Requirements for vSRX Virtual Firewall on KVM
This section presents an overview of requirements for deploying a vSRX Virtual Firewall instance on KVM;
Software Specifications
The table below lists the system software requirement specifications when deploying vSRX Virtual Firewall in a KVM environment. The table outlines the Junos OS release in which a particular software specification for deploying vSRX Virtual Firewall on KVM was introduced. You will need to download a specific Junos OS release to take advantage of certain features.
A Page Modification Logging (PML) issue related to the KVM host kernel might prevent the vSRX Virtual Firewall from successfully booting. If you experience this behavior with the vSRX Virtual Firewall, we recommend that you disable the PML at the host kernel level. See Prepare Your Server for vSRX Installation for details about disabling the PML as part of enabling nested virtualization.
| Features | Specification | Junos OS Release Introduced |
|---|---|---|
| vCPUs/Memory |
2 vCPU / 4 GB RAM |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 (vSRX Virtual Firewall) |
|
5 vCPU / 8 GB RAM |
Junos OS Release 15.1X49-D70 and Junos OS Release 17.3R1 (vSRX Virtual Firewall) |
|
|
9 vCPU / 16 GB RAM |
Junos OS Release 18.4R1 (vSRX Virtual Firewall) Junos OS Release 19.1R1 (vSRX Virtual Firewall 3.0) |
|
|
17 vCPU / 32 GB RAM |
Junos OS Release 18.4R1 (vSRX Virtual Firewall) Junos OS Release 19.1R1 (vSRX Virtual Firewall 3.0) |
|
|
Flexible flow session capacity scaling by an additional vRAM |
NA |
Junos OS Release 19.1R1 (vSRX Virtual Firewall) Junos OS Release 19.2R1 (vSRX Virtual Firewall 3.0) |
|
Multicore scaling support (Software RSS) |
NA | Junos OS Release 19.3R1 (vSRX Virtual Firewall 3.0 only) |
|
Reserve additional vCPU cores for the Routing Engine (vSRX Virtual Firewall and vSRX Virtual Firewall 3.0) |
NA | |
|
Virtio (virtio-net, vhost-net) (vSRX Virtual Firewall and vSRX Virtual Firewall 3.0) |
NA | |
| Supported Hypervisors | ||
|
Linux KVM Hypervisor support Note:
Starting with the specified Junos OS Releases mentioned here, all subsequent Junos OS Releases also support these RHEL versions and later releases. |
Ubuntu 14.04.5, 16.04, and 16.10 |
Junos OS Release 18.4R1 |
| Ubuntu 18.04 and 20.04 | Junos OS Release 20.4R1 | |
| Red Hat Enterprise Linux (RHEL) 7.3, 7.6, and 7.7 | Junos OS Release 18.4R1 | |
| Red Hat Enterprise Linux (RHEL) 8.2 | Junos OS Release 19.2R1 | |
| Red Hat Enterprise Linux (RHEL) 9 | Junos OS Release 23.4R1 | |
| CentOS 7.1, 7.2, 7.6, and 7.7 | Junos OS Release 20.4R1 | |
| Other Features | ||
|
Cloud-init |
NA | |
|
Powermode IPSec (PMI) |
NA | |
|
Chassis cluster |
NA | |
|
GTP TEID based session distribution using Software RSS |
NA | Yes (Junos OS Release 19.3R1 onwards) |
|
On-device antivirus scan engine (Avira) |
NA | Yes (Junos OS Release 19.4R1 onwards) |
|
LLDP |
NA | Yes (Junos OS Release 21.1R1 onwards) |
|
Junos Telemetry Interface |
NA | Yes (Junos OS Release 20.3R1 onwards) |
| System Requirements | ||
|
Hardware acceleration/enabled VMX CPU flag in the hypervisor |
NA | |
|
Disk space |
16 GB (IDE or SCSI drives) (vSRX Virtual Firewall) |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 |
|
18 GB (vSRX Virtual Firewall 3.0) |
||
| vNICs | Release Introduced |
|---|---|
| Virtio SA and HA | |
| SR-IOV SA and HA over Intel 82599/X520 series | Junos OS Release 15.1X49-D90 and Junos OS Release 17.3R1 |
| SR-IOV SA and HA over Intel X710/XL710/XXV710 series | Junos OS Release 15.1X49-D90 |
| SR-IOV SA and HA over Intel E810 series | Junos OS Release 21.2R1 Note:
Starting with Junos OS Release 23.2R2, only ICE driver 1.12.7 is compatible for E810 with vSRX 3.0. Version below 1.12.7 causes compatibility issue and will not bring up the FPC online. |
| SR-IOV SA and HA over Mellanox ConnectX-3 | Not supported |
| SR-IOV SA and HA over Mellanox ConnectX-4/5/6 (MLX5 driver only) |
Junos OS Release 18.1R1 (vSRX Virtual Firewall) Junos OS Release 21.2R1 onwards on vSRX Virtual Firewall 3.0 |
| PCI passthrough over Intel 82599/X520 series | Not supported |
| PCI passthrough over Intel X710/XL710 series | Not supported |
|
Data Plane Development Kit (DPDK) version 17.05 |
Junos OS Release 18.2R1 |
|
Data Plane Development Kit (DPDK) version 18.11 Starting in Junos OS Release 19.4R1, DPDK version 18.11 is supported on vSRX Virtual Firewall. With this feature the Mellanox Connect Network Interface Card (NIC) on vSRX Virtual Firewall now supports OSPF Multicast and VLANs. |
Junos OS Release 19.4R1 |
Data Plane Development Kit (DPDK) version 20.11 Starting in Junos OS Release 21.2R1, we've upgraded the Data Plane Development Kit (DPDK) from version 18.11 to version 20.11. The new version supports ICE Poll Mode Driver (PMD), which enables the physical Intel E810 series 100G NIC support on vSRX Virtual Firewall 3.0. |
Junos OS Release 21.2R1 |
A vSRX Virtual Firewall on KVM deployment requires you to enable hardware-based virtualization on a host OS that contains an Intel Virtualization Technology (VT) capable processor. You can verify CPU compatibility here: http://www.linux-kvm.org/page/Processor_support
The table below lists the specifications on the vSRX Virtual Firewall VM.
Starting in Junos OS Release 19.1R1, the vSRX Virtual Firewall instance supports guest OS using 9 or 17 vCPUs with single-root I/O virtualization over Intel X710/XL710 on Linux KVM hypervisor for improved scalability and performance.
- KVM Kernel Recommendations for vSRX Virtual Firewall
- Additional Linux Packages for vSRX Virtual Firewall on KVM
KVM Kernel Recommendations for vSRX Virtual Firewall
Table 3 lists the recommended Linux kernel version for your Linux host OS when deploying vSRX Virtual Firewall on KVM. The table outlines the Junos OS release in which support for a particular Linux kernel version was introduced.
|
Linux Distribution |
Linux Kernel Version |
Supported Junos OS Release |
|---|---|---|
|
CentOS |
3.10.0.229 Upgrade the Linux kernel to capture the recommended version. |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release |
|
Ubuntu |
3.16 |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release |
|
4.4 |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release |
|
| 18.04 |
Junos OS Release 20.4R1 or later release |
|
| 20.04 |
Junos OS Release 20.4R1 or later release |
|
|
RHEL |
3.10 |
Junos OS Release 15.1X49-D15 and Junos OS Release 17.3R1 or later release |
Additional Linux Packages for vSRX Virtual Firewall on KVM
Table 4 lists the additional packages you need on your Linux host OS to run vSRX Virtual Firewall on KVM. See your host OS documentation for how to install these packages if they are not present on your server.
|
Package |
Version |
Download Link |
|---|---|---|
|
libvirt |
0.10.0 |
|
|
virt-manager (Recommended) |
0.10.0 |
Hardware Specifications
Table 5 lists the hardware specifications for the host machine that runs the vSRX Virtual Firewall VM.
Component |
Specification |
|---|---|
Host processor type |
Intel x86_64 multi-core CPU Note:
DPDK requires Intel Virtualization VT-x/VT-d support in the CPU. See About Intel Virtualization Technology. |
Physical NIC support for vSRX Virtual Firewall and vSRX Virtual Firewall 3.0 |
Note:
If using SR-IOV with either the Mellanox ConnectX-3 or ConnectX-4 Family Adapters, on the Linux host, if necessary, install the latest MLNX_OFED Linux driver. See Mellanox OpenFabrics Enterprise Distribution for Linux (MLNX_OFED). Note:
You must enable the Intel VT-d extensions to provide hardware support for directly assigning physical devices per guest. See Configure SR-IOV and PCI on KVM. |
Physical NIC support for vSRX Virtual Firewall 3.0 |
Support SR-IOV on Intel X710/XL710/XXV710, and Intel E810. |
Best Practices for Improving vSRX Virtual Firewall Performance
Review the following practices to improve vSRX Virtual Firewall performance.
NUMA Nodes
The x86 server architecture consists of multiple sockets and multiple cores within a socket. Each socket has memory that is used to store packets during I/O transfers from the NIC to the host. To efficiently read packets from memory, guest applications and associated peripherals (such as the NIC) should reside within a single socket. A penalty is associated with spanning CPU sockets for memory accesses, which might result in nondeterministic performance. For vSRX Virtual Firewall, we recommend that all vCPUs for the vSRX Virtual Firewall VM are in the same physical non-uniform memory access (NUMA) node for optimal performance.
The Packet Forwarding Engine (PFE) on the vSRX Virtual Firewall will become unresponsive if the NUMA nodes topology is configured in the hypervisor to spread the instance’s vCPUs across multiple host NUMA nodes. vSRX Virtual Firewall requires that you ensure that all vCPUs reside on the same NUMA node.
We recommend that you bind the vSRX Virtual Firewall instance with a specific NUMA node by setting NUMA node affinity. NUMA node affinity constrains the vSRX Virtual Firewall VM resource scheduling to only the specified NUMA node.
Mapping Virtual Interfaces to a vSRX Virtual Firewall VM
To determine which virtual interfaces on your Linux host OS map to a vSRX Virtual Firewall VM:
Use the
virsh listcommand on your Linux host OS to list the running VMs.hostOS# virsh list
Id Name State ---------------------------------------------------- 9 centos1 running 15 centos2 running 16 centos3 running 48 vsrx running 50 1117-2 running 51 1117-3 running
-
Use the
virsh domiflist vsrx-namecommand to list the virtual interfaces on that vSRX Virtual Firewall VM.hostOS# virsh domiflist vsrx
Interface Type Source Model MAC ------------------------------------------------------- vnet1 bridge brem2 virtio 52:54:00:8f:75:a5 vnet2 bridge br1 virtio 52:54:00:12:37:62 vnet3 bridge brconnect virtio 52:54:00:b2:cd:f4
Note:The first virtual interface maps to the fxp0 interface in Junos OS.
Interface Mapping for vSRX Virtual Firewall on KVM
Each network adapter defined for a vSRX Virtual Firewall is mapped to a specific interface, depending on whether the vSRX Virtual Firewall instance is a standalone VM or one of a cluster pair for high availability. The interface names and mappings in vSRX Virtual Firewall are shown in Table 6 and Table 7.
Note the following:
In standalone mode:
fxp0 is the out-of-band management interface.
ge-0/0/0 is the first traffic (revenue) interface.
In cluster mode:
fxp0 is the out-of-band management interface.
em0 is the cluster control link for both nodes.
Any of the traffic interfaces can be specified as the fabric links, such as ge-0/0/0 for fab0 on node 0 and ge-7/0/0 for fab1 on node 1.
Table 6 shows the interface names and mappings for a standalone vSRX Virtual Firewall VM.
Network Adapter |
Interface Name in Junos OS for vSRX Virtual Firewall |
|---|---|
1 |
fxp0 |
2 |
ge-0/0/0 |
3 |
ge-0/0/1 |
4 |
ge-0/0/2 |
5 |
ge-0/0/3 |
6 |
ge-0/0/4 |
7 |
ge-0/0/5 |
8 |
ge-0/0/6 |
Table 7 shows the interface names and mappings for a pair of vSRX Virtual Firewall VMs in a cluster (node 0 and node 1).
Network Adapter |
Interface Name in Junos OS for vSRX Virtual Firewall |
|---|---|
1 |
fxp0 (node 0 and 1) |
2 |
em0 (node 0 and 1) |
3 |
ge-0/0/0 (node 0)ge-7/0/0 (node 1) |
4 |
ge-0/0/1 (node 0)ge-7/0/1 (node 1) |
5 |
ge-0/0/2 (node 0)ge-7/0/2 (node 1) |
6 |
ge-0/0/3 (node 0)ge-7/0/3 (node 1) |
7 |
ge-0/0/4 (node 0)ge-7/0/4 (node 1) |
8 |
ge-0/0/5 (node 0)ge-7/0/5 (node 1) |
vSRX Virtual Firewall Default Settings on KVM
vSRX Virtual Firewall requires the following basic configuration settings:
Interfaces must be assigned IP addresses.
Interfaces must be bound to zones.
Policies must be configured between zones to permit or deny traffic.
Table 8 lists the factory-default settings for security policies on the vSRX Virtual Firewall.
Source Zone |
Destination Zone |
Policy Action |
|---|---|---|
trust |
untrust |
permit |
trust |
trust |
permit |
untrust |
trust |
deny |