topic Re: Create VS R80.10 on VSX running R80.20. Is it possible? in Firewall and Security Management

Create VS R80.10 on VSX running R80.20. Is it possible?

Javier002 — Tue, 22 Jun 2021 21:34:09 GMT

Hello,

I need to test sk164472 and is necessary to run R80.10 or older. I have a cluster VSX with R80.20 and I don´t know if is possible to create a VS with a prior release than the version running on VSX.

Any help or guidance is welcome.

Thank in advance.

Re: Create VS R80.10 on VSX running R80.20. Is it possible?

Chris_Atkinson — Mon, 26 Oct 2020 13:24:45 GMT

Did you review sk112454 for R80.20 and above, did it not suit your situation?

Virtual Systems within a VSX gateway are the same version.

Re: Create VS R80.10 on VSX running R80.20. Is it possible?

Bob_Zimmerman — Mon, 26 Oct 2020 13:37:06 GMT

To answer your immediate question, no, there is not a way for VSs to be on different software versions. There is nothing at all virtual about VSX beyond the virtualization involved in preemptive multitasking. It's just multiple routing tables and firewall policies on a single OS. If you are familiar with rdomains, VRFs, or network namespaces, that's what VSX is.

There is less separation between VSs on the same box than there is between FreeBSD jails or Solaris/illumos zones.

Re: Create VS R80.10 on VSX running R80.20. Is it possible?

Javier002 — Mon, 26 Oct 2020 14:37:15 GMT

I guess so if the functionality is equivalent in both versions...

Thank you Chris_Atkinson

Re: Create VS R80.10 on VSX running R80.20. Is it possible?

Javier002 — Mon, 26 Oct 2020 14:43:39 GMT

Ok. I was thinking on container technology rather than VRFs...

Thank you so much Bob_Zimmerman

Re: Create VS R80.10 on VSX running R80.20. Is it possible?

Bob_Zimmerman — Tue, 27 Oct 2020 03:24:06 GMT

Come to think of it, I don't think even jails or zones would let you run different firewall versions on the same box. Too much of the firewall is actually in the network kernel, which is shared between them. Zones might sort-of work with something like the "brand" feature, but it would be a huge amount of effort (on par with what went into the LX brand). Usermode Linux could let you run multiple kernels with different versions of the firewall extensions, but would get weird in other ways.