Overview
Juniper's Virtual System (VSYS) can be defined as a logical firewall, or group of logical firewalls contain in a single physical firewall. As with Checkpoint's VSX, VSYS provides service providers and Network Operations Centers the ability to manage all of their customer's firewalls in one appliance. Common components like administrative access, global policies, and virtual routers, can be shared across Virtual Systems while each Vsys contains its own address book entries, user lists, VPNs, policies, NATs, and services. Vsys is not as segmented as VSX with regards to Virtual Firewall configurations. Virtually all components can be designated as either shared or exclusive to each Vsys. Though extremely robust, this can add a greater learning curve with regards to initial configuration and troubleshooting. When components are shared, they become available to other Virtual Systems and/or the root vsys. Exclusive components are only available to the Virtual System in which it was created.
Each Vsys contains 3 primary components; vitrual routers, zones, and network interfaces. Virtual routers are created automatically when a Vsys is created. The Virtual routers is named -vr and provides the routing logic for the Vsys. Other shared virtual routers are also created and accessible to all virtual systems. When a Vsys is created, 3 default zones are also created called Trust-, Untrust-Tun-, and Global-. The network interfaces created are both shared and non-shared. The shared interface is attached to the Untrust Zone and is accessible across all Virtual Systems. This interface can be either a physical interface or a VLAN tagged subinterface. The non-shared interface is attached to the Trust Zone and can also be a physical interface or a VLAN tagged subinterface.
Traffic from the Untrust Zone is classified by the root Vsys to determine the best Virtual System to handle the traffic. As indicated when the "get route ip " command is ran from the root Vsys, there may be multiple matches for each network but the more specific route will always be chosen. Traffic classification defines which Virtual systems are bound to which zones. This allows the root vsys to decide which vsys to send traffic to. There are 2 methods of traffic classification. One if for traffic destined for a virtual interface (vpns, mips, dips). The root vsys keeps a list of virtual interfaces so it knows were to send traffic destined for a virtual interface automatically. The second method is for traffic passing through a vysy. In order for the root vsys to know where to send the traffic either VLAN tagging or IP-based classifications must be used. When defining the traffic, overlapping ranges cannot be used since shared zones are utilized.
Vsys licensing starts at 10 Virtual Systems and can be customized for virtually any number of systems from 25, 100, 250, and more.
Professional support for Virtual Systems is a lot easier than it is with Checkpoint, which currently runs on several different appliance vendors. Juniper's knowledge base is pretty extensive, which is a good thing because your going to need it. I've found that troubleshooting a Vsys can be cumbersome and involves a lot of trial and error.
Definations
Virtual Systems can be defined as virtual firewalls inside of a physical firewall, that contains both shared and exclusive components as well as its own set of allocated resources. Each vsys contains its own policy, VPNs, and objects.
Virtual routers:
When a vsys is created a Virtual Router called vr- is also created. The virtual system will have access to this vr as well as any vr’s crated in the root vsys (like untrust-vr).
Zones:
In addition to its own vr, 3 zones are also created whenever a vsys is created: Untrust-, Trust-, and Global-. The vsys will also inherit any shared zones from the root vsys
Interfaces:
The trust interface for a vsys can either be a dedicate interface, a subinterface (identified by VLAN tagging), or a shared interface (using IP-based classification). The untrust interface can be physical, a subinterface, or shared (using a physical, sub,aggrogate or redundant interface). See the notes section below for special considerations regarding VPNS.
Traffic classification:
Defines which IP’s are bound to which zones. This allows the root vsys to decide which vsys to send traffic to. There are 2 methods of traffic classification. One if for traffic destined for a virtual interface (vpn’s, mips, dips). The root vsys keeps a list of virtual interfaces so it knows were to send traffic destined for a virtual interface automatically. The second method is for traffic passing through a vysy. In order for the root vsys to know where to send the traffic either VLAN tagging or IP-based classifications must be used. When defining the traffic, overlapping ranges cannot be used since shared zones are utilized.
VLAN tagging requires the use of a subinterface and supports dot1.q tags. In addition to the firewall’s configuration, the supporting network infrastructure must also be configured for VLAN tagging.
Configuring Virtual Systems:
CLI:
1. Create a vsys
Set vsys
(vsys_name)set admin name
(vsys_name)set admin password
(sysy_name)save
2. Define either a physical, sub, or shared interface for the vsys.
Physical
Enter vsys
Set interface ethernet3/1 import
Import an unused interface. This interface must be bound to the null zone on the root vsys (get zone)
Set interface ethernet3/1 zone Trust-
Remember 3 zones are automatically created (trust-, untrust-, and global-)
Set interface ethernet3/1 ip 192.168.1.1/24
Save
Subinterface
Enter vsys .
Set interface ethernet3/1.1 zone Trust-
Set interface ethernet3/1.1 ip 192.168.1.1/24 tag 3
IP the interface and set the VLAN tag.
Save
Shared- done in root vsys
Set zone name
Requires that a shared zone be created first. This zone is applied to the shared interface.
Set zone shared
Set interface ethernet3/1 zone
Set interface ehternet3/1 ip 192.168.1.1/24
Save
3. Define the traffic that will pass through the vsys (if using ip based)
Traffic can either be classified by ip or by subnet. The configuration of the traffic classification is done in the root vsys.
Set zone ip-classification range 192.168.1.1-192.168.1.100 vsys
Set zone ip-classification
Save
4. Resource allocation.
A profile can be created to allocate resources to the vsys.
Set vsys-profile name cpu-weither 20
Set vsys-profile mips max 30
Set vsys-profile dips max 20 reserve 5
Set vsys-profile mpolicies max 5
Set vsys-profile policies max 120
Set vsys-profile sessions max 3000
Save.
WebUI:
1. Create a vsys
1. Log into the root vsys and select New in the upper right hand corner.
2. Enter the vsys name
3. create the admin account
4. Create the VR (3 options-default router, select an existing vrouter, or create a custom)
5. Click Ok
2. Create interfaces (physical, subinterface, or shared).
a. Physical
1. Long into the root vsys and select the vsys and Enter.
2. Select Network>Interfaces
3. Select Import next to the desired interface
4. Select Ok
5. Enter zone and Ip information.
b. Subinterface
1. Log into the root vsys and select the vsys and Enter.
2. Select Network>Interfaces
3. Select sub-if in the upper right corner. Select New
4. Enter the requested interface information (interface ip, mash, zone, vlan tag)
c. Shared
1. Log into the root vsys
2. Select Network>Zones>New
3. Enter a zone name and select Shared.
4. Select Ok
5. Select Network>Interfaces
6. Identify the interface you want to share. Select Edit
7. Select the Zone created above.
8. Select Ok
3. Traffic classification(if using ip based)
1. Log into the root vsys
2. Select Network>Zones
3. Select the zone and click EDIT.
4. Check the Ip Classification button
5. Select System and choose the system to map traffic to (either an Ip range or subnet).
a. For example, you want all traffic destined to 192.168.1.1/24 to be routed to this zone.
6. Enter the Ip info
7. Click OK
4. Resource allocation
1. Log into the root vsys
2. Choose vsys>profile
3. Select EDIT next to the profile
4. Enter requested values
5. Click OK
Notes and troubleshooting:
You cannot rename a vsys. You will have to remove it and ad it back.
Inbound traffic can also reach a vsys via VPN tunnels; however, if the outgoing interface is a shared interface, you
cannot create an AutoKey IKE VPN tunnel for a vsys and the root system to the same remote site.
Both ingress and egress packet handling is checked for each packet. Both must be successful inorder to pass the packet to its destination. In addition, Intra-zone traffic will also be dropped.
Ingress packet handling:
1. Checks the Ingress interface.
2a . If it’s a shared interface, it checks the source Ip classification.
2b. If it is not a shared interface, it associates the packet with the ingress interface vsys (“v-i”). From here, standard Netscreen processing is performed.
3. Is the src IP classified? If YES, the packet is associated with the classified IP vsys (“v-i”). From here, standard Netscreen processing is performed. If NO, the IP classification fails.
Egress packet handling.
1. Checks the Egree interface.
2a. If it’s a shared interface, checks the DST IP classification.
2b. If it’s not a shared interface, its associated the packet with the egree interface (“v-e”).
3.Is the DST address classified? If YES, associated the packet with the classified IP vsys (“v-e”). If NO, classification fails.
VLAN members of the same vsys can communicate with each other however VLAN members of different vysy cannot without policies.
VLAN traffic classification is more secure than IP based because IP based uses shared zones. An admin of a shared zone can snoop all zones that are shared.
To view resource allocations:
Get vsys