Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Deploy vSRX Virtual Firewall in Google Cloud Platform

The following procedures describe how to deploy vSRX Virtual Firewall in the Google Virtual Private Cloud (VPC):

  • Deploy the vSRX Virtual Firewall Firewall from Google Cloud Platform Marketplace.

  • Use custom private image to deploy the vSRX Virtual Firewall Firewall from the GCP portal.

  • Use cloud-init to deploy the vSRX Virtual Firewall Firewall through gcloud using CLI.

Deploy the vSRX Virtual Firewall Firewall from Marketplace Launcher

You can use the Google Cloud Platform Marketplace to deploy your vSRX3.0 with licenses as avirtual machine(VM) running on a Google Compute Engine instance.

Before you deploy the vSRX Virtual Firewall, you must create or choose a project in your organization and create any networks and subnets that will connect to the firewall. You cannot attach multiple network interfaces to the same VPC network. Every interface you create must have a dedicated network with at least one subnet.

This topic provide your step to deploy a vSRX Virtual Firewall Firewall from the Google Cloud Platform Marketplace Launcher.

  1. Log in to the Google Cloud Platform console.
  2. In the left navigation area, select Marketplace.
  3. Locate the vSRX Virtual Firewall listing in the Marketplace.

    In the Search box, type ’Juniper’ or ’vSRX Virtual Firewall’ and click one of the following options based on your licensing requirements as shown in Figure 1.

    The images are available from cloud:

    • vSRX Virtual Firewall Next Generation Firewall

    • vSRX Virtual Firewall Next Generation Firewall-BYOL

    • vSRX Virtual Firewall Next Generation Firewall with Anti-Virus Protection

    Figure 1: Locate vSRX Virtual Firewall Listing in the GCP MarketplaceLocate vSRX Virtual Firewall Listing in the GCP Marketplace
  4. Click Launch on Compute Engine. The deployment page appears as shown in Figure 2.
    Figure 2: Launch vSRX Virtual Firewall Instance in GCP from MarketplaceLaunch vSRX Virtual Firewall Instance in GCP from Marketplace
  5. Name the instance and choose resources.

    Provide the details for the vSRX Virtual Firewall VM:

    • Deployment Name—Enter a unique name for your vSRX Virtual Firewall VM.

    • Machine type—Select a machine type based on the system requirements for your license.

    • SSH key—Paste your public SSH key that you created earlier.

      • Paste the key after the text gcp-user:

        Note:

        It is mandatory to use “gcp-user” as username when you login to the vSRX Virtual Firewall for the first time vSRX Virtual Firewall.

      • Select the Block project-wide SSH keys option.

    • Network interfaces—Select the VPC network and the subnets. Note that you can add only those subnets that you’ve created for the selected zone for this vSRX Virtual Firewall VM.

    • IP Forwarding—Retain the default value On. This is a mandatory requirement for the vSRX Virtual Firewall VM.

    • Enable External IP—Select the ephemeral option. This setting allows the GCP to provide an ephemeral IP address to act as the external IP address.

    • Allow HTTP traffic from the Internet—Retain the default value as selected. We recommend not providing HTTP access unless absolutely necessary.

    • Allow TCP port 22 traffic from the Internet—Retain the default value as selected. F or security reasons, we recommend that you limit the SSH access only to the specific IP address to access the vSRX Virtual Firewall

    Name the instance and choose resources as shown in Figure 3.

    Figure 3: Name vSRX Virtual Firewall Instance and Choose Resources in GCP MarketplaceName vSRX Virtual Firewall Instance and Choose Resources in GCP Marketplace

    1. Choose a Deployment Name. The name must be unique and cannot conflict with any other deployment in the project.

    2. Select a zone.

    3. Select a machine type.

    4. Set the SSH Key as shown in Figure 4.

      Figure 4: SSH KeySSH Key

    5. Configure the network and subnet.

    6. Leave IP forwarding ‘on’ (mandatory for vSRX Virtual Firewall deployments) as shown in Figure 5.

      Figure 5: IP Forwarding ConfigurationIP Forwarding Configuration
  6. Accept GCP Marketplace Terms of Service.
  7. Click Deploy.

    The system shows the progress of your vSRX Virtual Firewall deployment. It displays a message indicating the successful completion of the deployment and sends you an e-mail notification for the same.

  8. Click your VM to view the details. You can view your VM details by navigating to the Compute Engine under COMPUTE in the left navigation area.

    Make note of the external IP address, shown under Network interfaces. You'll need this address later to log on to your vSRX Virtual Firewall instance using the CLI.

  9. Logging in to a vSRX Virtual Firewall Instance.

    In GCP deployments, vSRX Virtual Firewall instances provide the following capabilities by default to enhance security:

    • Allows you to login only through SSH.

    • cloud-init is used to setup SSH key login.

    • SSH password login is disabled for root account.

    Note:

    Root login using SSH password is be disabled by default.

    Use an SSH client to log in to a vSRX Virtual Firewall instance for the first time. To log in, specify the location where you saved the SSH key pair file for the user account, and the IP address assigned to the vSRX Virtual Firewall management interface (fxp0).

    Note:

    Root login using a Junos OS password is disabled by default. You can configure other users after the initial Junos OS setup phase.

    If you do not have the key pair filename and the IP address, use these steps to view the key pair name and IP for a vSRX Virtual Firewall instance:

    1. In the GCP portal, select Instances.
    2. Select the vSRX Virtual Firewall instance, and select eth0 in the Description tab to view the IP address for the fxp0 management interface.
    3. Click Connect above the list of instances to view the SSH key pair filename.

    To configure the basic settings for the vSRX Virtual Firewall instance, see Configure vSRX Using the CLI.

    Note:

    gcloud connect to vSRX Virtual Firewall is not supported. Always use ssh with user provided key to connect to vSRX Virtual Firewall after instance is up.

Deploy the vSRX Virtual Firewall Instance from GCP Portal Using Custom Private Image

You can also use your custom private image to deploy the vSRX Virtual Firewall instead of deploying an image from GCP marketplace. Firstly you need upload the private image to Google Cloud storage, then create compute image in GCP, and then deploy vSRX Virtual Firewall on Google Compute Engine.

Watch the video Deploying vSRX Virtual Firewalls on Google Cloud Platform to understand how you can deploy vSRX Virtual Firewall instances from GCP.

Upload vSRX Virtual Firewall Image to Google Cloud Storage

To upload vSRX Virtual Firewall image to Google Cloud Storage:

  1. Prepare the private vSRX Virtual Firewall image file.

    A custom image is a boot disk image that is private to you. To import a disk image to Google Compute Engine, the image file must meet the following requirements.

    • Disk image filename must be disk.raw.

    • RAW image file must have a size in an increment of 1 GB. For example, the file must be either 10 GB or 11 GB but not 10.5 GB.

    • Compressed file must be a .tar.gz file that uses gzip compression and the GNU tar format.

    To use .qcow2 vSRX Virtual Firewall image to generate .tar.gz file follow below steps to process the upload.

    1. Convert .qcow2 to "disk.raw" (disk.raw is the dedicate name for google cloud deployment).

      qemu-img convert -f qcow2 -O raw junos-vsrx3-x86-64-19.2I-20190115_dev_common.0.1057.qcow2 disk.raw

    2. Compress to .tgz file.

      tar -czf vsrx-0115.tar.gz disk.raw

  2. Upload image to Google Cloud Storage. You can upload your custom private image in two ways:

    • Upload image through SDK shell

    • Upload image from Google Cloud Platform portal

Upload image through SDK shell:

Install Google Cloud SDK on Ubuntu.

You must install Google Cloud SDK on your operation system. below is the sample to install it on Ubuntu.

For more information on Google Cloud SDK installation on Ubuntu, see https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu and for Gcloud command-line tool overview, see https://cloud.google.com/sdk/gcloud/.

To upload image through SDK shell:

  1. Create google cloud storage.

    gs://vsrx-image

  2. Copy disk.raw to cloud storage.

    gsutil cp vsrx-0115.tar.gz gs://vsrx-image

To upload image from Google Cloud Platform portal.

  1. Click Storage->Create Bucket->Upload files as shown in Figure 6.

    Figure 6: vSRX Virtual Firewall Image Upload from GCP PortalvSRX Virtual Firewall Image Upload from GCP Portal

  2. Check the private image is available in Google Cloud Storage by selecting Storage -> Bucket detail in Google Cloud Platform web as shown in Figure 7.

    Figure 7: View Private Images in GCP PortalView Private Images in GCP Portal

Create vSRX Virtual Firewall Image

After you upload the vSRX Virtual Firewall image file to GCP storage you need to create GCP compute image for vSRX Virtual Firewall deployment.

  1. Create image in cloud.

    A sample to create vSRX Virtual Firewall image using the package ready in GCP project storage is shown below. The option of 'multi_ip_subnet' is mandatory.

    gcloud compute images create vsrx-0115 '--guest-os-features=multi_ip_subnet' --source-uri=gs://vsrx-image/vsrx-0115.tar.gz

  2. Check the private image is available in Google Cloud Compute Engine.

    root@cnrd-ubuntu173:~# gcloud compute images list | grep vsrx3-194* vsrx-0115. vsrx3-218606 READY

Using Google Console

You can rename the image file using the Google console as well.

  1. Log in to your Google account and open the Google Cloud Platform home page.

  2. Click theimages option on the Google Cloud Platform page. The Create an image page opens as shown in Figure 8

    Figure 8: Google Cloud Platform Image Creation PageGoogle Cloud Platform Image Creation Page

  3. Fill in the required details in the Create an image page and click Create.

    Note:

    It is mandatory to use “gcp-user” as username when you login to the vSRX Virtual Firewall for the first time vSRX Virtual Firewall.

  4. Check the private image that available in Google Cloud Compute Engine. On Google Cloud Platform web, click Compute Engine->Images as shown in Figure 9.

    Figure 9: Check Private Image in Google Cloud Compute EngineCheck Private Image in Google Cloud Compute Engine

Deploy the vSRX Virtual Firewall Firewall from GCP Portal

You can follow below steps to deploy a vSRX Virtual Firewall instance:

  1. Login Google Cloud Platform portal, go to Compute Engine -> VM instances and click CREATE INSTANCE.
  2. Configure a vSRX Virtual Firewall instance.

    • Name—Specify a unique name to the instance.

    • Region—Select proper region you want to deploy the vSRX Virtual Firewall on, you must already create subnet in same region in proper VPC networks.

    • Machine configuration —Choose correct machine type.

    • Container —Uncheck

    • Boot Disk—Choose the private image in Custom Images tab as shown in Figure 10. You must already upload the private image to Google Cloud Storage.

      Figure 10: Boot Disk from Custom ImagesBoot Disk from Custom Images

    • Identity and API access—Set default

    • Firewall / Management —Set default

    • Firewall / Security—Paste your SSH Key pair here. Details please reference “Prepare to setup vSRX Virtual Firewall on GCP – SSH Key”.

    • Firewall / Disks—Set default

    • Firewall / Networking:

      Table 1: Firewall Networking

      Firewall / Networking

      Details

      Hostname

      Optional, you can specify tags for the instance used for route configuration.

      Network Interfaces

      Default

      You can set interfaces to existing VPC networks and subnet in same region. Interface number, Interface order and manage interface setting.
  3. Click Create
  4. Logging in to a vSRX Virtual Firewall Instance.

    In GCP deployments, vSRX Virtual Firewall instances provide the following capabilities by default to enhance security:

    • Allows you to login only through SSH.

    • SSH password login is disabled for root account.

    Note:

    Root login using a Junos OS password or SSH password is disabled by default. You can configure other users after the initial Junos OS setup phase.

    Use an SSH client to log in to a vSRX Virtual Firewall instance for the first time. To log in, specify the location where you saved the SSH key pair file for the user account, and the IP address assigned to the vSRX Virtual Firewall management interface (fxp0).

    Note:

    It is mandatory to use “gcp-user” as username when you login to the vSRX Virtual Firewall for the first time vSRX Virtual Firewall.

    If you do not have the key pair filename and the IP address, use these steps to view the key pair name and IP for a vSRX Virtual Firewall instance:

    1. In the GCP portal, select Instances.
    2. Select the vSRX Virtual Firewall instance, and select eth0 in the Description tab to view the IP address for the fxp0 management interface.
    3. Click Connect above the list of instances to view the SSH key pair filename.

    To configure the basic settings for the vSRX Virtual Firewall instance, see Configure vSRX Using the CLI.

    Note:

    gcloud connect to vSRX Virtual Firewall is not supported. Always use ssh with user provided key to connect to vSRX Virtual Firewall after instance is up.

Deploy the vSRX Virtual Firewall Firewall Using Cloud-init

vSRX Virtual Firewall supports cloud-init. Cloud-init is an open-source multi-distribution package that handles early initialization of a cloud instance. It allows user to customize VM instance with attributes like hostname and default IP on the first boot. Cloud-init is particularly useful when user wants to deploy large number of VM instances in the data center using automation tools.

Some of the initial provisioning parameters for first boot are:

  • Hostname

  • Root password

  • SSH public key

    Note:

    for the ssh key file, it needs to be in the format "<username>:<key value>" as required by google cloud. Something like this:

  • Management interface (fxp0) IP

  • Default gateway IP

You can deploy vSRX Virtual Firewall Firewall using cloud-init in two ways:

GCE supports cloud-init type instance configuration. To launch instance with user data, use the command below as an example.

Figure 11: Sample Cloud-Init Configuration Sample Cloud-Init Configuration

Please note the following points:

  • junos.conf is configuration file with ‘#junos-config’ in content

  • gcp-user.pub is ssh public key

  • vSRX Virtual Firewall 3.0 supports RSA key pair only

  • For the SSH key file, it needs to be in the format <username>:<key value> as required by Google cloud. Refer the sample SSH key file below.

  • In junos.conf, please remove the “gcp-default” block in your user data. They will shadow the one created by vSRX Virtual Firewall init script. Refer the sample junos config

    Note:

    gcloud connect to vSRX Virtual Firewall is not supported. Always use ssh with user provided key to connect to vSRX Virtual Firewall after instance is up.

Related Documentation