\n
reset<\/pre>\n<\/div>\n <\/p>\n
Recovery of the device :<\/p>\n
- Restore firmware at boot time. If you have a corrupted flash image, but the bootloader still works, you can interrupt the boot process ("Hit any key to run loader" -> Press any key during the first couple of seconds of the boot process), and upload a new software version from a tftp server. You will need to set a local (self) IP address and the IP address of the tftp server - which needs to be on the same subnet - during the restore wizard. You will be prompted to save the file to flash, and whether you want to run the downloaded image.<\/p>\n
- Reset to factory defaults and restore config to flash<\/p>\n
- System (asset) recovery :<\/p>\n
* Login using serial number as username & password<\/p>\n
* Use pinhole on some devices :<\/p>\n
- Press until flashing light changes to orange<\/p>\n
- Release and count 3 seconds, then press again until flashing red<\/p>\n
- All leds will flash, device will reboot<\/p>\n
If you want to use the last procedure, this functionality has to be enabled on the device :<\/p>\n
\n
set admin device-reset\nset admin hw-reset<\/pre>\n<\/div>\nThe asset recovery procedure will allow you to overcome the problem of a lost password, however this procedure is quite destructive. It will remove all settings (including root password and certificates) from the device, so you'll need to reconfigure the device, or restore a recent backup file. You can see when an asset recovery has been performed on the device by looking at the control serial number in the output of a 'get sys'<\/p>\n
\n
get sys\nProduct Name: SSG-550\nSerial Number: 999999999999 , Control Number: 00000000<\/font>\nHardware Version: 0000(0)-(00), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0)\nSoftware Version: 5.4.0r7.0, Type: Firewall+VPN\nFeature: AV-K<\/pre>\n<\/div>\nEvery time an asset recovery is performed, the Control Number is increased by one.<\/p>\n
<\/p>\n
Zones & Interface configuration<\/h4>\n
On a SSG-550, these are the default zones :<\/p>\n
\n
firewall1-><\/span> get zone\n----------------------------------------------------------------------\n ID Name Type Attr VR Default-IF VSYS\n 0 Null Null Shared untrust-vr hidden Root\n 1 Untrust Sec(L3) Shared trust-vr null Root\n 2 Trust Sec(L3) trust-vr null Root\n 3 DMZ Sec(L3) trust-vr null Root\n 4 Self Func trust-vr self Root\n 5 MGT Func trust-vr null Root\n 6 HA Func trust-vr null Root\n 10 Global Sec(L3) trust-vr null Root\n 11 V1-Untrust Sec(L2) Shared trust-vr v1-untrust Root\n 12 V1-Trust Sec(L2) Shared trust-vr v1-trust Root\n 13 V1-DMZ Sec(L2) Shared trust-vr v1-dmz Root\n 14 VLAN Func Shared trust-vr vlan1 Root\n 15 V1-Null Sec(L2) trust-vr l2v Root\n 16 Untrust-Tun Tun trust-vr hidden.1 Root <\/pre>\n<\/div>\nYou can create your own zones and assign them to a VR. Every Virtual Router has its own routing table. In standard configurations, you'll have multiple zones, but only one Virtual Router (trust-vr). If you are using dynamic routing protocols and you want to separate routing tables, you may need multiple Virtual Routers.<\/p>\n
After creating a custom interface, you'll have to assign the interface to a zone. Then you can assign an IP address to an interface. You can only assign an IP address after an interface has been assigned to a zone.<\/p>\n
Don't use 255.255.255.255 as a subnetmask for the IP address of an interface. Use the networks's subnetmask, so the firewall can determine the "local subnet"<\/p>\n
<\/p>\n
Initial device configuration<\/h4>\nConnect, change passwords, create admin accounts<\/h5>\n
- Connect to the console using serial connection (9600bps, 8 bit, no parity, 1 stop bit, no flow control)<\/p>\n
- Default username & password : netscreen \/ netscreen<\/p>\n
(Change the password right away. Pay attention : you cannot recover the netscreen password easily, so don't forget this password !). <\/p>\n
\n
set admin password "ThisIsANewButBadPassword"\nsave<\/pre>\n<\/div>\nOptionally, you can change the default administrator account. In this example, I'm changing the username to "administrator"<\/p>\n
\n
set admin name netscreen "administrator"\nsave<\/pre>\n<\/div>\nCreate administrator account and assign rights (read-only or read-write)<\/p>\n
\n
set admin user "username" password "password" privilege all\nset admin user "readonlyuser" password "readonlypassword" privilege read-only\nsave<\/pre>\n<\/div>\nBy default, the internal database is used for admin authentication, but you can use an external resource (Radius, ldap, ...) for admin authentication as well.<\/p>\n
Set minimum password length to 8 and number of admin attempts to 2<\/p>\n
\n
set admin password restrict length 8\nset admin access attempts 2\nsave<\/pre>\n<\/div>\n <\/p>\n
If you want to restrict "root" login to console only, use<\/p>\n
\n
set admin root access console\nsave<\/pre>\n<\/div>\nYou can get all users and all ssh users, using the following commands :<\/p>\n
\n
get admin user\nget admin ssh all<\/pre>\n<\/div>\n <\/p>\n
Set hostname<\/p>\n
\n
set hostname "firewall1"\nsave<\/pre>\n<\/div>\n <\/p>\n
Set zones & interfaces<\/h5>\n
By default, the device has 3 zones : Trust, Untrust and DMZ. The interface in Trust mode is set to nat mode by defualt, all other interfaces are in route mode. By default, the device allows outbound access 'From Trust to Untrust) and blocks incoming access (default policy : deny)<\/p>\n
I recommend not to use any of these 3 zones, but to create your own zones, and assign your interfaces to your custom zones. I also do not recommend using interfaces in nat mode, but use route mode instead.<\/p>\n
Create 2 zones : One zone for Internet, one zone for your LAN, and assign the zones to a VR :<\/p>\n
\n
set zone "Internet"\nset zone "Internet" vrouter trust-vr\n\nset zone "Lan"\nset zone "Lan" vrouter trust-vr\n\nsave<\/pre>\n<\/div>\n <\/p>\n
Assign interface ethernet0\/1 to Internet, and interface ethernet0\/2 to Lan.<\/p>\n
\n
set interface ethernet0\/1 zone "Internet"\nset interface ethernet0\/2 zone "Lan"\nsave<\/pre>\n<\/div>\nSee zone configuration :<\/p>\n
\n
firewall1-><\/span> get zone\nTotal 16 zones created in vsys Root - 10 are policy configurable.\nTotal policy configurable zones for Root is 10.\n------------------------------------------------------------------------\n ID Name Type Attr VR Default-IF VSYS\n 0 Null Null Shared untrust-vr hidden Root\n 1 Untrust Sec(L3) Shared trust-vr null Root\n 2 Trust Sec(L3) trust-vr null Root\n 3 DMZ Sec(L3) trust-vr null Root\n 4 Self Func trust-vr self Root\n 5 MGT Func trust-vr null Root\n 6 HA Func trust-vr null Root\n 10 Global Sec(L3) trust-vr null Root\n 11 V1-Untrust Sec(L2) Shared trust-vr v1-untrust Root\n 12 V1-Trust Sec(L2) Shared trust-vr v1-trust Root\n 13 V1-DMZ Sec(L2) Shared trust-vr v1-dmz Root\n 14 VLAN Func Shared trust-vr vlan1 Root\n 15 V1-Null Sec(L2) trust-vr l2v Root\n 16 Untrust-Tun Tun trust-vr hidden.1 Root\n 100 Lan Sec(L3) trust-vr ethernet0\/2 Root\n 101 Internet Sec(L3) trust-vr ethernet0\/1 Root<\/font> <\/pre>\n<\/div>\nThe zone name has to be unique across all VR's<\/p>\n
Assign Lan interface a private static IP address, assign Interface a static IP address or DHCP IP address :<\/p>\n
\n
set interface ethernet0\/2 ip 192.168.0.1\/24\n\nset interface ethernet0\/1 ip 1.1.1.1\/29\nset interface ethernet0\/1 dhcp client enable\nsave<\/pre>\n<\/div>\nTip : if you need to define multiple interfaces in the same IP subnet, you'll have to enable this first in the vrouter<\/p>\n
\n
set vrouter trust-vr ignore-subnet-conflict\nsave<\/pre>\n<\/div>\n <\/p>\n
Note : Pay attention to the subnetmask when configuring a firewall interface. Don't use \/32 or the firewall won't work.<\/p>\n
Set both interfaces in route mode<\/p>\n
\n
set interface ethernet0\/1 route\nset interface ethernet0\/2 route\nsave<\/pre>\n<\/div>\n <\/div>\n
Set interface duplex and speed parameters (if required ! - by default, autonegotiation works fine)<\/div>\n
\n
set interface ethernet0\/2 phy ?\nauto auto negotiation\nfull force full duplex\nhalf force half duplex\nholddown holddown time\nlink-down bring down link<\/font>\n\nset interface ethernet0\/2 phy full ?\n1000mb 1000Mbps\n100mb 100Mbps\n10mb 10Mbps<\/font><\/pre>\n<\/div>\n <\/div>\n
Activate license, configure routing and anti-spoofing<\/h5>\nIt is advised to install your license now. You'll need to activate your device on the Juniper website, and then you can run the exec license-key update command to retrieve your license key. Use the "save" command to save the license key on the device.<\/div>\n
<\/div>\n
In order to download the key, the device needs to have access to the internet, so you'll have to create a default route and configure DNS resolution first :<\/div>\n
Assuming that your firewall has a static public IP address 1.1.1.1 and that the internet router (default gateway) is 1.1.1.2, and your public DNS is at 2.2.2.2, then you can use the following commands to allow the firewall to access the internet :<\/div>\n
\n
set route 0.0.0.0\/0 gateway 1.1.1.2\nset dns host dns1 2.2.2.2 src-interface ethernet0\/1\nsave<\/pre>\n<\/div>\n <\/div>\n
Now you can install the license key :<\/div>\n
\n
firewall1-><\/span> exec license-key update\nLicense key was retrieved successfully.\nLicense keys have been updated.\nYou must reset the device for the new setting to take effect.<\/font>\nfirewall1-><\/span> save\nfirewall1-><\/span> reset<\/pre>\n<\/div>\nAfter rebooting, you can verify that the key was installed correctly using<\/p>\n
\n
firewall1-><\/span> get license-key\ndi_db_key : JDkdLZidzoad9Z\u00e7jdklDIODiodaodiaOODIDZAdkdlazdD93+D\n DKJ393jdLDKlcdkdLKZCnCZALDIdzidldjidLDZEIDJIZIODOD\n DZKJLDLLIEDiODIJDELlkkLD\/\n bdazjlDIZDlldiIED0O93jdKLDZJIDO3DOJEIOLDJKLLDKDKDK\n DKDJKLDlID9D9DKldjdklDJIDIDOZDNSQCCBZJK2E238ldklde\n DZKALldi\u00e73IK3LLjdkl30DJKLDL3ZJJKLL\/\n DKJLKddlzlzjkLDIZIlazkalJDII3CBNQDMJKDLKMkdlekldek\n DZKLjdlkJD\/DJKLDL3LJDKL3IOMOMKDLK==\nexpire date: 2009\/01\/1\nModel: Advanced\nSessions: 128064 sessions\nCapacity: unlimited number of users\nNSRP: ActiveActive\nVPN tunnels: 1000 tunnels\nVsys: None\nVrouters: 8 virtual routers\nZones: 512 zones\nVLANs: 150 vlans\nDrp: Enable\nDeep Inspection: Enable\nDeep Inspection Database Expire Date: 2012\/01\/01<\/font><\/pre>\n<\/div>\n(don't bother - I have used a random string as db_key in my example...)<\/p>\n
<\/div>\n
Depending on how your network looks like, you may or may not need to add more routes to your firewall. <\/div>\n
By default, a route is "dynamic". This means that, if the interface that 'hosts' the route goes down, the route is removed from the routing table. So if you have 2 interfaces that have a route to the same subnet, but with a different cost, you can create some dynamic routing based on interface status. Of course, you can create a permanent route as well, that is not affected by interface status.<\/div>\n
Let's assume that you have another subnet 192.168.1.0\/24 that is in your Lan, setting behind router 192.168.0.10, then this would be the command to add the route to your firewall (to trust-vr by default) :<\/div>\n
\n
set route 192.168.1.0\/24 gateway 192.168.0.10 permanent\nsave<\/pre>\n<\/div>\n <\/div>\n
If you want to create a route in a specific (non default) VR, you can use this statement :<\/div>\n
\n
set vrouter YourOwn-vr route 192.168.0.0\/24 interface ethernet0\/3 gateway 10.1.1.1\n\nsave<\/pre>\n<\/div>\n <\/p>\n
You can get the routing table using<\/div>\n
\n
get route<\/pre>\n<\/div>\nA route with type C = connected subnet <\/p>\n
You will see an entry for the IP address of every ethernet interface, with type "H". This is not a real route and will not be used during route evaluation. When debugging, these host entries will be referred to as "SELF"<\/p>\n
Equal cost multipath routing is allowed<\/p>\n
ScreenOS supports source-based and destination-based routing, and supports RIP, OSPF and BGP<\/p>\n<\/div>\n
<\/div>\n
You can test routes using the "get route" statement. This will show the route\/interface it will use to get to the target host or network :<\/div>\n
\n
firewall-> get route ip 192.168.1.15\n\nDest for 192.168.1.15<\/font>\n\n--------------------------------------------------------------------------------<\/font>\n\ntrust-vr : => 192.168.1.0\/24 (id=16) via 192.168.0.10 (vr: trust-vr)<\/font>\n\nInterface ethernet0\/2 , metric 1<\/font><\/pre>\n<\/div>\n <\/div>\n
You can also verify routing using the ping and trace-route commands. If you launch 'ping' without any parameters, you enter the extended ping mode. This allows you to specify the target IP, number of pings, datagram size, timeout, and source interface.<\/div>\n
<\/div>\n
You can remove a route using the unset command :<\/div>\n
\n
firewall1-><\/span> unset route 4.4.4.0\/24\ntotal routes deleted = 1<\/font><\/pre>\n<\/div>\n <\/div>\n
If you are using multiple VR's, you'll need to set up routing between the two VR's. For that matter, you can use the name of each VR as gateway on both VR's<\/div>\n
<\/div>\n
<\/div>\n
Anti-spoofing :<\/u><\/div>\nL3 mode : based on routing tables <\/p>\n
L2 mode : based on address list entries<\/p>\n<\/div>\n
Anti-spoofing requires your routing table to be set up correctly. You can enable anti-spoofing on a per zone basis :<\/div>\n
\n
set zone "Internet" screen ip-spoofing\n\nsave<\/pre>\n<\/div>\n <\/p>\n
If you want to check for reverse-path routes to drop or allow traffic, use this command :<\/p>\n
\n
set zone "Internet" screen ip-spoofing drop-no-rpf-route\n\nsave<\/pre>\n<\/div>\n <\/div>\n
<\/div>\n
Restrict management to\/from certain IP addresses and on certain management services<\/h5>\n
Management services :<\/p>\n
- Telnet, SSH, HTTP(s), snmp, ping, ident<\/p>\n
- Can be enabled\/disabled per interface and optioanlly set to a virtual IP address on the interface (manage ip)<\/p>\n
- Traffic for these management services can be allowed from certain IP addresses only (manager-ip)<\/p>\n
- Always disable ident, unless you have problems with AS400 RPC connections<\/p>\n
First, disable management services on all interfaces :<\/p>\n
\n
unset interface ethernet0\/1 manage\nunset interface ethernet0\/2 manage\nunset interface ethernet0\/1 ip manageable\nunset interface ethernet0\/2 ip manageable\nsave<\/pre>\n<\/div>\n <\/p>\n
Create a virtual IP address on the Lan interface (192.168.0.2) to allow local administrators to connect :<\/p>\n
\n
set interface ethernet0\/2 manage-ip 192.168.0.2set interface ethernet0\/2 ip manageablesave<\/pre>\n<\/div>\nYou can see the virtual IP address that is used to host the management services using this command :<\/p>\n
\n
get int ethernet0\/2 | incl manage\nmanage ip 192.168.0.2, mac 0010.dbe2.c300<\/font><\/pre>\n<\/div>\nEnable management services on Lan interface :<\/p>\n
\n
set admin http redirect\nset interface ethernet0\/2 manage ssh\nset interface ethernet0\/2 manage ssl\nset ssl encrypt 3des sha-1\nset interface ethernet0\/2 manage web\nsave<\/pre>\n<\/div>\nIf you want to disable one of the management services (e.g. disable ping to the Lan interface), use<\/p>\n
\n
unset interface ethernet0\/2 manage ping\n\nsave<\/pre>\n<\/div>\nIf you want to allow management on all services, use this command :<\/p>\n
\n
set interface ethernet0\/2 manage<\/pre>\n<\/div>\nOnly allow traffic from management station 192.168.0.5 Note : configure this via the console cable, as you may cut off your own connection if you don't specify your own IP address first.<\/p>\n
\n
set admin manager-ip 192.168.0.5 255.255.255.255\nsave<\/pre>\n<\/div>\nYou can see the IP addresses that are allowed to access the management services using the following commands :<\/p>\n
\n
get sys | incl "Mng Host"\n\nMng Host IP: 192.168.0.5\/255.255.255.255<\/font>\n\n<\/font> get admin manager-ip\n\nMng Host IP: 192.168.0.5\/255.255.255.255<\/font><\/pre>\n<\/div>\nYou can define up to 6 IP addresses as manager-ip<\/p>\n
Set console timeout. Default = 10 minutes, recommended : 5 minutes :<\/p>\n
\n
set console timeout 5\nsave<\/pre>\n<\/div>\nTip : you can get the open\/listening ports on the device using the \u201cget socket\u201d command.<\/p>\n
<\/p>\n
Set up NTP, DNS, SNMP and Syslog<\/h5>\n
NTP :<\/u><\/p>\n\n
set ntp server 192.168.0.3\nset ntp server src-interface ethernet0\/2\nset ntp timezone 1\nset clock timezone 1\nset clock ntp\nsave\nget clock\n\nexec ntp update<\/pre>\n<\/div>\nThe last command will force a manual ntp update<\/p>\n
DNS :<\/u><\/p>\n\n
set dns host dns1 192.168.0.4 src-interface ethernet0\/2\nset domain mydomain.com\nset dns host schedule 04:00 interval 4\nsave<\/pre>\n<\/div>\nThe dns host schedule interval defines the cache refresh time for DNS hostnames that are defined in the address list.<\/p>\n
If you already had a DNS entry because of the license key installation, you can remove that entry using an unset command :<\/p>\n
\n
unset dns host dns1<\/pre>\n<\/div>\nSNMP :<\/u><\/p>\n\n
set snmp community "MyROCommunity" Read-Only Trap-on traffic version v1\nset snmp host "MyROCommunity" 192.168.0.100 255.255.255.255 src-interface ethernet0\/2 trap v1\nset snmp port listen 161\nset snmp port trap 162\nsave<\/pre>\n<\/div>\n<\/u><\/p>\n
Syslog :<\/p>\n<\/p>\n
\n
set syslog config "192.168.0.101"\nset syslog config "192.168.0.101" facilities local0 local1\nset syslog src-interface ethernet0\/2\nset syslog enable\nsave<\/pre>\n<\/div>\n <\/p>\n
Address Lists and Policies<\/h4>\n
Default policy is defined in "Global" Zone (default deny). By default, deny will be applied, but you won't see this when querying the device. It is recommended to set the global policy to any any deny, that way you can see the global policies if you want to<\/p>\n
\n
firewall1-><\/span> get policy all | incl Global\nNo global policy!Default deny.<\/font>\nfirewall1-><\/span> set policy global any any deny\nfirewall1-><\/span> save<\/pre>\n<\/div>\n <\/div>\n
Firewall policies are always created between two different zones. (exception : if you have enabled intrazone blocking, you can apply policies for traffic within the same zone)<\/div>\n
If traffic does not match any of the rules, then the global policy applies. This means that you don't need a any any deny policy for every Source Zone to Target Zone ruleset definition.<\/div>\n
<\/div>\n
Before you can create firewall policies, you'll need "address" definitions and "service" definitions.<\/div>\n
First, you need to create an address (host or network) in a specific zone :<\/div>\n
\n
set address "Lan" "Proxyserver1" 192.168.0.200 255.255.255.255 "Proxy Server 1"\nset address "Lan" "LanNetwork1" 192.168.0.0 255.255.255.0 "Local Network 1"\nset address "Lan" "LanNetwork2" 192.168.1.0 255.255.255.0 "Local Network 2"\n\nsave<\/pre>\n<\/div>\nYou can create an address multiple times, and in multiple zones at the same time. Suppose you have a remote host that can be reached via 2 different routes over 2 different interfaces, that are in different zones, then you'll need to define the same host twice.<\/p>\n
You can group addresses using the GUI or CLI :<\/p>\n
\n
set group address "Lan" "LocalNetworks" add "LanNetwork1"\nset group address "Lan" "LocalNetworks" add "LanNetwork2"<\/pre>\n<\/div>\nNext, you can create custom services. The device is already pre-loaded with some services, so verify that the service does not exist yet.<\/p>\n
\n
set service "MyCustomService" protocol tcp src-port 0-65535 dst-port 1234-1234\nsave<\/pre>\n<\/div>\nNote : you can group services as well, which is the preferred method over creating rules with multiple individual services. During evaluation of the policy, every source\/target\/service rule will be split up, causing the device to use more resources.<\/div>\n
<\/div>\n
Now you are ready to create a policy. <\/div>\n
- New policies are added to the bottom of the list. Use the GUI to rearrange the new policy (or command line : e.g. 'set policy move 5 before 4')<\/div>\n
- Make sure to manually activate nat-src for traffic going to the internet ! (see later - Address Translation)<\/div>\n
- Policy actions can be permit, deny, reset or tunnel<\/div>\n
- Policies can be scheduled (one time, recurring). If you have created a one time policy, the policy will not be removed automatically, so you'll need to clean up afterwards<\/div>\n
- You can negate source or destination addresses using the "negate" statement in the policy definition<\/div>\n
<\/div>\n
If you want to allow the proxy server to access all hosts on the internet, on port 1234, then use the following statement :<\/div>\n
\n
set policy from "Lan" to "Internet" "ProxyServer1" ANY "MyCustomService" nat src permit\n\nsave<\/pre>\n<\/div>\n <\/div>\n
You can get the policies using<\/div>\n
\n
get policy from "Lan" to "Internet"<\/pre>\n<\/div>\n <\/div>\n
I must admit - I like the CLI a lot, but if you want to create and manage policies, it's just so much easier to use the HTTPS GUI for policy management.<\/div>\n
<\/div>\n
How does Juniper handle packets & sessions ? <\/div>\n
![\"image\"](\"\/wp-content\/uploads\/2008\/09\/image.png\")
<\/a><\/p>\n