Migrate to vSRX3.0

Check vSRX Virtual Firewall Version

Check if your vSRX Virtual Firewall instance has vSRX2.0 or vSRX3.0 using the show version command:

Example-1

user@host-01> show version
Hostname: host-01
Model: vsrx

In the output, the field Model: vsrx with letters srx in lowercase represents vSRX2.0.

Example-2

user@host-01> show version
Hostname: host-01
Model: vSRX
Junos: 22.1R1.10

In the output, the field Model: vSRX with letters SRX in uppercase represents vSRX3.0.

Pre-Migration Checklist

Complete the following tasks before you migrate to vSRX3.0.

1. Check Junos OS version on your vSRX Virtual Firewall instance.

   content_copy zoom_out_map

   user@host-01> show version
   Hostname: host-01
   Model: vsrx
   Junos: 19.4R3.1

   The sample output indicates that your vSRX Virtual Firewall instance has Junos OS version 19.4R3 and with vSRX2.0.

2. Save the active configuration without any uncommitted changes.

   content_copy zoom_out_map

   user@host-01> show configuration | save /var/tmp/existingConfig.txt
   Wrote 273 lines of output to '/var/tmp/existingConfig.txt'

   The system saves the active configuration at the specified file location. Copy the saved file into your local workspace for later use.

3. Check your license requirements as per Figure 2. You might need a new license key, or you can re-apply the existing one.

   • If you require new license keys, obtain them from the Juniper Agile Licensing (JAL) portal (https://license.juniper.net/licensemanage/)
   • If you can re-apply the existing license key, save a copy of license file using the following steps:

     • Display license keys installed on your vSRX Virtual Firewall from the operational mode:

       content_copy zoom_out_map

       user@host-01> show system license keys
       DemolabJUNOS966777536 aeaqic beain4 vywmka bb3sxc zriaer ok4lgf
                             aattzl rmyuac ipfoft cqaj34 vywmka frembw
                             gaztem bsgiyd gmbzfv 4tkzcw hegbas tvnzux
                             azlseb ew45df ojxgc3 ahfbho wz2j2i fojb6m
                             z2jeif bwbml3 esqdkk dm4jxp j7o35h x6mvei
                             fd3sjp uubu3r udfzu
       

     • Copy license keys or save license keys to a file or URL with the following command:

       content_copy zoom_out_map

       user@host-01> request system license save filename | url 
       

4. Backup any other files on the vSRX2.0 VM, which you might require on the new vSRX3.0 VM (such as IPsec VPN certificates and scripts) (if applicable).

5. Ensure you have your server/host OS ready and setup the required virtual networks and storage pool in the host OS.

6. Power-off your vSRX2.0 VM before you start deploying the new vSRX3.0 VM.

Migration Procedure

Use the following steps to migrate from vSRX2.0 to vSRX3.0:

1. Navigate to the Juniper Networks Support page for the vSRX3.0 (https://support.juniper.net/support/downloads/?p=vsrx3) and select OS as vSRX3.0 and select the required versions shown in Figure 3.
   Figure 3: vSRX3.0 Download

2. Enter your credentials and review/accept the End User License Agreement. You’ll be guided to the software image download page. Follow the instructions on the page and download the Junos OS image file.

3. Install the downloaded vSRX Virtual Firewall VM on your server.

   When you download a vSRX3.0 image, the image file name includes vsrx3. Example: junos-install- vsrx3 -x86-64-21.2R3.8.tgz. See vSRX Deployment Guide for Private and Public Cloud Platforms for details on installation and launching of VM.

4. Check Junos OS and vSRX Virtual Firewall version after a reboot using the show version command.

   content_copy zoom_out_map

   user@host-01> show version
   Hostname: host-01
   Model: vSRX
   Junos: 22.3R1.1

Post-Migration Tasks

Complete the following checks after you install new Junos OS with vSRX3.0.

1. Launch the new vSRX Virtual Firewall instance with vSRX3.0 on your server.

2. Enable network access (for example by configuring an IP address on the fxp0 interface). This step enables you to transfer files to the new vSRX3.0 VM.

3. Apply the license keys (the existing keys or new keys as per Figure 2) on the newly launched vSRX Virtual Firewall instance.

   content_copy zoom_out_map

   user@host-01# request system license add terminal
   [Type ^D at a new line to end input,
   enter blank line between each license key]
   DemolabJUNOS966777536 aeaqic beain4 vywmka bb3sxc zriaer ok4lgf
                         aattzl rmyuac ipfoft cqaj34 vywmka frembw
                         gaztem bsgiyd gmbzfv 4tkzcw hegbas tvnzux
                         azlseb ew45df ojxgc3 ahfbho wz2j2i fojb6m
                         z2jeif bwbml3 esqdkk dm4jxp j7o35h x6mvei
                         fd3sjp uubu3r udfzu
   DemolabJUNOS966777536: successfully added
   add license complete (no errors)
   

4. If you are using a chassis cluster setup, enable chassis cluster on the new vSRX3.0 using the set chassis cluster cluster-id X node [0|1] command and reboot VMs.

5. Transfer any other files that you have taken a backup from vSRX2.0 VM such as IPsec VPN certificates and scripts (If applicable).

6. Copy the config file you saved earlier back to the /var/tmp folder.

7. Run the load override /var/tmp/existingConfig.txt in the configuration mode to replace the current configuration with the saved configuration.
   content_copy zoom_out_map

   user@host-01# load override /var/tmp/existingConfig.txt
   load complete

8. Commit the configuration.
   content_copy zoom_out_map

   user@host-01# commit

9. Ensure your device settings, network settings, and other configuration are available using the show configuration command.

[edit]
set security alg <alg-name> disable

user@host> show security alg status  
  DNS      : Enabled
  FTP      : Enabled
  H323     : Disabled
  MGCP     : Disabled
  MSRPC    : Enabled
  PPTP     : Enabled
  RSH      : Disabled
  RTSP     : Disabled
  SCCP     : Disabled
  SIP      : Disabled
  SQL      : Disabled
  SUNRPC   : Enabled
  TALK     : Enabled
  TFTP     : Enabled
  IKE-ESP  : Disabled
  TWAMP    : Disabled