Prepare Your Server for vSRX Virtual Firewall Installation

date_range 27-May-23

arrow_backward

arrow_forward

Enable Nested Virtualization

We recommend that you enable nested virtualization on your host OS or OpenStack compute node. Nested virtualization is enabled by default on Ubuntu but is disabled by default on CentOS.

Use the following command to determine if nested virtualization is enabled on your host OS. The result should be Y.

hostOS# cat /sys/module/kvm_intel/parameters/nested

hostOS# Y

Note:

APIC virtualization (APICv) does not work well with nested VMs such as those used with KVM. On Intel CPUs that support APICv (typically v2 models, for example E5 v2 and E7 v2), you must disable APICv on the host server before deploying vSRX Virtual Firewall.

To enable nested virtualization on the host OS:

Depending on your host operating system, perform the following:
- On CentOS, open the /etc/modprobe.d/dist.conf file in your default editor.
  hostOS# vi /etc/modprobe.d/dist.conf
- On Ubuntu, open the /etc/modprobe.d/qemu-system-x86.conf file in your default editor.
  hostOS# vi /etc/modprobe.d/qemu-system-x86.conf
Add the following line to the file:
```
hostOS# options kvm-intel nested=y enable_apicv=n
```
Note:
A Page Modification Logging (PML) issue related to the KVM host kernel might prevent the vSRX Virtual Firewall from successfully booting. We recommend that you add the following line to the file instead of the line listed above in Step 2:

hostOS# options kvm-intel nested=y enable_apicv=n pml=n
Save the file and reboot the host OS.
(Optional) After the reboot, verify that nested virtualization is enabled.
```
hostOS# cat /sys/module/kvm_intel/parameters/nested
```
```
hostOS# Y
```

On Intel CPUs that support APICv ( for example, E5 v2 and E7 v2), disable APICv on the host OS.

content_copy zoom_out_map
root@host# sudo rmmod kvm-intel
root@host# sudo sh -c “echo ’options kvm-intel enable_apicv=n’ >> /etc/modprobe.d/dist.conf” 
root@host# sudo modprobe kvm-intel 

Optionally, verify that APICv is now disabled.
```
root@host# cat /sys/module/kvm_intel/parameters/enable_apicv 
```
```
N
```

Upgrade the Linux Kernel on Ubuntu

To upgrade to the latest stable Linux kernel on Ubuntu:

Get and install the available updated kernel.
hostOS:$ sudo apt-get install linux-image-generic-lts-utopic
Reboot the host OS.
hostOS:$ reboot
Optionally, type uname -a in a terminal on your host OS to verify that the host OS is using the latest kernel version.
hostOS:$ uname -a
```
3.16.0-48-generic
```

arrow_backward PREVIOUS Requirements for vSRX Virtual Firewall on KVM

NEXT arrow_forward Install vSRX Virtual Firewall with KVM

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE

Prepare Your Server for vSRX Virtual Firewall Installation

Enable Nested Virtualization

Upgrade the Linux Kernel on Ubuntu

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry