skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

sd-onprem-proxmox-deploy

Deploy and validate Juniper Security Director On-Prem as a Proxmox VE KVM guest.

9|Updated Mar 7, 2026
Search Tags:#network security#proxmox#kvm#juniper#vm deployment#srx#security director
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill sd-onprem-proxmox-deploy-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sd-onprem-proxmox-deploy
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/sd-onprem-proxmox-deploy
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill sd-onprem-proxmox-deploy-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Deploying Juniper Security Director On-Prem 25/26 on Proxmox VE fails in non-obvious ways: the vendor installer targets libvirt (absent on Proxmox), the software bundle is encrypted, and wrong gateway, DNS, NTP, or fxp0 routing choices produce appliances that boot but never reach managed SRX firewalls or surface their logs. ## Core Features & Use Cases - Artifact extraction and VM build: Runs the vendor .bin in --no-run extract-only mode to produce qcow2 disks and a seed ISO, then imports them into a qm-native Proxmox VM mirroring the generated XML hardware profile. - Mandatory predeployment connectivity gate: Validates all four VIPs, per-firewall connectivity matrices, exact-source DNS/NTP probes, TLS handshakes on TCP/6514, and restricted bundle delivery via the bundled serve_bundle.py server before any VM is created. - SRX onboarding and log-path validation: Enforces an NTP synchronization gate, in-band (non-fxp0) management and log streaming, BROWN_FIELD device onboarding, and certificate/log-stream troubleshooting. - Use Case: A network engineer rebuilding SD On-Prem 26.2.1 on Proxmox VE 9.2 uses the STOP gate to catch a wrong seeded gateway before deployment, then onboards an SRX fleet with verified NTP and TLS log streaming. ## Quick Start Use the sd-onprem-proxmox-deploy skill to validate my network design and walk me through deploying Security Director On-Prem 26.2.1 as a Proxmox VE VM.

Frequently Asked Questions about sd-onprem-proxmox-deploy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy Juniper Security Director On-Prem on Proxmox VE?▼

Run the vendor .bin installer with --no-run to extract the qcow2 disks and seed ISO without libvirt, then import the disks into a qm-native Proxmox VM mirroring the generated sd-onprem.xml hardware profile. Set boot order in a separate qm set command after attaching the disks.

How do I onboard SRX devices to Security Director On-Prem?▼

Use BROWN_FIELD device-initiated onboarding: create the device via the REST API, fetch the bootstrap config, and load it fully on the SRX so it dials outbound-ssh to the device-connection VIP on TCP/7804. Verify NTP synchronization first, since a skewed clock silently prevents logs from appearing.

Is Security Director On-Prem the same as Junos Space Security Director?▼

No. Security Director On-Prem 25/26 is a new ATOM-based appliance running on single-node RKE2 Kubernetes, with no Space fabric and no device schema install step. Space-era documentation does not apply to this platform.

Why do SRX logs not appear in Security Director after onboarding?▼

The most common cause is device clock skew: the mTLS stream connects and payloads are acknowledged, but logs never surface in the GUI. Other causes include log streaming sourced from fxp0, a shadowing default-permit zone-pair policy, or a missing subscription assignment.

Can SRX firewalls send logs to Security Director over the fxp0 management interface?▼

No. SRX stream-mode security logs are emitted by the PFE data plane, which cannot egress fxp0. Each device must reach the log-collector VIP from a revenue port, typically with fxp0 moved into the mgmt_junos instance via set system management-instance.

What are the limitations of the Security Director On-Prem REST API?▼

The API authenticates with an x-iam-token browser-session JWT with roughly a 30-minute TTL; there is no API-key UI or long-lived token. There is also no manual certificate-install action, so devices onboarded before the cert controller is ready must be deleted and re-created.

Related Skills

Explore More Software Engineering Skills→
AI-Staffing-Solution-Consultants-LLCAI-Staffing-Solution-Consultants-LLC

agency-network-engineer

Generates and troubleshoots Cisco, Juniper, and Palo Alto routing, switching, and firewall configurations.

Official
Advanced
riparinoriparino
1

defensive-log-analysis

Reference KQL log tables and retention policies for Sentinel deployments.

Community
Intermediate
chatermchaterm
50

firewall

Manage iptables, firewalld, and ufw firewall rules on Linux.

Community
Intermediate
kettleofketchupkettleofketchup

vsphere

Manage VMware vSphere and ESXi infrastructure via govc, Ansible, esxcli, and REST APIs.

Community
Intermediate