Skip to main content

Azure Conductor Deployment Guide

This guide walks you through deploying a Juniper Session Smart Conductor on Azure using the Bring Your Own License (BYOL) plan. When you complete this guide, the conductor VM will be running SSR 7.1.4, configured with an authority name, conductor address, and shared services that allow branch routers to onboard and begin forwarding traffic.

Guide Topics​

StepTopicDescription
1Create the Azure Conductor VMDeploy the BYOL Conductor VM from the Azure Marketplace
2Initialize and Access the ConductorVerify the BYOL installation and log in to the Conductor GUI
3Configure the ConductorSet the authority name, conductor address, tenant, and internet service
—Appendix — Conductor ConfigurationComplete Azure conductor PCLI configuration reference

Network Topology​

The diagram below shows the logical network this guide builds.

Roles​

DeviceTypeRole
ConductorAzure VM (BYOL)Standalone SSR Conductor — centralized management and provisioning
azure-router-1Azure VM (BYOL)Conductor-managed SSR — internet breakout, LAN forwarding

Network Design Reference​

The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network.

ParameterExample ValueDescription
Azure RegioneastusAzure region for all deployed resources
Resource GroupSSR-RGAzure resource group containing all resources
VNet NameSSR-VNetVirtual network address space 10.0.0.0/16
Conductor Subnetssr-conductor-subnetConductor management subnet (10.0.0.0/24)
Conductor Private IP10.0.0.10Static private IP assigned within the conductor subnet
Conductor Gateway10.0.0.1Conductor subnet gateway
Conductor Public IP<auto-assigned>Azure-assigned public IP — used for SSH, GUI, and as the conductor address
Authority NameAuthority128SSR organizational authority name
Conductor NameConductorConductor system name
Conductor Node Namenode0Conductor node name
Conductor Subnetssr-wan-subnetConductor public (WAN) subnet (10.0.1.0/24). This is shared with the router.
Router WAN Subnetssr-wan-subnetRouter public (WAN) subnet (10.0.1.0/24). This is shared with the conductor.
Router LAN Subnetssr-lan-subnetRouter private (LAN) subnet (10.0.2.0/24)
Router Nameazure-router-1Router system name
Router Node Namenode0Router node name
WAN Device Interfacewan-devWAN device interface name
WAN Network Interfacewan1WAN network interface name
LAN Device Interfacelan-devLAN device interface name
LAN Network Interfacelan1LAN network interface name
Router LAN IP10.0.2.1/24LAN gateway address assigned to the router LAN interface
Tenant NamecorpLAN-side user tenant
Service NameInternet-TrafficInternet breakout service
Service Address0.0.0.0/0All internet-bound traffic
NeighborhoodinternetSVR peering neighborhood name

Prerequisites​

Before beginning, ensure the following are available:

  • Azure subscription — with permission to create VMs, VNets, network security groups, and managed identities.
  • Azure VNet — with at least the following subnets already created:
    • ssr-wan-subnet — the router's public (WAN) subnet; must have internet egress and reachable via SSH and HTTPS for administration. This is shared with the conductor.
    • ssr-lan-subnet — the router's private (LAN) subnet.
  • Azure Managed Identity — with the minimum read permissions listed in Step 1.
  • Juniper software access credentials — Artifactory username and password for SSR software downloads.
  • SSH key pair — RSA 2048-bit or stronger; the public key is supplied to the Azure deployment templates.

Software Version Requirements​

This guide installs SSR 7.1.4 on the conductor.

note

The router software version must be lower than or equal to the conductor software version.

note

BYOL instances require the conductor to run SSR 6.3.0-R1 or newer. SSR 7.1.4 satisfies this requirement.