diff --git a/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3-lma3.yaml b/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3-lma3.yaml
index af06f3e..a30dfeb 100644
--- a/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3-lma3.yaml
+++ b/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3-lma3.yaml
@@ -1,7 +1,7 @@
 resource_registry:
   "MCP2::NetworkAcc": ../fragments/NetworkAccVM.yaml
   "MCP2::NetworkAccStorage": ../fragments/NetworkAccVMStorage.yaml
-  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFl.yaml
+  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFlVSRX.yaml
   "MCP2::SrvInstances": ../fragments/SrvInstancesVM.yaml
   "MCP2::SrvInstancesCeph": ../fragments/SrvInstancesVMCeph.yaml
   "MCP2::SrvInstancesCephOSD": ../fragments/SrvInstancesVMCephOSD.yaml
@@ -20,6 +20,8 @@
   ucp_boot_timeout: 3600
   cluster_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0evjOaK8c8SKYK4r2+0BN7g+8YSvQ2n8nFgOURCyvkJqOHi1qPGZmuN0CclYVdVuZiXbWw3VxRbSW3EH736VzgY1U0JmoTiSamzLHaWsXvEIW8VCi7boli539QJP0ikJiBaNAgZILyCrVPN+A6mfqtacs1KXdZ0zlMq1BPtFciR1JTCRcVs5vP2Wwz5QtY2jMIh3aiwkePjMTQPcfmh1TkOlxYu5IbQyZ3G1ahA0mNKI9a0dtF282av/F6pwB/N1R1nEZ/9VtcN2I1mf1NW/tTHEEcTzXYo1R/8K9vlqAN8QvvGLZtZduGviNVNoNWvoxaXxDt8CPv2B2NCdQFZp
   private_floating_network_cidr: '10.11.12.0/24'
+  private_floating_network_gateway: '10.11.12.1'
+  control_network_vsrx_peering_ip: '10.10.0.131'
   private_floating_interface: 'ens4'
   worker_metadata: {"labels": {"openstack-control-plane":"enabled""role":"ceph-osd-node"}}
   cmp_metadata: {"labels": {"openstack-compute-node":"enabled","tfvrouter":"enabled", "role":"ceph-osd-node","local-volume-provisioner": "enabled"}}
diff --git a/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3.yaml b/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3.yaml
index 80229a2..2b79289 100644
--- a/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3.yaml
+++ b/de/heat-templates/env/mstr1-wrkr3-cmp2-ntw3.yaml
@@ -1,7 +1,7 @@
 resource_registry:
   "MCP2::NetworkAcc": ../fragments/NetworkAccVM.yaml
   "MCP2::NetworkAccStorage": ../fragments/NetworkAccVMStorage.yaml
-  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFl.yaml
+  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFlVSRX.yaml
   "MCP2::SrvInstances": ../fragments/SrvInstancesVM.yaml
   "MCP2::SrvInstancesCeph": ../fragments/SrvInstancesVMCeph.yaml
   "MCP2::SrvInstancesCephOSD": ../fragments/SrvInstancesVMCephOSD.yaml
@@ -19,6 +19,8 @@
   ucp_boot_timeout: 3600
   cluster_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0evjOaK8c8SKYK4r2+0BN7g+8YSvQ2n8nFgOURCyvkJqOHi1qPGZmuN0CclYVdVuZiXbWw3VxRbSW3EH736VzgY1U0JmoTiSamzLHaWsXvEIW8VCi7boli539QJP0ikJiBaNAgZILyCrVPN+A6mfqtacs1KXdZ0zlMq1BPtFciR1JTCRcVs5vP2Wwz5QtY2jMIh3aiwkePjMTQPcfmh1TkOlxYu5IbQyZ3G1ahA0mNKI9a0dtF282av/F6pwB/N1R1nEZ/9VtcN2I1mf1NW/tTHEEcTzXYo1R/8K9vlqAN8QvvGLZtZduGviNVNoNWvoxaXxDt8CPv2B2NCdQFZp
   private_floating_network_cidr: '10.11.12.0/24'
+  private_floating_network_gateway: '10.11.12.1'
+  control_network_vsrx_peering_ip: '10.10.0.131'
   private_floating_interface: 'ens4'
   worker_metadata: {"labels": {"openstack-control-plane":"enabled","role":"ceph-osd-node","local-volume-provisioner": "enabled"}}
   cmp_metadata: {"labels": {"openstack-compute-node":"enabled","tfvrouter":"enabled", "role":"ceph-osd-node"}}
diff --git a/de/heat-templates/env/mstr1-wrkr3-cmp3-ntw3.yaml b/de/heat-templates/env/mstr1-wrkr3-cmp3-ntw3.yaml
index ff191f8..750f670 100644
--- a/de/heat-templates/env/mstr1-wrkr3-cmp3-ntw3.yaml
+++ b/de/heat-templates/env/mstr1-wrkr3-cmp3-ntw3.yaml
@@ -1,7 +1,7 @@
 resource_registry:
   "MCP2::NetworkAcc": ../fragments/NetworkAccVM.yaml
   "MCP2::NetworkAccStorage": ../fragments/NetworkAccVMStorage.yaml
-  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFl.yaml
+  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFlVSRX.yaml
   "MCP2::SrvInstances": ../fragments/SrvInstancesVM.yaml
   "MCP2::SrvInstancesCeph": ../fragments/SrvInstancesVMCeph.yaml
   "MCP2::SrvInstancesCephOSD": ../fragments/SrvInstancesVMCephOSD.yaml
@@ -19,6 +19,8 @@
   ucp_boot_timeout: 3600
   cluster_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0evjOaK8c8SKYK4r2+0BN7g+8YSvQ2n8nFgOURCyvkJqOHi1qPGZmuN0CclYVdVuZiXbWw3VxRbSW3EH736VzgY1U0JmoTiSamzLHaWsXvEIW8VCi7boli539QJP0ikJiBaNAgZILyCrVPN+A6mfqtacs1KXdZ0zlMq1BPtFciR1JTCRcVs5vP2Wwz5QtY2jMIh3aiwkePjMTQPcfmh1TkOlxYu5IbQyZ3G1ahA0mNKI9a0dtF282av/F6pwB/N1R1nEZ/9VtcN2I1mf1NW/tTHEEcTzXYo1R/8K9vlqAN8QvvGLZtZduGviNVNoNWvoxaXxDt8CPv2B2NCdQFZp
   private_floating_network_cidr: '10.11.12.0/24'
+  private_floating_network_gateway: '10.11.12.1'
+  control_network_vsrx_peering_ip: '10.10.0.131'
   private_floating_interface: 'ens4'
   worker_metadata: {"labels": {"openstack-control-plane":"enabled","role":"ceph-osd-node","local-volume-provisioner": "enabled"}}
   cmp_metadata: {"labels": {"openstack-compute-node":"enabled","tfvrouter":"enabled", "role":"ceph-osd-node"}}
diff --git a/de/heat-templates/env/mstr3-wrkr3-cmp2-ntw3-lma3-osd3.yaml b/de/heat-templates/env/mstr3-wrkr3-cmp2-ntw3-lma3-osd3.yaml
index b0a817a..db4760e 100644
--- a/de/heat-templates/env/mstr3-wrkr3-cmp2-ntw3-lma3-osd3.yaml
+++ b/de/heat-templates/env/mstr3-wrkr3-cmp2-ntw3-lma3-osd3.yaml
@@ -1,7 +1,7 @@
 resource_registry:
   "MCP2::NetworkAcc": ../fragments/NetworkAccVM.yaml
   "MCP2::NetworkAccStorage": ../fragments/NetworkAccVMStorage.yaml
-  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFl.yaml
+  "MCP2::NetworkPrvFl": ../fragments/NetworkPrvFlVSRX.yaml
   "MCP2::SrvInstances": ../fragments/SrvInstancesVM.yaml
   "MCP2::SrvInstancesCeph": ../fragments/SrvInstancesVMCeph.yaml
   "MCP2::SrvInstancesCephOSD": ../fragments/SrvInstancesVMCephOSD.yaml
@@ -26,6 +26,8 @@
   ucp_boot_timeout: 3600
   cluster_public_key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0evjOaK8c8SKYK4r2+0BN7g+8YSvQ2n8nFgOURCyvkJqOHi1qPGZmuN0CclYVdVuZiXbWw3VxRbSW3EH736VzgY1U0JmoTiSamzLHaWsXvEIW8VCi7boli539QJP0ikJiBaNAgZILyCrVPN+A6mfqtacs1KXdZ0zlMq1BPtFciR1JTCRcVs5vP2Wwz5QtY2jMIh3aiwkePjMTQPcfmh1TkOlxYu5IbQyZ3G1ahA0mNKI9a0dtF282av/F6pwB/N1R1nEZ/9VtcN2I1mf1NW/tTHEEcTzXYo1R/8K9vlqAN8QvvGLZtZduGviNVNoNWvoxaXxDt8CPv2B2NCdQFZp
   private_floating_network_cidr: '10.11.12.0/24'
+  private_floating_network_gateway: '10.11.12.1'
+  control_network_vsrx_peering_ip: '10.10.0.131'
   private_floating_interface: 'ens4'
   worker_metadata: {"labels": {"openstack-control-plane": "enabled", "openvswitch": "enabled","openstack-gateway":"enabled","local-volume-provisioner": "enabled"}}
   cmp_metadata: {"labels": {"openstack-compute-node": "enabled", "tfvrouter": "enabled"}}
diff --git a/de/heat-templates/fragments/NetworkPrvFl.yaml b/de/heat-templates/fragments/NetworkPrvFl.yaml
index d43939d..ac4c5d3 100644
--- a/de/heat-templates/fragments/NetworkPrvFl.yaml
+++ b/de/heat-templates/fragments/NetworkPrvFl.yaml
@@ -7,6 +7,15 @@
     type: string
   private_floating_network_ipam_pool_end:
     type: string
+  private_floating_network_gateway:
+    type: string
+    default: ''
+  accessible_network:
+    type: string
+    default: ''
+  control_network_vsrx_peering_ip:
+    type: string
+    default: ''
 
 resources:
 
diff --git a/de/heat-templates/fragments/NetworkPrvFlVSRX.yaml b/de/heat-templates/fragments/NetworkPrvFlVSRX.yaml
new file mode 100644
index 0000000..5ba7015
--- /dev/null
+++ b/de/heat-templates/fragments/NetworkPrvFlVSRX.yaml
@@ -0,0 +1,63 @@
+heat_template_version: queens
+
+parameters:
+  private_floating_network_cidr:
+    type: string
+  private_floating_network_ipam_pool_start:
+    type: string
+  private_floating_network_ipam_pool_end:
+    type: string
+  private_floating_network_gateway:
+    type: string
+  accessible_network:
+    type: string
+  control_network_vsrx_peering_ip:
+    type: string
+
+resources:
+
+  network:
+    type: OS::Neutron::Net
+  subnet:
+    type: OS::Neutron::Subnet
+    properties:
+      network: { get_resource: network }
+      enable_dhcp: false
+      cidr: { get_param: private_floating_network_cidr }
+      gateway_ip: ~
+      allocation_pools:
+        - start: { get_param: private_floating_network_ipam_pool_start }
+          end: { get_param: private_floating_network_ipam_pool_end }
+
+  accessible_server_port:
+    type: OS::Neutron::Port
+    properties:
+      network_id: { get_param: accessible_network }
+      port_security_enabled: false
+      fixed_ips:
+       - ip_address: {get_param: control_network_vsrx_peering_ip }
+
+  private_floating_server_port:
+    type: OS::Neutron::Port
+    properties:
+      network_id: { get_resource: network }
+      port_security_enabled: false
+      fixed_ips:
+        - ip_address: { get_param: private_floating_network_gateway}
+
+  vsrx_instance:
+    type: OS::Nova::Server
+    properties:
+      name: { list_join: ['-', [get_param: "OS::stack_name", 'vsrx01']] }
+      availability_zone: nova
+      image: vsrx-mcp2-external
+      flavor: oc_vsrx
+      networks:
+        - port: { get_resource: accessible_server_port }
+        - port: { get_resource: private_floating_server_port }
+
+outputs:
+  private_floating_network_id:
+    value: { get_resource: network }
+  private_floating_subnet_id:
+    value: { get_resource: subnet }
diff --git a/de/heat-templates/top.yaml b/de/heat-templates/top.yaml
index d7d165f..da2e305 100644
--- a/de/heat-templates/top.yaml
+++ b/de/heat-templates/top.yaml
@@ -14,6 +14,10 @@
     type: string
     description: The CIDR of control network, used to detect control interface.
     default: '10.10.0.0/24'
+  control_network_vsrx_peering_ip:
+    type: string
+    description: IP address of vsrx for tungsten fabric peering
+    default: ''
   masters_size:
     type: number
     description: Number of masters instances to deploy
@@ -184,6 +188,9 @@
       private_floating_network_cidr: { get_param: private_floating_network_cidr }
       private_floating_network_ipam_pool_start: { get_param: private_floating_network_ipam_pool_start }
       private_floating_network_ipam_pool_end: { get_param: private_floating_network_ipam_pool_end }
+      private_floating_network_gateway: {get_param: private_floating_network_gateway}
+      control_network_vsrx_peering_ip: {get_param: control_network_vsrx_peering_ip}
+      accessible_network: { get_attr: [accessible_network, public_network]}
 
   storage_network:
     type: MCP2::NetworkAccStorage