Requirements for vSRX Virtual Firewall on Contrail

Contrail Recommendations for vSRX Virtual Firewall

Table 3 lists the recommended software versions to run vSRX Virtual Firewall on Contrail.

Table 4 lists the contrail recommendations for vSRX Virtual Firewall.

NUMA Nodes

The x86 server architecture consists of multiple sockets and multiple cores within a socket. Each socket also has memory that is used to store packets during I/O transfers from the NIC to the host. To efficiently read packets from memory, guest applications and associated peripherals (such as the NIC) should reside within a single socket. A penalty is associated with spanning CPU sockets for memory accesses, which might result in nondeterministic performance. For vSRX Virtual Firewall, we recommend that all vCPUs for the vSRX Virtual Firewall VM are in the same physical non-uniform memory access (NUMA) node for optimal performance.

PCI NIC-to-VM Mapping

If the node on which vSRX Virtual Firewall is running is different from the node to which the Intel PCI NIC is connected, then packets will have to traverse an additional hop in the QPI link, and this will reduce overall throughput. On a Linux host OS, install the hwloc package and use the lstopo command to view information about relative physical NIC locations. On some servers where this information is not available, refer to the hardware documentation for the slot-to-NUMA node topology.

Mapping Virtual Interfaces to a vSRX Virtual Firewall VM

To determine which virtual interfaces on your Linux host OS map to a vSRX Virtual Firewall VM:

1. Use the virsh list command on your Linux host OS to list the running VMs.

   content_copy zoom_out_map

   hostOS# virsh list
   

   content_copy zoom_out_map

    Id    Name                           State
   ----------------------------------------------------
    25    instance-00000060              running
    31    instance-0000005b              running
    34    instance-000000bd              running
    35    instance-000000bc              running
    

2. Use the virsh domiflist vsrx-name command to list the virtual interfaces on that vSRX Virtual Firewall VM.

   content_copy zoom_out_map

   hostOS# virsh domiflist 31
   

   content_copy zoom_out_map

   Interface  Type       Source     Model       MAC
   -------------------------------------------------------
   tapd3d9639c-d5 ethernet   -          virtio      02:d3:d9:63:9c:d5
   tapc3c3751a-37 ethernet   -          virtio      02:c3:c3:75:1a:37
   tap8af29333-1b ethernet   -          virtio      02:8a:f2:93:33:1b
   tapf0387bee-9b ethernet   -          virtio      02:f0:38:7b:ee:9b
   tap04e4b59a-91 ethernet   -          virtio      02:04:e4:b5:9a:91

   Note:

   The first virtual interface maps to the fxp0 interface in Junos OS.