Deploy vSRX Virtual Firewall in Google Cloud Platform

You can use the Google Cloud Platform Marketplace to deploy your vSRX3.0 with licenses as avirtual machine(VM) running on a Google Compute Engine instance.

Before you deploy the vSRX Virtual Firewall, you must create or choose a project in your organization and create any networks and subnets that will connect to the firewall. You cannot attach multiple network interfaces to the same VPC network. Every interface you create must have a dedicated network with at least one subnet.

This topic provide your step to deploy a vSRX Virtual Firewall Firewall from the Google Cloud Platform Marketplace Launcher.

vSRX Virtual Firewall supports cloud-init. Cloud-init is an open-source multi-distribution package that handles early initialization of a cloud instance. It allows user to customize VM instance with attributes like hostname and default IP on the first boot. Cloud-init is particularly useful when user wants to deploy large number of VM instances in the data center using automation tools.

Some of the initial provisioning parameters for first boot are:

• Hostname

• Root password

• SSH public key

  Note:

  for the ssh key file, it needs to be in the format "<username>:<key value>" as required by google cloud. Something like this:

• Management interface (fxp0) IP

• Default gateway IP

You can deploy vSRX Virtual Firewall Firewall using cloud-init in two ways:

• From Google SDK

• To deploy vSRX Virtual Firewall with cloud-init from Google portal, see Deploy the vSRX Virtual Firewall Firewall from GCP Portal. To add user-data to have cloud init enabled specify the metadata.

GCE supports cloud-init type instance configuration. To launch instance with user data, use the command below as an example.

Figure 11: Sample Cloud-Init Configuration

Please note the following points:

• junos.conf is configuration file with ‘#junos-config’ in content

• gcp-user.pub is ssh public key

• vSRX Virtual Firewall 3.0 supports RSA key pair only

• For the SSH key file, it needs to be in the format <username>:<key value> as required by Google cloud. Refer the sample SSH key file below.

  content_copy zoom_out_map

  root@cnrd-kvmsrv37:~# cat gcp-user.pub
  ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDeR2jhMLzSfgee/5cnduTa+13yVLKbTa/
  OFnZSHQsZoA5LKHIXs/TbyooZTX5PnfNr6hx2Iyxjaodu01kT0UJ87wps8n9BH74DP6x0YK07OaZZl5T/
  5Iso9fXRCzl9+go9vKzNKhqXmqKUc3Fl6hTX2QzQbtrwN2twLzCxz+OSliCoobJr+/
  8wPcvI6fUbL6FRTgE1zC1HBlDKspK7x47YDYPJlUcyMhRtGvxd319jrx5i96mZq850+
  dCfZkHSipT09hFRtk8C4MsOaKsw3RWUCY5LCPekrutrLLfhMKh88onv4ud7gXOklSwgVVod49aY2FfiaACMAVoaomfYXweP 
  gcp-user
  
  
  
  ssh -i <private-key> gcp-user@<vSRX management public ip>

• In junos.conf, please remove the “gcp-default” block in your user data. They will shadow the one created by vSRX Virtual Firewall init script. Refer the sample junos config

  content_copy zoom_out_map

      #junos-config
  security {
      policies {
          default-policy {
              permit-all;
          }
      }
      zones {
          security-zone trust {
              interfaces {
                  ge-0/0/0.0;
              }
          }
          security-zone untrust {
              interfaces {
                  ge-0/0/1.0;             
              }
          }
      }
  }
  interfaces {
      ge-0/0/0 {
          unit 0 {
              family inet {
                  10.0.0.10/24;
              }
          }
      }
      ge-0/0/1 {
          unit 0 {
              family inet {
                  10.0.1.10/24;
              }
          }
      }
  }
  

  Note:

  gcloud connect to vSRX Virtual Firewall is not supported. Always use ssh with user provided key to connect to vSRX Virtual Firewall after instance is up.