Skip to main content

Step 2: Create the Spoke Router VM

This step deploys the BYOL SSR VM from the Azure Marketplace as a Spoke Router. The deployment template creates the VM, attaches it to the spoke WAN and LAN subnets, installs SSR 7.1.4, and configures the node as a conductor-managed router automatically.

Requirements​

The following infrastructure must exist in your Azure subscription before deploying the spoke router:

  • The SSR-VNet VNet with the ssr-spoke-wan and ssr-spoke-lan subnets already created.
  • The same Managed Identity used for the hub router, or a separate identity with the same minimum read permissions.
  • A conductor where the Spoke Router will onboard.
  • A Hub Router. Note the Spoke Router can be deployed while the hub installation completes.

Select the BYOL Plan​

  1. Go to the Session Smart Networking Platform in the Azure Marketplace.

  2. Select the Plans + Pricing tab.

    Select a Plan

  3. Scroll down to the bottom of the BYOL section.

  4. Next to Juniper Session Smart Conductor-managed Router, click Launch.

    Launch the Router Template)

    Router ARM Template

Deploy via Azure Portal​

  1. Fill in the template parameters using the following table.

    ParameterExample ValueNotes
    Subscription(your subscription)Subscription for the deployment.
    Resource GroupSSR-RGSelect an existing Resource Group
    RegioneastusThe Azure location where the VNet exists. One word, all lowercase (for example, eastus, westus, westeurope). See Azure locations.
    Instance SizeStandard_F8s_v2The Azure VM size to use for the router.
    Instance Nameazure-spoke-routerDisplay name for the VM.
    SSR Version7.1.4The BYOL version to install
    Primary Control IP<conductor-public-ip>Public IP of the conductor
    Secondary Control IP(leave blank)Only required for HA conductor deployments
    Artifactory Username(your username)User portion of the Juniper access credentials.
    Artifactory Token(your token)Token portion of the Juniper access credentials.
    Managed Identity(your managed identity)Must have the permissions listed in Requirements
    Virtual Network NameSSR-VNetSelect an existing VNet name.
    Public Subnet Namessr-spoke-wanHub WAN subnet
    Public Subnet Allowed CIDR0.0.0.0/0This should be restricted at deployment time to the IP address for SSH/HTTPS
    Admin Allowed CIDRCIDR range allowed for SSH/HTTPSSource IP CIDR range x.x.x.x/32 to reach the conductor for administration.
    Private Subnet Namessr-spoke-lanHub LAN subnet
    Private Subnet Allowed CIDR0.0.0.0/0 If the value is known at deployment time, it should be restricted.Source IP address range of the internal workloads to allow access.
    Admin Public Key Data(contents of your SSH public key)If you have an existing public key, select the appropriate response and provide the key. If not, generate a new one the first time, and reuse the same key subsequent times.
    caution

    Public Subnet Allowed CIDR and Admin Allowed CIDR default to 0.0.0.0/0 for initial deployment. After the deployment completes and your environment is stable, update the associated NSG rules to restrict access for Public Subnet Allowed CIDR to known source addresses.

  2. Click Next. Azure will validate the input.

    Next button

  3. After reviewing the Terms, click Create.

  4. When the deployment completes, open the Outputs tab.

    Deployment complete

    Make a note of the following value — you will need them in later steps:

    • Public IP address: The router's Azure assigned Public IP.

Network Interface Layout​

Use the following interface information to assign the LAN and WAN interfaces later in this process.

Linux InterfaceAzure NIC NameSubnet
ge-0-0azure-hub-router-publicssr-hub-wan
ge-0-1azure-hub-router-privatessr-hub-lan

Next Step​

After both the Hub and Spoke VMs are deployed, proceed to Step 3 — Verify Installation and Discover VMBus UUIDs.