Juniper SRX -- Concepts: Understand and explain our supported SRX offerings

*********THIS ONE ***********

===========================================================================
2nd tier device
NO NATS OR VPNS
Will have segment T1_T2 on ASA to send to juniper.
Typically used when in depth defense is required. IE PCI
Current Support Version SRX 12.1X44-D45.2
SRX100 - 700 MBPS throughput 384 security Policies
SRX240 - 1.8 GBPS throughput 4096 security Policies
SRX1400 - 10 GPBS throughput 40,000 security Policies
do show int --->run show interface terse
Supported Features
Feature Description IPv4 IPv6 General
Multiple Segments The ability to host more than one internal segment behind the
device Y Y N/A
Traffic Filtering Permit/Deny traffic via the use of traffic policies Y Y N/A
NAT/PAT Address translation Y N/A N/A
Interface Trunking Multiple segments/vlans on a shared interface N/A N/A Y
ALG / Layer 7 inspection Support for built in Application Inspection ( dns, ftp
etc.. ) Y Y Y
Screens ( Mitigation ) Attack Mitigation policies ( Assuming they have passed th
e 1st tier FW) Y Y Y
Syslog Offloaded syslog monitoring N/A N/A Y
SNMP snmp r/o monitoring N/A N/A Y
Backup Configuration backup integration with torq Y - Y
HA Active/Standy Hardware availability Active/Standy Y Y Y
Unsupported Features
Feature Description
VPN IPsec/SSL Termination of encrypted traffic on the Juniper device
Multi-tenancy Context/Virtualization of Juniper devices
HA Active/Active Hardware availability Active/Active
Dynamic routing protocols ( RIP, EIGRP, OSPF, BGP ).
Application Firewall/IPS High level layer 7 filtering
Transparent Mode Layer 2 firewall configuration
Multicast Multicast
Unified threat management . Anti-Virus/Web Filtering
Stand-Alone
SRX 240H2
Port Use Cable Type Switchport Mode
0 DRAC Standard Access
1 Reserved*** N/A N/A
2 T1-T2-XCONN* Standard Trunk
3 INSIDE** Standard Trunk
4 DMZ Standard Trunk
5 Reserved*** N/A N/A
6 - 15 Additional Segments Standard Trunk
High Availability
SRX 240H2
Port Use Cable Type Switchport Mode

0
1
2
3
4
5
6

DRAC Standard Access

Control Link X - Over Direct to peer
T1-T2-XCONN* Standard Trunk
INSIDE** Standard Trunk
DMZ Standard Trunk
Fabric (Data) Link X - Over Direct to peer
- 15 Addional Segments Standard Trunk

Juniper SRX -- Concepts: Understand and explain the configuration management sys
tem
***********THIS ONE************
================================================================================
===
https://www.juniper.net/documentation/en_US/junos12.1/topics/concept/junos-cli-o
perational-configuration-modes-switching-overview.html
Rene Juniper PPT
configure or edit to go into configuration mode user@host#
user@host> is Operation mode
To run Operational mode commands in configuration mode type run before the comma
nd. (IE run show interfaces terse)
RUN UNIX SHELL
start shell
To move security policies
insert security policies from-zone A to-zone B policy NEW before policy OLD
***************
I messed up too much with the configuration and I don t know if it s safe to commit
anymore! What can I do?
If you don t want to lose a lot of work: show | compare
It will show you the pending changes
If you just want to start from scratch: rollback 0
Similar to copy start run on Cisco
Or you just can exit the appliance and don t save when asked
***************

juniper srx -- configurations: configure static routes

********THIS ONE*************
======================================================
http://www.juniper.net/techpubs/en_US/junos15.1/topics/example/routing-protocolstatic-security-basic-set-of-route-configuring-cli.html
Loopbacks
10.0.0.1
10.0.0.2
o o
o o
o
o 172.16.1.0
172.16.1.2 o
o
o
o================================o
o
o
A
o
o
B
o
o
o
o
o

o o

o o

Customer networks
192.168.47.5
192.168.47.5
SRX A
set interfaces ge-1/2/0 unit 0 description A->B
set interfaces ge-1/2/0 unit 0 family inet address 172.16.1.1/24
set interfaces lo0 unit 57 family inet address 10.0.0.1/32
set interfaces lo0 unit 57 family inet address 10.0.0.2/32
set routing-options static route 192.168.47.0/24 next-hop 172.16.1.2
SRX
set
set
set
set
set

B
interfaces ge-1/2/0 unit 1 description B->A
interfaces ge-1/2/0 unit 1 family inet address 172.16.1.2/24
interfaces lo0 unit 2 family inet address 192.168.47.5/32
interfaces lo0 unit 2 family inet address 192.168.47.6/32
routing-options static route 0.0.0.0/0 next-hop 172.16.1.1

Show route
show routing-options
Juniper SRX -- Troubleshoot: Troubleshoot using log entries
===========================================================
http://kb.juniper.net/InfoCenter/index?page=content&id=KB15779&actp=search#Log_f
iles_and_Syslog
Log Files
System messages can be viewed in the log files with the 'show log messages' comm
and. Variations of the command are as follows:
Commands:
show log:
List all Logfiles available
show log messages:
Show Log File from beginning
show log messages | last:
List last Log Messages
show log messages | match LOGIN:
Search within the Log
monitor start <file>:
Send Logs to terminal (like tail -f)

Logs play an important role in identifying and fixing troubles. In Juniper devic
es, there are different ways to configure logs. You can configure a Juniper devi
ce to send log messages to log server in the network or within the device.
JunOS is heart of Juniper devices and works just perfect. Today I will show you
how to configure logs in Juniper SRX within the device.
Configure Logs in Juniper SRX

Configure Logs in Juniper SRX

You can configure logs in JunOS at [edit system syslog] hierarchy. Different typ
es of logs can be configured to check different logs. Now, let s start with the fa
ctory default logs configuration. When the device is fresh installed
with latest version of JunOS, there are three types of logs configured by defau
lt. You can view the log by typing show system syslog command in configuration m
ode.
[edit]
root@MustBeGeek# show system syslog
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
As you can see the factory default configuration has 3 default log configured. T
wo logs are sent to files whereas one log is displayed to user logged in. Every
log has facility level and severity level. Facility level means the type
of log message being sent and severity level means type of importance of the lo
g. The first log defined above shows facility level of any with severity level o
f emergency which is displayed to user logged in the device. The second
log has facility level as Authorization and severity level of Info and sent to
the file named messages. The third log has facility level of interactive-command
s and severity level of any and is sent to the file named
interactive-commands.
Apart from default logs, you might want to have your own control on logs being s
ent to files. Let s create log for policy sessions from untrust zone to trust zone
. First you have to specify session-init, session-close command under security p
olicy.
[edit security policies from-zone untrust to-zone trust policy MailAccess]
root@MustBeGeek# show
match {
source-address any;
destination-address ExchangeServer;
}
then {
permit;
log {
session-init;
session-close;
}
}
Now let s configure log file under [edit system syslog] hierarchy. We will configu
re the file named SessionsLog that will have RT_FLOW_SESSION keyword. You can co
nfigure different parameters for different types of logs. You can also configure
different expressions for meeting your need. Here we will use match RT_FLOW_SES
SION expression to log session messages.
[edit system syslog]
root@MustBeGeek# set file SessionsLog any any
[edit system syslog]
root@MustBeGeek# set file SessionsLog match RT_FLOW_SESSION
[edit system syslog]
root@MustBeGeek# set file SessionsLog archive size 1m files 3

[edit system syslog]

root@MustBeGeek# show
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
file SessionsLog {
any any;
match RT_FLOW_SESSION;
archive size 1m files 3;
}
Some useful commands for viewing and maintaining logs are:1. You can now view the logs by typing following commands in operational mode.
root@MustBeGeek> show log SessionsLog
2. You can also view real-time log messages of the log file by typing following
command in operational mode.
root@MustBeGeek> monitor start SessionsLog
3. The log files are in /cf/var/log location. You can view the log files by typi
ng following command. The command will show the list of configured log files.
root@MustBeGeek> file list /cf/var/log
4. To delete log files from here issue following command,
root@MustBeGeek> file delete /cf/var/log/SessionsLog
5. You can also delete log files and some temporary files by typing following co
mmand.
root@MustBeGeek> request system storage cleanup

Possible traceoptions

Overview
For SRX High-End devices, security logs such as traffic and IDP logs are streame
d through the traffic interface ports to a remote syslog server. You can configu
re that security logs are handled through the eventd process and sent with
system logs.
SRX High-End devices do not send session logs to the Routing Engine (RE). Becaus
e system logging is performed on the RE, session or traffic logs cannot be writt
en to the RE file system. Therefore, all traffic logging must be sent to
a remote syslog server. Because fxp0 belongs to the RE, the remote syslog serve
r must be reachable by an interface on an IOC. Traffic logging cannot be sent ou
t through fxp0.
CLI Configuration
To send traffic (security policy) logs to a remote syslog server, you must confi
gure the following:
Send security log messages to a remote syslog server.

Enable logging on security policies.

1. Send Security Log Messages to a Remote Syslog Server
The following example specifies that security log messages in structured-data fo
rmat are sent from 10.30.30.1 to a remote syslog server at 192.30.80.76
Specify that the IP address of the source system is 10.30.30.1 (for example, the
SRX Series device's loopback or other interface IP address).
user@host# set security log source-address 10.30.30.1
Specify that the messages are streamed to a remote log server with an IP address
of 192.30.80.76.
user@host# set security log stream trafficlogs host 192.30.80.76
Overview
You can use traffic logs to track usage patterns or troubleshoot issues for a sp
ecific policy. You can configure a policy so that traffic information is logged
when a session begins (session-init) and/or closes (session-close).
To generate traffic logs for multiple policies, you must configure each policy t
o log traffic information. You also must configure syslog messages with a severi
ty level of info or any. In the default configuration,
these messages and all other logging messages are sent to a local log file name
d messages.

Juniper SRX -- Troubleshoot: Troubleshoot connectivity by verifying security pol

icy allow/deny actions (match policies)
================================================================================
=======================================
https://www.juniper.net/documentation/en_US/junos12.1/topics/reference/c
ommand-summary/show-security-match-policies.html
show security match-policies from-zone z1 to-zone Z2 source-ip 8.8.8.8 destinati
on-ip 192.168.100.50 source-port 5555 destination-port 443 protocol tcp
Juniper SRX -- Troubleshoot: Restore a configuration from a TORQ backup
*********THIS ONE*********
=======================================================================
start shell ---> get into unix
Copy a File Using Secure Copy Protocol (scp)
To use scp to copy a local file to a remote system, enter the following command:
root@host> file copy filename scp://user@hostname/path/filename
In the following example, /config/juniper.conf is the local file, user is the us
ername, and ssh-host is the scp server:
root@host> file copy /config/juniper.conf scp://user@ssh-host/tmp/juniper.conf
user@ssh-host's password: ******
juniper.conf
100% |*****| 2198
00:00
scp configname sso@ip:disk0:configname
load override /var/tmp/filename

commit
http://kb.juniper.net/InfoCenter/index?page=content&id=KB21134&actp=search
They give nothing
============================================================================
Juniper
An SSH connection is established using the TACACS ID backups to the device's DRA
C IP from the applicable DC's IP range on port 22
There are three phases to backing these devices up:
Version - show version to get the configuraiton
running-config - show configuration | display set
finalize - Perform a commit to save the configuration and then properly
close the SSH connection.