Description

AWS (Amazon Web Services) is a commonly used public cloud platform in the market. It serves as an automation tool CloudFormation which allows the usage of programming languages or a simple text file to model and provision, in an automated and secure manner. This article describes a typical failure in vSRX stack creation when an undesirable AMI (Amazon Machine Image) type is chosen in the automation template and how to fix it.

We assume vSRX Next Generation Firewall AMI has already been subscribed via AWS Marketplace. Verify your subscription as the following web page indicates:


 

Symptoms

When creating a vSRX stack via AWS CloudFormation, first specify a template location. Then provide user specified configuration fields such as Stack name, etc. The following screen capture shows vSRX instance is set as c5n.2xlarge. Note instance type is not case sensitive.

 


After stack creation is initiated, monitor the creation process via event logs. Note that an error occurred, which caused the stack creation to fail.

Solution

The failed reason says:

Enhanced networking with the Elastic Network Adapter (ENA) is required for the 'c5n.2xlarge' instance type. Ensure that you are using an AMI that is enabled for ENA. (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: 8cc4c756-1658-426b-add8-f80a7504b048)


This indicates c5n.2xlarge is not properly chosen. 

The details of vSRX AMI webpage show that Juniper recommends c4.xlarge for vSRX instance type:


Replace all c5n.2xlarge in the YAML template with the preferred AMI type as shown in the example below:

Before change: 

    "VSRXType" : {
      "Description" : "Virtual machine size required for VSRX instances.",
      "Type" : "String",
      "Default" : "c5n.2xlarge",
      "AllowedValues" : [ "c5n.2xlarge" ]
    }
 
    "vSRXInstance" : {
      "c5n.2xlarge"   : { "Type" : "c5n.2xlarge",   "Bandwidth" : "500000" }
    }


    "VSRXType" : {
      "Description" : "Virtual machine size required for VSRX instances.",
      "Type" : "String",
      "Default" : "c4.xlarge",
      "AllowedValues" : [ "c4.xlarge" ]
    }
 

After change: 

    "vSRXInstance" : {
      "c4.xlarge"   : { "Type" : "c4.xlarge",   "Bandwidth" : "500000" }
    }

A re-creation of stack is now completed successfully:



And a vSRX EC2 instance is running, which can be found in AWS EC2 Instances web portal.