarizes the preconfiguration statements added to a factory-default configuration for vSRX Virtual Firewall on AWS instances:

content_copy zoom_out_map
set groups aws-default system root-authentication ssh-rsa "ssh-rsa XXXRSA-KEYXXXXX”
set groups aws-default system services ssh no-passwords
set groups aws-default system services netconf ssh
set groups aws-default system services web-management https system-generated-certificate
set groups aws-default interfaces fxp0 unit 0 family inet address aws-ip-address
set groups aws-default routing-options static route 0.0.0.0/0 next-hop aws-ip-address
set apply-groups aws-default

For Junos OS Release 15.1X49-D70 and earlier, the following example summarizes the preconfiguration statements added to a factory-default configuration for vSRX Virtual Firewall on AWS instances:

content_copy zoom_out_map
set system root-authentication ssh-rsa "ssh-rsa XXXRSA-KEYXXXXX”
set system services ssh no-passwords
set interfaces fxp0 unit 0 family inet addressaws-ip-address
set routing-options static route 0.0.0.0/0 next-hop aws-ip-address

CAUTION:

Do not use the load factory-default command on a vSRX Virtual Firewall AWS instance. The factory default configuration removes the AWS preconfiguration. If you must revert to factory default, ensure that you manually reconfigure AWS preconfiguration statements before you commit the configuration; otherwise, you will lose access to the vSRX Virtual Firewall instance.

Add a Basic vSRX Virtual Firewall Configuration

You can either create a new configuration on vSRX Virtual Firewall or copy an existing configuration from another SRX or vSRX Virtual Firewall and load it onto your vSRX Virtual Firewall on AWS. Use the following steps to copy and load an existing configuration:

To configure a vSRX Virtual Firewall instance using the CLI:

Log in to the vSRX Virtual Firewall instance using SSH and start the CLI.
Note:
Starting in Junos OS Release 17.4R1, the default user name has changed from root@ to ec2-user@.
```
ec2-user@% cli
ec2-user@>
```
Enter configuration mode.
```
ec2-user@> configure 
[edit]
ec2-user@#
```
Set the authentication method to log into the vSRX Virtual Firewall. You can specify a password by entering a cleartext password or an encrypted password. If you require a more robust level of authentication security, we recommend that you select an SSH public key string (DSA, ECDSA, or RSA).
```
ec2-user@# set system root-authentication ssh-rsa <public-key>
```
or
```
ec2-user@# set system root-authentication plain-text-password
New password: password
Retype new password: password
```
Optionally, enable passwords for SSH if you want to create password access for additional users.
```
ec2-user@# delete services ssh no-passwords
```
Configure the hostname.
```
ec2-user@# set system host-name host-name
```
For each vSRX Virtual Firewall revenue interface, assign the IP address defined on AWS. For example:
```
ec2-user@# set interfaces ge-0/0/0 unit 0 family inet address 10.0.10.197/24 
```
For multiple private addresses, enter a set command for each address. Do not assign the Elastic IP address.

Specify a security zone for the public interface.

content_copy zoom_out_map
ec2-user@# set security zones security-zone untrust interfaces ge-0/0/0.0 

Specify a security zone for the private interface.
```
ec2-user@# set security security-zone trust interfaces ge-0/0/1.0 
```
Configure routing to add a separate virtual router and routing option for the public and private interfaces.
Note:
We recommend putting the revenue (data) interfaces in routing instances as a best practice to avoid asymmetric traffic/routing, because fxp0 is part of the default (inet.0) table by default. With fxp0 as part of the default routing table, there might be two default routes needed: one for the fxp0 interface for external management access, and the other for the revenue interfaces for traffic access. Putting the revenue interfaces in a separate routing instance avoids this situation of two default routes in a single routing instance.
```
set routing-instances aws instance-type virtual-router 
set routing-instances aws interface ge-0/0/0.0 
set routing-instances aws interface ge-0/0/1.0 
set routing-instances aws interface st0.1 
set routing-instances aws routing-options static route 0.0.0.0/0 next-hop 10.0.0.1 
set routing-instances aws routing-options static route 10.20.20.0/24 next-hop st0.1
```

Verify the configuration.

content_copy zoom_out_map
ec2-user@# commit check
configuration check succeeds

Commit the configuration to activate it on the device.
```
ec2-user@# commit
commit complete
```
Optionally, use the show command to display the configuration to verify that it is correct.

For an example of how to configure vSRX Virtual Firewall to NAT all hosts behind the vSRX Virtual Firewall instance in the Amazon Virtual Private Cloud (Amazon VPC) to the IP address of the vSRX Virtual Firewall egress interface on the untrust zone, see Example: Configuring NAT for vSRX. This configuration allows hosts behind vSRX Virtual Firewall in a cloud network to access the Internet.

For an example of how to configure IPsec VPN between two instances of vSRX Virtual Firewall on AWS on different Amazon VPCs, see Example: Configure VPN on vSRX Between Amazon VPCs.

Add DNS Servers

vSRX Virtual Firewall does not include any DNS servers in the default configuration. You might need DNS configured to deploy Layer 7 services, such as IPS, to pull down signature updates, for example. You can use your own external DNS server or use an AWS DNS server. If you enable DNS on your Amazon VPC, queries to the Amazon DNS server (169.254.169.253) or the reserved IP address at the base of the VPC network range plus two should succeed. See AWS - Using DNS with Your Amazon VPC for complete details.

Add vSRX Virtual Firewall Feature Licenses

Certain Junos OS software features require a license to activate the feature. To enable a licensed feature, you need to purchase, install, manage, and verify a license key that corresponds to each licensed feature. To conform to software feature licensing requirements, you must purchase one license per feature per instance. The presence of the appropriate software unlocking key on your virtual instance allows you to configure and use the licensed feature.

See Managing Licenses for vSRX for details.

arrow_backward PREVIOUS Deploying vSRX Virtual Firewall 3.0 for Securing Data using AWS KMS

NEXT arrow_forward Configure vSRX Virtual Firewall Using the J-Web Interface

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE

Configure vSRX Virtual Firewall Using the CLI

Understand vSRX Virtual Firewall on AWS Preconfiguration and Factory Defaults

Add a Basic vSRX Virtual Firewall Configuration

Add DNS Servers

Add vSRX Virtual Firewall Feature Licenses

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE

Configure vSRX Virtual Firewall Using the CLI

Understand vSRX Virtual Firewall on AWS Preconfiguration and Factory Defaults

Add a Basic vSRX Virtual Firewall Configuration

Add DNS Servers

Add vSRX Virtual Firewall Feature Licenses

Related Documentation

Stay in touch