diff --git a/tcp_tests/templates/virtual-mcp11-k8s-contrail/salt.yaml b/tcp_tests/templates/virtual-mcp11-k8s-contrail/salt.yaml
index 0ee9739..e1b8f4a 100644
--- a/tcp_tests/templates/virtual-mcp11-k8s-contrail/salt.yaml
+++ b/tcp_tests/templates/virtual-mcp11-k8s-contrail/salt.yaml
@@ -16,17 +16,38 @@
 {% set IPV4_NET_ADMIN_PREFIX = '.'.join(IPV4_NET_ADMIN.split('.')[0:3]) %}
 {% set IPV4_NET_CONTROL_PREFIX = '.'.join(IPV4_NET_CONTROL.split('.')[0:3]) %}
 
+- description: Configure repository on the cfg01 node
+  cmd:
+    echo "172.18.248.114    jenkins.mcp.mirantis.net  gerrit.mcp.mirantis.net" >> /etc/hosts;
+    echo "185.135.196.10    apt-mk.mirantis.com" >> /etc/hosts;
+    echo "nameserver 172.18.208.44" >> /etc/resolv.conf;
+    echo "nameserver 8.8.8.8" >> /etc/resolv.conf;
+    which wget >/dev/null || (apt-get update; apt-get install -y wget);
+    echo "deb [arch=amd64] http://apt-mk.mirantis.com/xenial nightly salt extra" > /etc/apt/sources.list.d/mcp_salt.list;
+    wget -O - http://apt-mk.mirantis.com/public.gpg | apt-key add -;
+    echo "deb http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3 xenial main" > /etc/apt/sources.list.d/saltstack.list;
+    wget -O - https://repo.saltstack.com/apt/ubuntu/16.04/amd64/2016.3/SALTSTACK-GPG-KEY.pub | apt-key add -;
+  node_name: {{ HOSTNAME_CFG01 }}
+  retry: {count: 1, delay: 1}
+  skip_fail: false
+
+- description: Update packages on cfg01
+  cmd: apt-get clean; apt-get update
+  node_name: {{ HOSTNAME_CFG01 }}
+  retry: {count: 1, delay: 1}
+  skip_fail: false
+
 - description: Installing salt master on cfg01
   cmd:  eatmydata apt-get install -y reclass git salt-master
   node_name: {{ HOSTNAME_CFG01 }}
   retry: {count: 1, delay: 1}
   skip_fail: false
 
-#- description: (moved to cloud-init config) Install common packages on cfg01
-#  cmd: eatmydata apt-get install -y python-pip wget curl tmux byobu iputils-ping traceroute htop tree
-#  node_name: {{ HOSTNAME_CFG01 }}
-#  retry: {count: 1, delay: 1}
-#  skip_fail: false
+- description: Install common packages on cfg01
+  cmd: apt-get install -y python-pip wget curl tmux byobu iputils-ping traceroute htop tree
+  node_name: {{ HOSTNAME_CFG01 }}
+  retry: {count: 1, delay: 1}
+  skip_fail: false
 
 - description: Configure salt-master on cfg01
   cmd: |
@@ -67,8 +88,10 @@
   cmd: |
     ssh-keyscan -H github.com >> ~/.ssh/known_hosts;
     git clone -b {{ SALT_MODELS_COMMIT }} --recurse-submodules {{ SALT_MODELS_REPOSITORY }} /srv/salt/reclass;
-
     mkdir -p /srv/salt/reclass/classes/service;
+  node_name: {{ HOSTNAME_CFG01 }}
+  retry: {count: 1, delay: 1}
+  skip_fail: false
 
     # Replace firstly to an intermediate value to avoid intersection between
     # already replaced and replacing networks.
@@ -76,12 +99,12 @@
     # 192.168.10 -> 10.16.0 (generated network for admin)
     # 10.16.0 -> <external network>
     # So let's replace constant networks to the keywords, and then keywords to the desired networks.
+- description: Fix model
+  cmd: |
     find /srv/salt/reclass/ -type f -exec sed -i 's/192\.168\.10\./==IPV4_NET_ADMIN_PREFIX==/g' {} +
     find /srv/salt/reclass/ -type f -exec sed -i 's/172\.16\.10\./==IPV4_NET_CONTROL_PREFIX==/g' {} +
-
     find /srv/salt/reclass/ -type f -exec sed -i 's/==IPV4_NET_ADMIN_PREFIX==/{{ IPV4_NET_ADMIN_PREFIX }}./g' {} +
     find /srv/salt/reclass/ -type f -exec sed -i 's/==IPV4_NET_CONTROL_PREFIX==/{{ IPV4_NET_CONTROL_PREFIX }}./g' {} +
-
     find /srv/salt/reclass/ -type f -exec sed -i 's/apt_mk_version:.*/apt_mk_version: {{ REPOSITORY_SUITE }}/g' {} +
 
     # Disable checkouting the model from remote repository
diff --git a/tcp_tests/templates/virtual-mcp11-k8s-contrail/underlay.yaml b/tcp_tests/templates/virtual-mcp11-k8s-contrail/underlay.yaml
index c3e5a34..1325108 100644
--- a/tcp_tests/templates/virtual-mcp11-k8s-contrail/underlay.yaml
+++ b/tcp_tests/templates/virtual-mcp11-k8s-contrail/underlay.yaml
@@ -19,6 +19,7 @@
 {% set HOSTNAME_CTL03 = os_env('HOSTNAME_CTL03', 'ctl03.' + DOMAIN_NAME) %}
 {% set HOSTNAME_CMP01 = os_env('HOSTNAME_CMP01', 'cmp01.' + DOMAIN_NAME) %}
 {% set HOSTNAME_CMP02 = os_env('HOSTNAME_CMP02', 'cmp02.' + DOMAIN_NAME) %}
+{% set HOSTNAME_VSRX01 = os_env('HOSTNAME_VSRX01', 'vsrx01' + DOMAIN_NAME) %}
 
 template:
   devops_settings:
@@ -37,6 +38,7 @@
             default_{{ HOSTNAME_CTL03 }}: +109
             default_{{ HOSTNAME_CMP01 }}: +105
             default_{{ HOSTNAME_CMP02 }}: +106
+            default_{{ HOSTNAME_VSRX01 }}: +250
           ip_ranges:
             dhcp: [+90, -10]
 
@@ -52,9 +54,18 @@
             default_{{ HOSTNAME_CTL03 }}: +109
             default_{{ HOSTNAME_CMP01 }}: +105
             default_{{ HOSTNAME_CMP02 }}: +106
+            default_{{ HOSTNAME_VSRX01 }}: +250
           ip_ranges:
             dhcp: [+90, -10]
 
+      public-pool01:
+        net: {{ os_env('PUBLIC_ADDRESS_POOL01', '10.80.0.0/16:24') }}
+        params:
+          ip_reserved:
+            gateway: +1
+            l2_network_device: +1
+            default_{{ HOSTNAME_VSRX01 }}: +250
+
     groups:
       - name: default
         driver:
@@ -82,12 +93,21 @@
             forward:
               mode: nat
 
+          public:
+            address_pool: public-pool01
+            forward:
+              mode: nat
+
         group_volumes:
          - name: cloudimage1604    # This name is used for 'backing_store' option for node volumes.
            source_image: !os_env IMAGE_PATH1604  # https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-amd64-disk1.img or
                                              # http://apt.tcpcloud.eu/images/ubuntu-16-04-x64-201608231004.qcow2
            format: qcow2
 
+         - name: vsrx_image
+           source_image: !os_env IMAGE_VSRX
+           format: qcow2
+
         nodes:
           - name: {{ HOSTNAME_CFG01 }}
             role: salt_master
@@ -290,3 +310,26 @@
 
               interfaces: *all_interfaces
               network_config: *all_network_config
+
+          - name: {{ HOSTNAME_VSRX01 }}
+            role: vsrx
+            params:
+              vcpu: !os_env SLAVE_NODE_CPU, 2
+              memory: !os_env SLAVE_NODE_MEMORY, 2048
+              boot:
+                - hd
+              volumes:
+                - name: system
+                  capacity: !os_env NODE_VOLUME_SIZE, 150
+                  backing_store: vsrx_image
+                  format: qcow2
+              interfaces:
+                - label: eth0
+                  l2_network_device: public
+                  interface_model: virtio
+                  mac_address: 52:54:00:4e:b4:36
+                - label: eth1
+                  l2_network_device: admin
+                  interface_model: virtio
+                  mac_address: 52:54:00:e1:44:9d
+