Understand vSRX Virtual Firewall with KVM

vSRX Virtual Firewall on KVM

The Linux kernel uses the kernel-based virtual machine (KVM) as a virtualization infrastructure. KVM is open source software that you can use to create multiple virtual machines (VMs) and to install security and networking appliances.

The basic components of KVM include:

• A loadable kernel module included in the Linux kernel that provides the basic virtualization infrastructure

• A processor-specific module

When loaded into the Linux kernel, the KVM software acts as a hypervisor. KVM supports multitenancy and allows you to run multiple vSRX Virtual Firewall VMs on the host OS. KVM manages and shares the system resources between the host OS and the multiple vSRX Virtual Firewall VMs.

Figure 1 illustrates the basic structure of a vSRX Virtual Firewall VM on an Ubuntu server.

Figure 1: vSRX Virtual Firewall VM on Ubuntu

vSRX Virtual Firewall Scale Up Performance

Table 1 shows the vSRX Virtual Firewall scale up performance when deployed on KVM, based on the number of vCPUs and vRAM applied to a vSRX Virtual Firewall VM along with the Junos OS release in which a particular vSRX Virtual Firewall software specification was introduced.

You can scale the performance and capacity of a vSRX Virtual Firewall instance by increasing the number of vCPUs and the amount of vRAM allocated to the vSRX Virtual Firewall. The multi-core vSRX Virtual Firewall automatically selects the appropriate vCPUs and vRAM values at boot time, as well as the number of Receive Side Scaling (RSS) queues in the NIC. If the vCPU and vRAM settings allocated to a vSRX Virtual Firewall VM do not match what is currently available, the vSRX Virtual Firewall scales down to the closest supported value for the instance. For example, if a vSRX Virtual Firewall VM has 3 vCPUs and 8 GB of vRAM, vSRX Virtual Firewall boots to the smaller vCPU size, which requires a minimum of 2 vCPUs. You can scale up a vSRX Virtual Firewall instance to a higher number of vCPUs and amount of vRAM, but you cannot scale down an existing vSRX Virtual Firewall instance to a smaller setting.