Understand vSRX Virtual Firewall with Microsoft Azure Cloud

vSRX Virtual Firewall with Microsoft Azure

Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, you can deploy the vSRX Virtual Firewall to the Microsoft Azure Cloud. Microsoft Azure is Microsoft's application platform for the public cloud. It is an open, flexible, enterprise-grade cloud computing platform for building, deploying, and managing applications and services through a global network of Microsoft-managed data centers. It provides Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) services. You place your virtual machines (VMs) onto Azure virtual networks, where the distributed and virtual networks in Azure help ensure that your private network traffic is logically isolated from traffic on other Azure virtual networks.

The Azure WALinuxAgent performs the provisioning job for the vSRX Virtual Firewall instances. When a new vSRX Virtual Firewall instance is deployed, the continued increasing size of the waagent log file might cause the vSRX Virtual Firewall to stop. If the vSRX Virtual Firewall is still operating, then delete the /var/log/waagent.log directly or run the clear log waagent.log all command to clear the log file.

Or you can run the set groups azure-provision system syslog file waagent.log archive size 1m and set groups azure-provision system syslog file waagent.log archive files 10 commands to prevent the growing of the waagent logs. These configurations will cause the rotation of log of waagent with the size bigger than 1MB and set a maximum of 10 backups.

You can add a vSRX Virtual Firewall virtual security appliance to provide networking security features as an application instance within an Azure virtual network. The vSRX Virtual Firewall protects the workloads that run within the virtual network on the Microsoft Azure Cloud.

You can deploy the vSRX Virtual Firewall VM in Azure using the following deployment methods:

• Azure Marketplace—Deploy the vSRX Virtual Firewall VM from the Azure Marketplace. The Azure Marketplace provides you with different methods to deploy a vSRX Virtual Firewall VM in your virtual network. You can choose a customized solution template offered by Juniper Networks to automate the vSRX Virtual Firewall VM deployment based on specific use cases (for example, a security gateway). A solution template automates the dependencies associated with specific deployment use cases, such as VM settings, virtual network settings (such as multiple subsets for the management interface (fxp0) and two revenue (data) interfaces), and so on. Or, you can select the vSRX Virtual Firewall VM image and define the deployment settings and dependencies based on your specific networking requirements. Starting in Junos OS Release 15.1X49-D91 for vSRX Virtual Firewall, you can deploy the vSRX Virtual Firewall to Microsoft Azure Cloud from the Azure Marketplace.

  Azure Marketplace also enables you to discover and subscribe to software that supports regulated workloads through Azure Marketplace for Azure Government Cloud (US).

• Azure CLI—Deploy the vSRX Virtual Firewall VM from the Azure CLI. You can customize the vSRX Virtual Firewall VM deployment settings and dependencies based on your network requirements in Microsoft Azure Cloud. To help automate and simplify the deployment of the vSRX Virtual Firewall VM in the Microsoft Azure virtual network, Juniper Networks provides a series of scripts, Azure Resource Manager (ARM) templates and parameter files, and configuration files in a GitHub repository.

  Note:

  Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, you can deploy the vSRX Virtual Firewall to Microsoft Azure Cloud from the Azure CLI.

In Microsoft Azure, you can host servers and services on the cloud as a pay-as-you-go (PAYG) or bring-your-own-license (BYOL) service.

Starting in Junos OS Release 15.1X49-D120, vSRX Virtual Firewall on Microsoft Azure Cloud supports the vSRX Virtual Firewall Premium-Next Generation Firewall with Anti-Virus Protection bundle for PAYG, available as 1-hour or 1-year subscriptions. This bundle includes:

• Standard (STD) features of core security, including core firewall, IPsec VPN, NAT, CoS, and routing services.

• Advanced Layer 4 through 7 security services such as AppSecure features of AppID, AppFW, AppQoS, and AppTrack, IPS and rich routing capabilities, including the Content Security antivirus feature.

Figure 1 illustrates the deployment of a vSRX Virtual Firewall in Microsoft Azure.

In the Microsoft Azure, public subnets have access to the Internet gateway, but private subnets do not. vSRX Virtual Firewall requires two public subnets and one or more private subnets for each individual instance group. The public subnets consist of one for the management interface (fxp0) and one for a revenue (data) interface. The private subnets, connected to the other vSRX Virtual Firewall interfaces, ensure that all traffic between applications on the private subnets and the Internet must pass through the vSRX Virtual Firewall instance.

Figure 1: vSRX Virtual Firewall Deployed to Microsoft Azure

For a glossary of Microsoft Azure terms see Microsoft Azure glossary.

Starting in Junos OS Release 21.4R1, vSRX Virtual Firewall 3.0 supports Azure Accelerated Networking (AAN) option that utilizes the Mellanox SR-IOV virtual function for high-speed networking.

Microsoft Azure has Azure Accelerated Networking (AAN) option for each attached network interface. The AAN utilizes the Mellanox SR-IOV virtual function for high-speed networking. vSRX Virtual Firewall 3.0 now supports AAN. vSRX Virtual Firewall 3.0 with AAN provides better network performance at Azure cloud.

We currently support only the below listed vSRX Virtual Firewall 3.0 instances for Azure AAN.

• Use the az network nic update --name <interface-name> --resource-group <resource-group> --accelerated-networking true command to enable AAN.

• Using the Web GUI: After you login to the Microsoft Azure portal:

  • Click Virtual networks and select the correct virtual network. networking”

    Click Connected devices, select the required NIC interface and then click Enable accelerated networking.

  • Click Virtual machines and select the required VM, then click Networking. Finally, click the pane of correct NIC interface and click Enable accelerated networking.

For more information see Enabling Accelerated Networking for replicated VMs.