Requirements for vSRX Virtual Firewall on Microsoft Azure

System Requirements for vSRX Virtual Firewall on Microsoft Azure Cloud

Starting in Junos OS Release 15.1X49-D80 and Junos OS Release 17.3R1, you can deploy the vSRX Virtual Firewall to the Microsoft Azure Cloud. Microsoft Azure supports a wide variety of sizes and options for deployed Azure virtual machines (VMs).

For the vSRX Virtual Firewall deployment in Microsoft Azure, we recommend DSv2-series VMs. The DSv2-series VMs provided from Microsoft Azure use Premium Storage(SSD) and are ideal for applications that demand faster CPUs and better local disk performance, or have higher memory demands. Of the available DSv2-series VMs, we recommend that you select Standard_DS3_v2, Standard_DS4_v2, or Standard_DS5_v2 for the vSRX Virtual Firewall VM deployment in Microsoft Azure. For more details, see DSv2-series.

Table 1 lists the properties of the Standard_DS3_v2 VM available in Microsoft Azure.

Table 2 lists the properties of the Standard_DS4_v2 VM available in Microsoft Azure.

Table 3 lists the properties of the Standard_DS5_v2 VM available in Microsoft Azure.

Network Requirements for vSRX Virtual Firewall on Microsoft Azure Cloud

When you deploy a vSRX Virtual Firewall VM in a Microsoft Azure virtual network, note the following specifics of the deployment configuration:

• A dual public IP network configuration is a requirement for vSRX Virtual Firewall VM network connectivity; the vSRX Virtual Firewall VM requires two public subnets and one or more private subnets for each instance group.

• The public subnets required by the vSRX Virtual Firewall VM consist of one subnet for the out-of-band management interface (fxp0) for management access and another for the two revenue (data) interfaces. By default, one interface is assigned to the untrust security zone and the other to the trust security zone on the vSRX Virtual Firewall VM.

• In the Microsoft Azure deployment of the vSRX Virtual Firewall VM, the vSRX Virtual Firewall supports the management interface (fxp0) and the two revenue (data) interfaces (port ge-0/0/0 and ge-0/0/1), which includes public IP address mapping and data traffic forwarding to and from the vSRX Virtual Firewall VM.

Microsoft Azure Instances and vSRX Virtual Firewall Instance Types

Microsoft Azure instance types supported for vSRX Virtual Firewall are listed in Table 4.

Interface Mapping for vSRX Virtual Firewall on Microsoft Azure

Table 5 lists the vSRX Virtual Firewall and Microsoft Azure interface names. The first network interface is used for the out-of-band management (fxp0) for vSRX Virtual Firewall.

We recommend putting revenue interfaces in routing instances as a best practice to avoid asymmetric traffic/routing, because fxp0 is part of the default (inet.0) table by default. With fxp0 as part of the default routing table, there might be two default routes needed: one for the fxp0 interface for external management access, and the other for the revenue interfaces for traffic access. Putting the revenue interfaces in a separate routing instance avoids this situation of two default routes in a single routing instance. Ensure that interfaces belonging to the same security zone are in the same routing instance.

vSRX Virtual Firewall Default Settings on Microsoft Azure

vSRX Virtual Firewall requires the following basic configuration settings:

• Interfaces must be assigned IP addresses.

• Interfaces must be bound to zones.

• Policies must be configured between zones to permit or deny traffic.

Table 6 lists the factory-default settings for security policies on the vSRX Virtual Firewall

Best Practices for Improving vSRX Virtual Firewall Performance

Review the following deployment practices to improve vSRX Virtual Firewall performance:

• Disable the source/destination check for all vSRX Virtual Firewall interfaces.

• Limit public key access permissions to 400 for key pairs.

• Ensure that there are no contradictions between Microsoft Azure security groups and your vSRX Virtual Firewall configuration.

• Use vSRX Virtual Firewall NAT to protect your instances from direct Internet traffic.