The SD on-premises installation is documented in the guide Deploy Juniper Security Director Using KVM. However, we may face some challenges. Here are those:
Here is the error message that we will be getting for the first issue/challenge:
root@dedbgjun--ubu:~/Downloads/Juniper-Security-Director-25.4.1-4023# ./launch-vm.sh
Domain 'dedbgjun-sd-vm' defined from /root/Downloads/Juniper-Security-Director-25.4.1-4023/dedbgjun-sd-vm.xml
VM dedbgjun-sd-vm created successfully.
Do you want to start the Security Director VM? (y/n)y
Starting VM installation
error: Failed to start domain 'SDOP_VM'
error: Cannot access storage file '/root/Downloads/Juniper-Security-Director-25.4.1-4023/Security-Director-OnPrem-disk-2.qcow2' (as uid:64055, gid:994): Permission denied
The Virtual Machine Manager installed in the Ubuntu Machine is unable to start the SDOP VM.
In this section, it describes how to install SDOP properly on an Ubuntu Machine:
For the first issue, we need to follow the steps below to fix it:
cd /root/Downloads/Juniper-Security-Director-25.4.1-4023
mv *.qcow2 *.iso /var/lib/libvirt/images/
chmod 644 /var/lib/libvirt/images/*
Edit the XML file named <VMName.xml> and change it as highlighted below :
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type="file" device="disk">
<driver name="qemu" type="qcow2"/>
<source file="/var/lib/libvirt/images/Security-Director-OnPrem-disk-0.qcow2"/>
<target dev="vda" bus="virtio"/>
<boot order="1"/>
</disk>
<source file="/var/lib/libvirt/images/Security-Director-OnPrem-disk-1.qcow2"/>
<target dev="vdb" bus="virtio"/>
<boot order="2"/>
<source file="/var/lib/libvirt/images/Security-Director-OnPrem-disk-2.qcow2"/>
<target dev="vdc" bus="virtio"/>
<boot order="3"/>
<disk type="file" device="cdrom">
<driver name="qemu" type="raw"/>
<source file="/var/lib/libvirt/images/Security-Director-OnPrem-kvm.iso"/>
<target dev="sda" bus="scsi"/>
<readonly/>
chmod 755 /var/lib/libvirt/images/
./launch-vm.sh
For the second issue, we should configure the IP on the Ubuntu machine's bridge interface (br0):
systemctl enable systemd-networkd
systemctl restart systemd-networkd
systemctl stop NetworkManager
systemctl disable NetworkManager
++ Configured IP address on bridge interface br0 instead of physical interface ens18:
root@SDOP:~# cat /etc/netplan/01-netcfg.yaml
network:
version: 2
renderer: networkd
ethernets:
ens18:
dhcp4: false
dhcp6: false
bridges:
br0:
interfaces: [ens18]
addresses:
- 10.219.59.60/24
routes:
- to: default
via: 10.219.59.1
nameservers:
- 10.219.2.101
netplan apply
After the change, the output below should be like this:
root@SDOP:~# ifconfig
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.219.59.60 netmask 255.255.255.0 broadcast 10.219.59.255
ether 7e:ff:20:03:65:b5 txqueuelen 1000 (Ethernet)
RX packets 2334689 bytes 244508096 (244.5 MB)
RX errors 0 dropped 4642 overruns 0 frame 0
TX packets 132581 bytes 12710916 (12.7 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens18: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether bc:24:11:56:95:f4 txqueuelen 1000 (Ethernet)
RX packets 1201948039 bytes 444014649380 (444.0 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4490783 bytes 281402549 (281.4 MB)
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 7239 bytes 636189 (636.1 KB)
TX packets 7239 bytes 636189 (636.1 KB)
virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:03:2f:c3 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
TX packets 0 bytes 0 (0.0 B)
vnet1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::fc54:ff:fe83:b437 prefixlen 64 scopeid 0x20<link>
ether fe:54:00:83:b4:37 txqueuelen 1000 (Ethernet)
RX packets 2968682 bytes 190463887 (190.4 MB)
TX packets 1193310825 bytes 429534208770 (429.5 GB)
TX errors 0 dropped 88542 overruns 0 carrier 0 collisions 0
root@SDOP:~#
Note: The above configuration may be different for your environment. If there is no renderer in the YAML file, you don't need to disable the NetworkManager service.
If you are still facing the same issue, please contact JTAC