The Juniper Olive installation software works a lot like a common parasite, with FreeBSD as its unsuspecting host. To create an Olive, you’ll install a copy of FreeBSD using QEMU or VirtualBox. Next, you’ll copy a gzipped tarball of the Juniper Olive software to your FreeBSD virtual machine. There, you’ll unzip the package and make a small modification, and then you’ll zip the files back into a FreeBSD installable package. Finally, you’ll install the package and reboot the FreeBSD system.

This is where things get interesting. The first time you boot your system, the Juniper Olive software invades its FreeBSD host. It will repartition the FreeBSD hard disk, copy new files to the system, and keep any FreeBSD files that it needs. When it’s finished, you should have a functional Juniper router.

A FreeBSD CD image is required to install FreeBSD with QEMU. Several versions are available that are suitable for creating Juniper Olive, but I recommend a mini ISO. It contains all the necessary files, and it’s the fastest to download. Download the 4.11-RELEASE-i386-miniinst.iso file from the FreeBSD archive (ftp://ftp-archive.freebsd.org/). I recommend this FreeBSD version instead of more recent ones because it seems to work well with almost any Olive version.

Next, you need to acquire the Juniper Olive software. The software is available as a FreeBSD installable package and should have a name like jinstall-12.1R1.9-domestic-olive.tgz. Because Juniper Olive is not supported by Juniper, you cannot get a copy of the software directly from Juniper.

To create an ISO image file using Windows, you first need to install ISO image creation software. I recommend ISO Recorder (http://isorecorder.alexfeinman.com/isorecorder.htm). It’s free, easy to install, and works well. Download the software and launch the installer. Then click Next and follow the prompts to complete the installation.

After installing ISO Recorder, you should be able to create an ISO image of the Juniper Olive software. Create a folder and copy your gzipped Olive file into the folder (named juniper-olive, for example). Then, right-click the folder and select Create ISO image file.

The ISO Recorder Creation Wizard appears, as shown in Figure 6-1.

Figure 6-1. ISO Recorder Creation Wizard

Under Create image, select the Directory radio button, change the Image format to CD, click Next, and follow the prompts to create your ISO image. After you have a Juniper ISO, you’re ready to install Juniper Olive on Windows.

On computers running OS X, copy your Juniper image file to a folder and use hdiutil to create an ISO image of the folder’s contents. In the following listing, I’ve created an ISO image file named juniper-olive.iso using a folder named JUNOS:

$ mkdir JUNOS
$ cp jinstall-12.1R1.9-domestic.tgz JUNOS
$ hdiutil makehybrid -iso -joliet -o juniper-olive.iso JUNOS

Now that you have a suitable ISO of the Olive software, you’re ready to install Juniper Olive on OS X.

Creating an ISO image on Ubuntu Linux is almost the same as on OS X, except you use the mkisofs application. Copy your Juniper image file to a folder (JUNOS, for example) and enter the following commands to create the ISO:

$ mkdir JUNOS
$ cp jinstall-12.1R1.9-domestic.tgz JUNOS
$ mkisofs -o juniper-olive.iso JUNOS

Now that you have your ISO, there are only a few things left to do before you create a Juniper Olive.

Start by creating a build directory and then copy the FreeBSD installation ISO and the Juniper Olive ISO files to the directory, as in the following example:

$ mkdir Juniper
$ cp 4.11-RELEASE-i386-miniinst.iso Juniper
$ cp juniper-olive.iso Juniper

If you’re using Windows, open a command prompt window and enter the following commands instead:

c: mkdir Juniper
c: copy 4.11-RELEASE-i386-miniinst.iso Juniper
c: copy juniper-olive.iso Juniper

Now that everything is prepped in your build directory, you can begin installing the system.

In this section, you’ll create a virtual hard disk using qemu-img and install FreeBSD on the virtual disk. I’ll only cover the basics of preparing FreeBSD for Olive and won’t go into a lot of detail about FreeBSD itself.

$ cd ~
$ cp .bash_profile .bash_profile-backup
$ sudo echo 'export PATH=/Applications/GNS3.app/Contents/Resources/qemu/
bin:$PATH' >> .bash_profile

$ echo $PATH

Getting Started

Begin the installation by creating an 8GB virtual disk image file named juniper.img in your build directory. The qemu-img command options used here should work on all Unix-like systems.

$ cd Juniper
$ qemu-img create juniper.img 8G

Next, boot QEMU from the FreeBSD mini ISO using the following command:

$ qemu-system-i386 -m 512 -hda juniper.img -localtime -cdrom 4.11-RELEASE
i386-miniinst.iso

Windows users should open a command prompt window and use the following commands instead. Be sure to enter the path command if QEMU isn’t already in your Windows path.

c: cd Juniper
c: path="c:program filesGNS3qemu-0.13.0"
c: qemu-img create juniper.img 8G
c: qemu-system-i386w -m 512 -hda juniper.img -localtime -cdrom 4.11-RELEASE-
i386-miniinst.iso

When FreeBSD boots, the Kernel Configuration Menu appears, as shown in Figure 6-2.

Figure 6-2. FreeBSD Kernel Configuration Menu

Press ENTER to skip the kernel configuration and continue with the installation.

Next, the FreeBSD sysinstall Main Menu appears, shown in Figure 6-3.

Figure 6-3. sysinstall Main Menu

Use the arrow to move down, select Standard to begin a standard installation, and then press ENTER to continue.

Partitioning the Filesystem

The next screen, shown in Figure 6-4, displays basic information about using the FDISK Partition Editor.

Figure 6-4. FDISK partitioning message screen

Read the instructions and press ENTER to continue to the FDISK Partition Editor menu, shown in Figure 6-5.

Figure 6-5. FDISK Partition Editor menu

The FDISK Partition Editor allows you to choose how much disk space you want to allocate to FreeBSD. Choose A to use the entire disk and then select Q to finish.

The Install Boot Manager menu should appear next, as shown in Figure 6-6.

Figure 6-6. Install Boot Manager menu

Use the arrow to move down, select Standard to install a standard master boot record (MBR), and press ENTER to continue.

FreeBSD then displays a message about creating BSD partitions inside your newly created FDISK partition, as shown in Figure 6-7.

Figure 6-7. BSD partition message

After reading the message, press ENTER to continue to the FreeBSD Disklabel Editor.

The next step is to create Juniper-compatible partitions. It’s important to pay close attention to how you partition the virtual hard disk because the Juniper Olive package must see the correct FreeBSD partitions or the installation will fail. You also must create your partitions in a specific order.

To create your first partition, select C and type the partition size in the field provided, as shown in Figure 6-8.

Figure 6-8. Specify a partition size.

I entered 1024M to create a 1GB partition. Press ENTER to accept this value, and you’ll see the partition type option screen, shown in Figure 6-9.

Figure 6-9. Choose a partition type.

Press ENTER to create a filesystem (FS) partition type, and you’ll be given the option to choose the mount point for the partition, as shown in Figure 6-10.

Figure 6-10. Choose a mount point for the partition.

To create a mount point for your root partition, type a forward slash (/) and press ENTER to complete the configuration of your first partition.

Using Table 6-1, follow the same procedure to create the complete filesystem layout. The order is important! After creating your root partition (/), work your way down the list, finishing with the /var partition. When you get to the swap partition, make sure you choose swap and not FS as your partition type. The /var partition is last, so when you create it, accept the default partition block size. This value uses the remaining free space on your partition. Remember, if the partitions are not created in sequential order, the partition names won’t match the mount points, and Juniper Olive won’t install properly.

Table 6-1. FreeBSD Partitioning for Juniper Olive

Part	Mount	Size
ad0s1a	/	1024 MB
ad0s1b	swap	1024 MB
ad0s1e	/config	1024 MB
ad0s1f	/var	remaining space

There are many ways to partition FreeBSD in preparation for the Olive install, but I’ve found this method to be the most reliable across different versions of Juniper Olive. When you’re done, the filesystem should look exactly like the one in Figure 6-11.

Figure 6-11. Fully configured partition layout suitable for Juniper Olive

Once you’ve configured all the partitions, choose Q to complete the partitioning process and then choose your distribution set, as shown in Figure 6-12.

Figure 6-12. FreeBSD distribution choices

Use the arrow keys to scroll down, select Minimal, and then press the spacebar to make the selection. Now press TAB to select OK and press ENTER to finish.

Finishing Installation of FreeBSD

Next, choose your installation media, as shown in Figure 6-13.

Figure 6-13. Choosing an installation media

Press ENTER to choose CD/DVD as your installation media, and the installation will begin. When it’s finished, the message shown in Figure 6-14 appears.

Figure 6-14. File installation complete message

Because you’re using FreeBSD as a host for Junos OS, you don’t need to concern yourself with any of the FreeBSD configuration questions that follow this screen. Answer “no” to all remaining questions, and when asked to create a password for the root account, press ENTER to leave it blank. When you’re finished answering questions, allow the system to reboot, log on as root, and shut down FreeBSD using the halt command. Then close the window and quit the QEMU program.

Boot FreeBSD using QEMU with the following command to ensure that you can mount the juniper-olive.iso CD image file you created earlier. (On Windows, replace qemu-system-i386 with qemu-system-i386w.)

qemu-system-i386 -m 512 -hda juniper.img -localtime -cdrom juniper-olive.iso

If FreeBSD loads correctly, a login prompt should appear. Log in as root at the prompt; you shouldn’t need to enter a password, so just press ENTER. Then use the mount command to mount the juniper-olive.iso CD image.

# mount /cdrom

Create a temporary directory named olive on the /var partition and extract the Juniper Olive package into the temporary directory.

# mkdir /var/tmp/olive
# cd /var/tmp/olive
# tar zxvf /cdrom/jinstall-12.1R1.9-domestic.tgz

Next, modify Junos OS to allow you to install the software on your QEMU virtual machine.

# mkdir temp
# cd temp
# tar zxvf ../pkgtools.tgz
# cp /usr/bin/true bin/checkpic

Extract the pkgtools directory from pkgtools.tgz to another temp directory within the olive directory, and replace the checkpic file with the FreeBSD true file. This removes the Junos OS checkpic protection.

After the modification, gzip the temp directory contents back into a tarball named pkgtools.tgz and remove the temp directory you created.

# tar zcvf ../pkgtools.tgz *
# cd ..
# rm -rf temp

Next, create a new Olive installation package and install it on your FreeBSD system. In the following listing, I’ve named the installation package olive.tgz:

# tar zcvf ../olive.tgz *
# pkg_add -f ../olive.tgz

After you install the Olive package, you should see an error message followed by some warning messages, which tell you that the package will erase any files that aren’t Junos configuration files and that you need to reboot to load the Junos OS software.

Any other onscreen instructions displayed can be ignored because they apply to an actual Juniper router, not an Olive installation on a PC. However, before continuing, you need to shut down the FreeBSD system using the halt command and quit QEMU.

# halt

The final step in installing Olive is to reboot the system and give the package time to complete its takeover of FreeBSD. At this point, you must provide the installer with extra memory, or the install will fail. Although Junos OS runs comfortably with 512MB of RAM, the installer needs 1024MB of RAM to create the RAM disk that it uses during installation.

In Linux and OS X, boot Juniper Olive with 1024MB of RAM to complete the installation, as follows:

$ sudo qemu-system-i386 -m 1024 -hda juniper.img -serial telnet:127.0.0.1:1001,
server,nowait,nodelay -localtime

Windows users should enter the following command instead:

c: qemu-system-i386w -m 1024 -hda juniper.img -serial telnet:127.0.0.1:1001,
server,nowait,nodelay -localtime

After you boot the system, you can watch the Olive software being installed by using telnet to connect to port 1001 of your localhost. (On Windows you may have to install the Telnet Client program from the Programs and Features Control Panel first.) Open a second Windows command prompt or terminal window, and enter the following command to see the installation output displayed on the console:

telnet localhost 1001

I highly recommend monitoring your install. It’s a great way to troubleshoot whether something goes wrong. Otherwise, you won’t know why an installation failed. A common problem is that not enough memory has been allocated to your virtual machine; another is that your partition sizes are too small or were created incorrectly.

The Juniper Olive installation can take 15 minutes or longer, depending on your hardware, because the installer performs a lot of tasks, such as repartitioning your FreeBSD hard drive and extracting various packages. When everything is complete, the system should automatically reboot, load Junos OS, and present you with what appears to be a FreeBSD login prompt, shown in Figure 6-15.

Figure 6-15. Successful Junos OS boot messages and login

This prompt is where you’ll log in to Junos OS. If you see the previous messages and the login prompt, then your Juniper router is ready to use.

After you create a working Olive, make a backup copy of the image for safekeeping. After all, who wants to go through all that work again? Not me!

First, properly shut down Junos OS to prevent triggering a dirty filesystem. A dirty filesystem occurs when files have not been properly closed. This condition can cause file corruption and can even break the Junos operating system. If the filesystem is marked as dirty, a filesystem check is triggered the next time you start Junos OS, and it may take longer than usual to boot until the system is checked and marked clean again (meaning no errors were found, or all errors were fixed).

To shut down Junos OS, log in as root (no password necessary) and enter the following commands:

Login: root
root@% cli
root> request system halt
Halt the system ? [yes,no] (no) yes

It’s safe to quit QEMU after you see a message indicating that the operating system has halted, as shown here:

The operating system has halted.
Please press any key to reboot.

To make a backup copy of your Juniper image, enter the following command from the directory where your image file is saved:

$ cp juniper.img backup-juniper.img

Windows users can use this command instead:

c: copy juniper.img backup-juniper.img

Now that you have a Juniper router, you need to configure GNS3 so it can be used in your projects.

To add your Juniper virtual machine to GNS3, click New to start the New QEMU VM wizard. Enter a name for your virtual machine and leave Type set to Default. Click Next to set the QEMU binary and memory options, shown in Figure 6-17.

Figure 6-17. Setting QEMU binary and memory

Select qemu-system-i386 from the Qemu binary drop-down menu. You’re choosing this QEMU program because Juniper Olive runs on a 32-bit version of FreeBSD. Give your Olive 512MB of RAM and then click Next. Click Browse to locate and select the juniper.img file that you created previously, and then click Finish.

After creating your virtual machine, go back and add more Ethernet interfaces. I recommend using six interfaces. Highlight your virtual machine and select Edit. Click the Network tab and change the number of interfaces to 6. Now select the Advanced settings tab and enter the -nographic option under Additional settings, as shown in Figure 6-18.

Figure 6-18. QEMU advanced options

The -nographic option prevents the QEMU GUI interface from displaying when you start your QEMU virtual machine. Although the GUI can be useful in troubleshooting a virtual machine, it’s more often a nuisance and should be disabled. This option can be used with any QEMU virtual machine, not only Juniper. When you’re done, click OK to close the window and then click Apply and OK to save all your changes.

You need to create a new virtual machine in VirtualBox and import the Firefly hard disk image file. Launch VirtualBox and click New to open the Create Virtual Machine dialog, shown in Figure 6-20.

Figure 6-20. Create Virtual Machine dialog

Give the virtual machine a name (Firefly in this example), set Type to BSD, and set Version to FreeBSD (32-bit). When you’re done, click Next to assign the memory size, as shown in Figure 6-21.

Figure 6-21. Adjust the memory size.

Follow the instructions from Juniper to set the proper memory size. In this example, I’ve chosen 2048 MB, because that’s what Juniper recommends for my version of Firefly. When you’re done, click Next, and check Use an existing virtual hard drive file, as shown in Figure 6-22.

Use the browse icon to locate and choose the VDI image file you created previously. When you’re finished, click the Create button to create the virtual machine.

Figure 6-22. Choose the Junos vSRX Firefly VDI hard disk image file.

After creating the virtual machine, you have to increase the number of processors to two because vSRX Firefly needs two processors to run properly. If your virtual machine is configured with only one processor, Firefly will boot and run, but you will not be able to see or configure any Ethernet interfaces.

Select your virtual machine name in VirtualBox, go to Settings ▸ System, and click the Processor tab, shown in Figure 6-23.

Figure 6-23. The Processor tab under System

Use the slider tool to select two processors, and click OK. After you’ve configured your Firefly virtual machine, right-click your virtual machine in VirtualBox and select Clone to create a copy of it to work with in GNS3. The original virtual machine will remain unused, and you’ll always have a clean, unconfigured master of your virtual machine.

Once you’re done creating the Firefly virtual machine, you’ll need to add it to GNS3 before you can use it in your projects.

Launch GNS3 and select Edit ▸ Preferences on Windows and Linux or GNS3 ▸ Preferences on OS X. Double-click VirtualBox in the pane on the left, and select VirtualBox VMs to open the VirtualBox VMs preferences window, shown in Figure 6-24.

To add your Firefly VirtualBox virtual machine to GNS3, click New to start the New Virtual VM wizard. Select your Firefly virtual machine from the drop-down menu and click Finish. Next, click Edit.

Figure 6-24. VirtualBox VMs preferences window

On the General settings tab, place a check next to Enable remote console and Start VM in headless mode. This will allow you to use the console to log on to Firefly. Finally, click the Network tab, change the number of interfaces to 6, and set the network type to Paravirtualized Network (virtio net). You’re now ready to create a project using Firefly.

In this section, you’ll create a simple project using vSRX Firefly as a network firewall. Firefly is similar in functionality to Cisco’s ASA firewall, but it’s different to configure. I won’t go into a lot of detail, but this project should get you started. If you want to learn more about Juniper SRX, you can find plenty of detailed documents at Juniper’s website (https://www.juniper.net/).

Let’s start by creating the GNS3 project shown in Figure 6-25. Drag a Firefly device from the End Devices toolbar to your workspace. Next, drag two Cisco routers to your workspace and link the devices together. Link R1’s interface f0/0 to interface e1 of vSRX Firefly. Link R2’s interface f0/0 to interface e0 of vSRX Firefly.

Figure 6-25. vSRX Firefly project

Router R1 will be configured to use a Firefly trust zone. R1 represents a trusted host on your LAN. Router R2 will be configured to use a Firefly untrust zone. The untrust zone represents an untrusted network, like the Internet. You’ll configure Firefly so that your trusted host (R1) can ping your untrusted host (R2) through the vSRX Firefly firewall using NAT.

Begin by configuring router R1 with an IP address and default gateway.

R1(config)# interface f0/0
R1(config-if)# ip address 192.168.1.100 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# ip route 0.0.0.0 0.0.0.0 192.168.1.1

Next, configure an IP address on the untrusted router R2. No gateway configuration is necessary here.

R2(config)# interface f0/0
R2(config-if)# ip address 100.1.1.1 255.255.255.0
R2(config-if)# no shutdown

With the router IP addresses configured, you can turn your attention to Firefly. Log on using the root account to configure the vSRX Firefly firewall. Because this is a new installation, you should not be asked for a password. After logging on, enter the following commands to create your firewall; you’ll start by creating a password and configuring the network settings:

  root@%cli
  root>edit
➊ root#set system root-authentication plain-text-password
  New password:firefly1
  Retype new password:firefly1
➋ root#set interface ge-0/0/0.0 family inet address 100.1.1.2/24
➌ root#set interface ge-0/0/1.0 family inet address 192.168.1.1/24
➍ root#set routing-options static route 0.0.0.0/0 next-hop 100.1.1.1

Like a Juniper router, you cannot save any configuration changes on an SRX device until you’ve assigned a password to the root account, so start by going to edit mode and creating a root password ➊. I’ve entered firefly1, but you can choose any password you’d like.

Next, at ➋, you set the IP address on the WAN interface (ge-0/0/0.0), and at ➌, you set the LAN interface (ge-0/0/1.0). Finally, at ➍, set the default gateway address using the untrusted router’s IP address (100.1.1.1).

Complete the configuration by defining your security zones and security trust policies.

➊ root#set security zones security-zone trust interfaces ge-0/0/1.0
➋ root#set security nat source rule-set interface-nat from zone trust
➌ root#set security nat source rule-set interface-nat to zone untrust
➍ root#set security nat source rule-set interface-nat rule rule1 match
   source-address 0.0.0.0/0 destination-address 0.0.0.0/0
➎ root#set security nat source rule-set interface-nat rule rule1 then source-nat
   interface
➏ root#set security policies from-zone trust to-zone untrust policy permit-all
   match source-address any destination-address any application any
➐ root#set security policies from-zone trust to-zone untrust policy permit-all
   then permit
➑ root#commit

Assign your LAN interface to the trust zone ➊. Set the interface-nat source zone to trust ➋ and the interface-nat destination zone to untrust ➌, and create a rule that matches any source and destination IP addresses (0.0.0.0/0) ➍. In a production environment, you would tighten this up a bit, but for your practice GNS3 lab, it’s fine. Now configure NAT overloading on the WAN interface ➎.

To finish the configuration, define the type of traffic that’s allowed to go between the zones ➏. In this case, you’re allowing all protocols and applications from the trust zone to the untrust zone. Finally, create the security policy ➐ and commit your changes ➑, and you’re done!

Verify your configuration by entering the show security nat source summary command.

root>show security nat source summary
Total port number usage for port translation pool: 0
Maximum port number for port translation pool: 33554432
Total pools: 0

Total rules: 1
Rule name     Rule set            From          To           Action
rule1➊       interface-nat➋     trust➌        untrust➍    interface➎

This information indicates that rule1 ➊ allows packets via NAT ➋ from the trust zone ➌ to the untrust zone ➍, and IP data sourced from the trust zone will be overloaded onto the untrusted interface ➎. By default, that’s interface ge-0/0/0.0 (your WAN interface). If your summary matches the one in this book after entering the command, then you’re ready to test the connection. If your output looks different, then you’ve probably mistyped something, so you need to go back and check all your configuration settings.

Log on to router R1 and enter the ping command to test connectivity with router R2.

R1#ping 100.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/10/24 ms

If your ping is successful, as indicated by !!!!!, then you’ve done everything correctly. If it failed, then you may need to go back and check your configuration settings. You should also make sure your Cisco routers have the correct IP addresses and subnet masks and that the Ethernet interfaces are not shut down.