vSRX Virtual Firewall Readiness Checks in IBM Cloud

A readiness check verifies the ability of your IBM Cloud™ Juniper vSRX Virtual Firewall to perform certain gateway actions. They include:

• OS reloads

• License upgrades

• Version upgrades

Once you run the readiness check, errors will alert you to any necessary actions you should take before beginning one of these actions, or inform you that you're ready to proceed.

To run a readiness check, perform the following procedure:

1. From your browser, open the IBM Cloud catalog and log in to your account.

2. Select the Menu from the top left, then click Classic Infrastructure.

3. Choose Network > Gateway Appliances.

4. Click the name of the vSRX Virtual Firewall you want to run a readiness check on.

5. Find the Readiness Check module on the vSRX Virtual Firewall details page.

6. Click the Run check button.

7. The details page for your vSRX Virtual Firewall displays again, as do the test results in the readiness check module.

   Note:

   Ensure the status for any action you wish to perform is Ready before beginning that action.

There are seven unique status conditions for the readiness check that you may encounter.

• Unchecked—A readiness check has not yet been run for this action.

• Expired—The readiness check has not run recently enough to reflect accurate results. Run a new check to see the current status.

• Ready—Your vSRX Virtual Firewall is ready to perform the given action.

• Not Ready—Your vSRX Virtual Firewall is not ready to perform the action in question. This could occur because of several reasons. Either a readiness check error occurred, or the readiness check did not complete fast enough, and timed out.

  Error messages for the issues found during the readiness check display next to the module. Click on the error codes to get more information on each error. Alternatively, you can find information about each error in the topic Understanding readiness errors.

• Running—The readiness check is currently running on your vSRX Virtual Firewall, and has not currently encountered any errors.

• Incomplete—The first member of the gateway's highly available (HA) setup failed the readiness check. As a result, the gateway could not complete the readiness check.

• Unsupported—The action you are attempting to check is not supported for this gateway.

• Current— The action you are attempting to check does not need to be performed, as the gateway already has the latest version available.

Readiness check errors you may encounter can either be common errors or version upgrade errors. The below lists provide additional information on these error codes.

To understand common errors that might occur when running readiness checks, see Common readiness errors.

There are two categories of errors you might encounter when performing readiness checks:

• Host (Ubuntu) SSH connectivity errors

• Gateway (vSRX Virtual Firewall) SSH connectivity errors

Many of these errors result from the fact that the gateway actions being checked require root SSH access to the private IP address for either the Ubuntu (Host) OS or the vSRX Virtual Firewall (Gateway). If a SSH connectivity check fails, then the action cannot proceed.

For details on how to ensure that the SSH session can be established, refer to Accessing the device using SSH. Note that for step 3, the example given is with the admin user. For a readiness check, substitute the root user for both the vSRX Virtual Firewall and the Hardware (host). Also, make sure you use your private IP with this procedure, not your public one.

To validate connectivity, open an SSH session to either the Ubuntu host's or vSRX Virtual Firewall's private IP using the root credentials listed in the Hardware section (for an Ubuntu host) or the vSRX Virtual Firewall section (for the gateway) of the Gateway Details page. Ensure that the SSH session can be established.

If the session cannot be established, check the potential following issues:

• For Host (Ubuntu) SSH connectivity errors:

  • Is the Ubuntu firewall blocking SSH access to the private IP? The firewall rules must allow SSH access to the private 10.0.0.0/8 subnet. For more information on IBM Cloud IP Ranges for the service network, see IBM Cloud IP ranges.

  • Is the root password listed on the Gateway Details page the correct password for the root user? If not, click the device link under the Hardware section and navigate to Passwords. Select Actions > Edit credentials nd change the password to match the actual root password on the Ubuntu host.

  • Is the root login disabled for the SSH server? Is the SSH server disabled or stopped?

  • Is the root user account disabled on the Ubuntu host?

• For Gateway (vSRX) SSH connectivity errors:

  • Is the vSRX Virtual Firewall firewall blocking SSH access to the private IP? The firewall rules must allow SSH access to the private 10.0.0.0/8 subnet. For more information on IBM Cloud IP Ranges for the service network, see IBM Cloud IP ranges.

  • Is the root password listed on the Gateway Details page the correct password for the root user? If not, click the Edit icon next to the root password and change the password to match the actual root password for the vSRX Virtual Firewall.

  • Is the root user account disabled for SSH access to the vSRX Virtual Firewall?