{"id":1139,"date":"2017-09-08T20:10:38","date_gmt":"2017-09-08T20:10:38","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2017\/09\/08\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init\/"},"modified":"2023-01-06T16:56:19","modified_gmt":"2023-01-06T16:56:19","slug":"vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html","title":{"rendered":"vSRX on an Isolated Network: Provision via Cloud-Init"},"content":{"rendered":"

Background<\/h2>\n

Introduced within the Junos OS Release – 15.1X49-D100 – the vSRX now comes with cloud-init. As per Junipers configuration guide,<\/p>\n

… the cloud-init package (version 0.7x) comes pre-installed in the vSRX image to help simplify configuring new vSRX instances operating in an OpenStack environment according to a specified user-data file. Cloud-init is performed during the first-time boot of a vSRX instance.[1]<\/a><\/sup><\/p>\n

In other words, you can pass the Junos configuration to the instance at point of creation, via the use of the user-data key. Like so:<\/p>\n

openstack server create --image vsrx-image-15.1X49-D100.6 \\\r\n                        --flavor vsrx_flavor \\\r\n                        --user-data \/root\/juniper.conf.txt \\\r\n                        --nic net-id=587b75b5-ceb6-49e8-b850-861809f14d5e,v4-fixed-ip=172.29.100.105 \\\r\n                        --nic net-id=423b2b1b-5591-4861-baab-64e9fef84f47,v4-fixed-ip=192.168.1.5 \\\r\n                        --nic net-id=24ca3340-a3de-4708-ad2b-2a2ab826250c,v4-fixed-ip=172.29.50.105 \\\r\n                        vsrx-15.1X49-D100.6<\/pre>\n

In the background this uploads the configuration to the Nova metadata service, which can then be retrieved via . The intention is that the vSRX then calls this URL during the initial boot and pulling the required config. Now, to get to this address traffic from your host must either go through the router namespace or the DHCP namespace. For the topic of this discussion will look into the DHCP namespace method.<\/p>\n

Within the DHCP namespace (upon the Network Controller) there is a Neutron metadata proxy that forwards the request onto a Neutron metadata agent, who then forwards onto the Nova metadata API. As the Neutron metadata proxy is hosted upon the DHCP agent IP upon the given subnet, it allows the instance to query the metadata service via a local IP, i.e:<\/p>\n

root@% ifconfig fxp0\r\nfxp0:   encaps: ether; framing: ether\r\n        flags=0x3\/0x8000 <PRESENT|RUNNING>\r\n        curr media: i802 fa:16:3e:e7:b5:2f\r\nfxp0.0: flags=0x4008000 <UP|MULTICAST>\r\n        inet primary mtu 1500 local=172.29.100.106 dest=172.29.100.0\/24 bcast=172.29.100.255\r\n\r\n\r\nroot@% curl \r\n#junos-config\r\n## Last changed: 2017-09-04 16:07:32 UTC\r\nsystem {\r\n    services {\r\n        ssh;\r\n        web-management {\r\n            http {\r\n                interface fxp0.0;\r\n            }\r\n        }\r\n    }<\/pre>\n

However, this leads to one small detail. When the vSRX boots up it must have a route telling it that it to reach 169.254.169.254<\/span> via the DHCP agents IP. Neutron provides the option to inject static routes into the instance at boot via DHCP and the 121 option. But here lies the problem – the vSRX does not support option 121.<\/p>\n

Solution<\/h2>\n

The solution to the issue is this, we set the default gateway on the Neutron subnet (that we attach for management\/FXP0) to that of the DHCP agent IP. Lets step through how this works,<\/p>\n

    \n
  1. At boot, the vSRX obtains a DHCP lease containing the IP and gateway address.<\/li>\n
  2. At the point the vSRX performs a GET for the configuration (from the metadata service) it is routed via the default gateway, which is the IP of the DHCP agent.<\/li>\n
  3. The request is proxied onto the Nova metadata service. The vSRX applies the configuration.<\/li>\n
  4. Routing issues as negated due to a different management default gateway being defined within the Junos configuration. Due to this overwriting the gateway address previously obtained via DHCP.<\/li>\n<\/ol>\n

    References<\/h2>\n

    [1]<\/a>\u00a0http:\/\/www.juniper.net\/documentation\/en_US\/vsrx\/topics\/task\/configuration\/security-vsrx-cloud-init-support.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Background Introduced within the Junos OS Release – 15.1X49-D100 – the vSRX now comes with cloud-init. As per Junipers configuration guide, … the cloud-init package (version 0.7x) comes pre-installed in the vSRX image to help simplify configuring new vSRX instances operating in an OpenStack environment according to a specified user-data file. Cloud-init is performed during … Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":1138,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[74],"tags":[],"yoast_head":"\nvSRX on an Isolated Network: Provision via Cloud-Init - Fir3net<\/title>\n<meta name=\"description\" content=\"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"vSRX on an Isolated Network: Provision via Cloud-Init - Fir3net\" \/>\n<meta property=\"og:description\" content=\"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\" \/>\n<meta property=\"og:site_name\" content=\"Fir3net\" \/>\n<meta property=\"article:published_time\" content=\"2017-09-08T20:10:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-06T16:56:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png\" \/>\n\t<meta property=\"og:image:width\" content=\"256\" \/>\n\t<meta property=\"og:image:height\" content=\"256\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Rick Donato\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rick Donato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\"},\"author\":{\"name\":\"Rick Donato\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\"},\"headline\":\"vSRX on an Isolated Network: Provision via Cloud-Init\",\"datePublished\":\"2017-09-08T20:10:38+00:00\",\"dateModified\":\"2023-01-06T16:56:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\"},\"wordCount\":422,\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png\",\"articleSection\":[\"OpenStack\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\",\"url\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\",\"name\":\"vSRX on an Isolated Network: Provision via Cloud-Init - Fir3net\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png\",\"datePublished\":\"2017-09-08T20:10:38+00:00\",\"dateModified\":\"2023-01-06T16:56:19+00:00\",\"description\":\"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the\",\"breadcrumb\":{\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png\",\"width\":256,\"height\":256},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.fir3net.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cloud\",\"item\":\"https:\/\/www.fir3net.com\/cloud\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"OpenStack\",\"item\":\"https:\/\/www.fir3net.com\/cloud\/openstack\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"vSRX on an Isolated Network: Provision via Cloud-Init\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.fir3net.com\/#website\",\"url\":\"https:\/\/www.fir3net.com\/\",\"name\":\"Fir3net\",\"description\":\"Keeping you in the know\",\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.fir3net.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.fir3net.com\/#organization\",\"name\":\"Fir3net\",\"url\":\"https:\/\/www.fir3net.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"width\":390,\"height\":88,\"caption\":\"Fir3net\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\",\"name\":\"Rick Donato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"caption\":\"Rick Donato\"},\"description\":\"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"vSRX on an Isolated Network: Provision via Cloud-Init - Fir3net","description":"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html","og_locale":"en_US","og_type":"article","og_title":"vSRX on an Isolated Network: Provision via Cloud-Init - Fir3net","og_description":"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the","og_url":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html","og_site_name":"Fir3net","article_published_time":"2017-09-08T20:10:38+00:00","article_modified_time":"2023-01-06T16:56:19+00:00","og_image":[{"width":256,"height":256,"url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png","type":"image\/jpeg"}],"author":"Rick Donato","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rick Donato","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#article","isPartOf":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html"},"author":{"name":"Rick Donato","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037"},"headline":"vSRX on an Isolated Network: Provision via Cloud-Init","datePublished":"2017-09-08T20:10:38+00:00","dateModified":"2023-01-06T16:56:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html"},"wordCount":422,"publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"image":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png","articleSection":["OpenStack"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html","url":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html","name":"vSRX on an Isolated Network: Provision via Cloud-Init - Fir3net","isPartOf":{"@id":"https:\/\/www.fir3net.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage"},"image":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png","datePublished":"2017-09-08T20:10:38+00:00","dateModified":"2023-01-06T16:56:19+00:00","description":"Background Introduced within the Junos OS Release - 15.1X49-D100 - the vSRX now comes with cloud-init. As per Junipers configuration guide, ... the","breadcrumb":{"@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#primaryimage","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2017\/09\/images_articles_if_1-43_770590.png","width":256,"height":256},{"@type":"BreadcrumbList","@id":"https:\/\/www.fir3net.com\/Cloud\/Openstack\/vsrx-on-an-isolated-network-how-do-i-provision-via-cloud-init.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fir3net.com\/"},{"@type":"ListItem","position":2,"name":"Cloud","item":"https:\/\/www.fir3net.com\/cloud"},{"@type":"ListItem","position":3,"name":"OpenStack","item":"https:\/\/www.fir3net.com\/cloud\/openstack"},{"@type":"ListItem","position":4,"name":"vSRX on an Isolated Network: Provision via Cloud-Init"}]},{"@type":"WebSite","@id":"https:\/\/www.fir3net.com\/#website","url":"https:\/\/www.fir3net.com\/","name":"Fir3net","description":"Keeping you in the know","publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fir3net.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.fir3net.com\/#organization","name":"Fir3net","url":"https:\/\/www.fir3net.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","width":390,"height":88,"caption":"Fir3net"},"image":{"@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037","name":"Rick Donato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","caption":"Rick Donato"},"description":"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders."}]}},"_links":{"self":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/1139"}],"collection":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/comments?post=1139"}],"version-history":[{"count":2,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/1139\/revisions"}],"predecessor-version":[{"id":3457,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/1139\/revisions\/3457"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media\/1138"}],"wp:attachment":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media?parent=1139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/categories?post=1139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/tags?post=1139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}