Juniper SSG140 User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-015643-01
Security Products
SSG 140 Hardware Installation and Configuration Guide

2
Copyright Notice
Copyright © 2006 Juniper Networks, Inc. All rights reserved.
Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other
trademarks, service marks, registered trademarks, or registered service marks in this document are the property of Juniper Networks or their respective
owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for
any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication
without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense.
The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency
energy. If it is not installed in accordance with Juniper Network’s installation instructions, it may cause interference with radio and television reception.
This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC
rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no
guarantee that interference will not occur in a particular installation.
If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user
is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Consult the dealer or an experienced radio/TV technician for help.
Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Table of Contents 3
Table of Contents
About This Guide 5
Organization ....................................................................................................6
WebUI Conventions .........................................................................................6
CLI Conventions...............................................................................................7
Obtaining Documentation and Technical Support............................................8
Chapter 1 Hardware Overview 9
Port and Power Connectors ...........................................................................10
Front Panel ....................................................................................................11
Device Status LEDs..................................................................................11
Port Descriptions .....................................................................................12
Ethernet Ports ...................................................................................12
Console Port .....................................................................................13
AUX Port...........................................................................................13
Reset Pinhole...........................................................................................13
USB Port..................................................................................................14
Back Panel .....................................................................................................15
Physical Interface Module Descriptions ...................................................15
Power Switch...........................................................................................17
AC Power Appliance Inlet ........................................................................17
Fuse Cover...............................................................................................17
Chapter 2 Installing and Connecting the Device 19
Before You Begin ...........................................................................................20
Equipment Installation ...................................................................................20
Connecting Interface Cables to the Device .....................................................22
Connecting AC Power to the Device...............................................................22
Powering the Device On and Off....................................................................22
Connecting the Device to a Network ..............................................................23
Connecting an SSG 140 Device to an Untrusted Network ........................23
Connecting Ethernet Ports ................................................................24
Connecting Serial (AUX/Console) Ports..............................................24
Connecting PIMs......................................................................................24
Connecting the Device to an Internal Network or a Workstation .............25
Chapter 3 Configuring the Device 27
Accessing the Device......................................................................................28
Using a Console Connection ....................................................................28
Using the WebUI .....................................................................................29
Using Telnet ............................................................................................30
Default Device Settings ..................................................................................30
Basic Device Configuration ............................................................................32
Root Admin Name and Password ............................................................32

4Table of Contents
SSG 140 Series Hardware Installation and Configuration Guide
Date and Time.........................................................................................33
Administrative Access .............................................................................33
Management Services..............................................................................33
Hostname and Domain Name .................................................................34
Domain Name System Server..................................................................34
Default Route...........................................................................................35
Ethernet0/0 Interface IP Address .............................................................35
PIM Configuration .......................................................................................... 35
ISDN Interface .........................................................................................36
T1 Interface.............................................................................................36
E1 Interface.............................................................................................37
Serial WAN Interface ...............................................................................38
Basic Firewall Protections ..............................................................................39
Verifying External Connectivity......................................................................40
Resetting the Device to Factory Defaults........................................................40
Chapter 4 Servicing the Device 43
Tools and Parts Required ...............................................................................43
Replacing a Physical Interface Module ...........................................................44
Removing a Blank Faceplate....................................................................44
Removing a Physical Interface Module ....................................................44
Installing a Physical Interface Module......................................................45
Upgrading Memory ........................................................................................46
Replacing the Fuse.........................................................................................48
Appendix A Specifications A-51
SSG 140 Physical Specifications .....................................................................52
Electrical Specifications..................................................................................52
Environmental Tolerance...............................................................................52
Certifications..................................................................................................52
Safety ......................................................................................................52
EMC Emissions........................................................................................53
EMC Immunity ........................................................................................53
European Telecommunications Standards Institute .................................54
T1 Interface.............................................................................................54
Connectors.....................................................................................................54
Appendix B Initial Configuration Wizard B-55
Index..........................................................................................................................IX-I

5
About This Guide
The Juniper Networks Secure Services Gateway (SSG) 140 device is an integrated
router and firewall platform that provides Internet Protocol Security (IPSec) virtual
private network (VPN) and firewall services for small- and medium-sized
companies and enterprise branch and remote offices.
The SSG 140 supports support universal serial bus (USB) storage and four physical
interface modules (PIM) slots that can hold T1, E1, ISDN, and Serial wide area
network (WAN) PIMs. The SSG 140 also provides protocol conversions between
local area networks (LANs) and WANs.
NOTE: The configuration instructions and examples in this document are based on the
functionality of a device running ScreenOS 5.4. Your device might function
differently depending on the ScreenOS version you are running. For the latest
device documentation, refer to the Juniper Networks Technical Publications
website at http://www.juniper.net/techpubs/hardware. To see which ScreenOS
versions are currently available for your device, refer to the Juniper Networks
Support website at http://www.juniper.net/customers/support/.

SSG 140 Series Hardware Installation and Configuration Guide
6Organization
Organization
This guide contains the following sections:
Chapter 1, “Hardware Overview” describes the chassis and components of the
SSG 140 device.
Chapter 2, “Installing and Connecting the Device” describes how to mount an
SSG 140 device in a standard 19-inch equipment rack and how to connect cables
and power to the device.
Chapter 3, “Configuring the Device” describes how to configure and manage an
SSG 140 device and how to perform some basic configuration tasks.
Chapter 4, “Servicing the Device” describes service and maintenance procedures
for the SSG 140 device.
Appendix A, “Specifications” provides general specifications for the SSG 140
device.
Appendix B, “Initial Configuration Wizard” provides detailed information about
using the Initial configuration Wizard (ICW) for the SSG 140 device.
WebUI Conventions
To perform a task with the WebUI, you first navigate to the appropriate dialog box,
where you then define objects and set parameters. A chevron ( > ) shows the
navigational sequence through the WebUI, which you follow by clicking menu
options and links. The set of instructions for each task is divided into navigational
path and configuration settings.
The following figure lists the path to the address configuration dialog box with the
following sample configuration settings:
Objects > Addresses > List > New: Enter the following, then click OK:
Address Name: addr_1
IP Address/Domain Name:
IP/Netmask: (select), 10.2.2.5/32
Zone: Untrust

CLI Conventions 7
About This Guide
Figure 1: Navigational Path and Configuration Settings
CLI Conventions
The following conventions are used to present the syntax of CLI commands in
examples and in text.
In examples:
Anything inside square brackets [ ] is optional.
Anything inside braces { } is required.
If there is more than one choice, each choice is separated by a pipe ( | ). For
example:
set interface { ethernet1 | ethernet2 | ethernet3 } manage
means “set the management options for the ethernet1, the ethernet2, or the
ethernet3 interface.”
Variables are in italic type:
set admin user name1 password xyz
In text:
Commands are in boldface type.
Variables are in italic type.
NOTE: When entering a keyword, you need to type only enough letters to identify the
word uniquely. For example, typing set adm u kath j12fmt54 is enough to enter
the command set admin user kathleen j12fmt54. Although you can use this
shortcut when entering commands, all the commands documented here are
presented in their entirety.

SSG 140 Series Hardware Installation and Configuration Guide
8Obtaining Documentation and Technical Support
Obtaining Documentation and Technical Support
To obtain technical documentation for any Juniper Networks product, visit
www.juniper.net/techpubs/.
For technical support, open a support case using the Case Manager link at
http://www.juniper.net/support/ or call 1-888-314-JTAC (within the United States) or
1-408-745-9500 (outside the United States).
If you find any errors or omissions in this document, please contact us at the
following email address:
[e-mail]

9
Chapter 1
Hardware Overview
This chapter provides detailed descriptions of the SSG 140 chassis and its
components. It contains the following sections:
“Port and Power Connectors” on page 10
“Front Panel” on page 11
“Back Panel” on page 15

SSG 140 Series Hardware Installation and Configuration Guide
10 Port and Power Connectors
Port and Power Connectors
This section describes and displays the location of the built-in ports and power
connector.
Figure 2: Built-in Ports and Power Connector Locations
Table 1: SSG 140 Ports and Power Connector
POWER HA PIM1 PIM3
STATUS ALARM PIM2 PIM4 RESET
CONSOLEUSB AUX 10/100 10/100/1000
0/0 0/1 0/2 0/3
TX/RX TX/RX TX/RX TX/RXLINK LINK LINK LINK
0/4 0/5 0/6 0/7
TX/RX TX/RX TX/RX TX/RXLINK LINK LINK LINK
0/8
TX/RX LINK
0/9
TX/RX LINK
SSG 140
USB Port
Console Port AUX Port 10/100Ethernet
Ports 10/100/1000
Ethernet Ports
Front
E1
PORT 0
STATUS
PORT 1
STATUS
E1
PORT 0
STATUS
PORT 1
STATUS
I
O
AC Power Appliance Inlet Back
Port Description Connector Speed/Protocol
0/0-0/7 Enables direct connections to workstations or a LAN
connection through a switch or hub. This
connection also allows you to manage the device
through a Telnet session or the WebUI.
RJ-45 10/100 Mbps Ethernet
Autosensing duplex and auto MDI/MDIX
0/8-0/9 Enables direct connections to workstations or a LAN
connection through a switch or hub. This
connection also allows you to manage the device
through a Telnet session or the WebUI.
RJ-45 10/100/1000 Mbps Ethernet
Autosensing duplex and auto MDI/MDIX
USB Enables a 1.1 USB connection with the device. N/A 12M (full speed) or 1.5M (low speed)
Console Enables a serial connection with the device. Used
for terminal-emulation connectivity to launch CLI
sessions.
RJ-45 9600 bps/RS-232C serial
AUX Enables a backup RS-232 async serial Internet
connection through an external modem.
RJ-45 9600 bps — 115 Kbps/RS-232C serial
PIM
T1 Enables connection of a T1 line to the untrusted
network.
RJ-48 1.544 Mbps (full-time slots)
E1 Enables connection of an E1 line to the untrusted
network.
RJ-48 2.048 Mbps (full-time slots)
ISDN Enables connection of an ISDN line to the untrusted
network.
RJ-45 B-channels at 64 Kbps
Leased line at 128 Kbps
Serial Provides full-duplex, synchronous data transmission
over serial links.
DB-60 8 Mbps
Power
AC Power
appliance inlet
Accepts the supplied AC power cord. N/A 90-264 VAC 50-60 Hz

Front Panel 11
Front Panel
This section describes the following elements on the front panel of an SSG 140
device:
Device Status LEDs
Port Descriptions
Reset Pinhole
USB Port
Figure 3: SSG 140 Front Panel
Device Status LEDs
The device status LEDs display information about critical device functions. When
the device powers up, the POWER LED changes from off to green and the STATUS
LED changes from off to blinking green. Startup takes approximately one minute to
complete. If you want to turn the device off and on again, we recommend you wait
a few seconds between shutting it down and powering it back up. Table 2 provides
the name, color, status, and description of each device status LED.
Table 2: Status LED Descriptions
POWER HA PIM1 PIM3
STATUS ALARM PIM2 PIM4 RESET
CONSOLEUSB AUX 10/100 10/100/1000
0/0 0/1 0/2 0/3
TX/RX TX/RX TX/RX TX/RXLINK LINK LINK LINK
0/4 0/5 0/6 0/7
TX/RX TX/RX TX/RX TX/RXLINK LINK LINK LINK
0/8
TX/RX LINK
0/9
TX/RX LINK
SSG 140
Device Status LEDs
USB Port
Reset Pinhole Console Port
AUX Port 10/100
Ethernet Ports 10/100/1000 Ethernet Ports
Name Color Status Description
POWER Green On steadily Power is functioning correctly.
Off Device is not receiving power.
STATUS Green Off Device is powered off or is starting up.
Blinking Normal operation.

SSG 140 Series Hardware Installation and Configuration Guide
12 Front Panel
Port Descriptions
This section explains the purpose and function of the following:
Ethernet Ports
Console Port
AUX Port
Ethernet Ports
Eight 10/100 Fast Ethernet ports provide LAN connections to hubs, switches, local
servers, and workstations. You can also designate an Ethernet port for management
traffic. The ports are labeled 0/0 through 0/7. For the default zone bindings for each
Ethernet port, see “Default Device Settings” on page 30.
The SSG 140 device also has two 10/100/1000 Gigabit Ethernet ports (copper) to
provide connectivity to Gigabit Ethernet LANs. The Gigabit ports are labeled 0/8 and
0/9.
When configuring one of the ports, reference the interface name that corresponds
to the location of the port. From left to right on the front panel, the interface names
for the ports are ethernet0/0 through ethernet0/9.
Figure 4 displays the location of the LEDs on each Ethernet port.
ALARM Red On steadily Critical alarm:
Failure of hardware component or software module.
Firewall attacks detected.
Amber On steadily Major alarm:
Low memory (less than 10% remaining).
High CPU utilization (more than 90% in use).
Session full.
Maximum number of VPN tunnels reached.
HA status changed or redundant group member not
found.
Off No alarms.
HA (High
Availability)
Green On steadily Unit is the primary (master) device.
Amber On steadily Unit is the secondary (backup) device.
Off High availability not enabled.
PIM (1-4) Green On steadily PIM is ready for activity.
Blinking Traffic is present.
Off PIM is not present or is installed incorrectly.
Name Color Status Description

Front Panel 13
Figure 4: Ethernet port LEDs
Table 3 describes the LAN port LEDs.
Table 3: LAN Port LEDs
Console Port
The Console port is an RJ-45 serial port wired as Data Communications Equipment
(DCE) that can be used for local administration. An RJ-45 to DB-9 adapter is
supplied.
See Connectors on page 54 for the Console port connector pinouts.
AUX Port
The auxiliary (AUX) port is an RJ-45 serial port wired as a Data Terminal Equipment
(DTE) that can be connected to a modem to allow remote administration. We do not
recommend using this port for regular remote administration. The AUX port is
typically assigned to be the backup serial interface. The baud rate is adjustable from
9600 bps to 115200 bps and requires hardware flow control.
See “Connectors” on page 54 for the AUX port connector pinouts.
Reset Pinhole
The reset pinhole is a button that resets the device to its original default settings. To
use this button, insert a stiff wire (such as a straightened paper clip) into the
pinhole. See “Resetting the Device to Factory Defaults” on page 40 for more
information.
Function Color State Description
LINK Green On steadily
Off
Port is online
Port is offline
TX/RX Green Blinking
Off
Traffic is passing through. The data rate is
proportional to the TX/RX activity
Port might be on but is not receiving data
LINK
TX/RX
WARNING: Because resetting the device restores it to the original default
configuration, any new configuration settings are lost, and the firewall and all VPN
services become inoperative. We recommend that you save the device
configuration before resetting the device with the reset pinhole.

SSG 140 Series Hardware Installation and Configuration Guide
14 Front Panel
USB Port
The USB port on the front panel of an SSG 140 device accepts a universal serial bus
(USB) storage device or USB storage device adapter with a compact-flash disk
installed, as defined in the CompactFlash Specification published by the
CompactFlash Association. When the USB storage device is installed and
configured, it automatically acts as a secondary boot device if the primary
compact-flash disk fails on startup.
The USB port allows file transfers such as device configurations, user certifications,
and update version images between an external USB storage device and the
internal flash storage located in the security device. The USB port supports USB 1.1
specification at either low speed (1.5M) or full speed (12M) file transfer.
To transfer files between the USB storage device and an SSG 140, perform the
following steps:
1. Insert the USB storage device into the USB port on the security device.
2. Save the files from the USB storage device to the internal flash storage on the
device with the save {software | config | image-key} from usb filename to
flash CLI command.
3. Before removing the USB storage device, stop the USB port with the
exec usb stop CLI command.
4. Remove the USB storage device.
If you want to delete a file from the USB storage device, use the delete file
usb:/filename CLI command.
If you want to view the saved file information on the USB storage device or internal
flash storage, use the get file CLI command.

Back Panel 15
Back Panel
This section describes the following elements on the back panel of an SSG 140
device:
Physical Interface Module Descriptions
Power Switch
The back panel of the SSG 140 device contains four back panel slots for
user-installable physical Interface Modules (PIMs) and a power switch.
Figure 5: Back Panel of an SSG 140 Device
Physical Interface Module Descriptions
Physical interface modules (PIMs) allow you to connect an SSG 140 device to
geographically dispersed networks. These networks can be privately owned, but
they more typically include public or shared networks. Table 4 describes the PIMs
supported by the SSG 140 device. Table 5 describes the meaning of the PIM LED
states.
Table 4: SSG 140 PIMs
Table 5: PIM LED States on the SSG 140
E1
PORT 0
STATUS
PORT 1
STATUS
E1
PORT 0
STATUS
PORT 1
STATUS
I
O
PIM Slot 1
PIM Slot 2
PIM Slot 3
PIM Slot 4
Power Panel
Type Description
ISDN Provides connection to a single ISDN line.
T1 Provides connection to T1 or fractional T1 network media types.
E1 Provides connection to E1 or fractional E1 network media types.
Sync Serial Provides full-duplex, synchronous data transmission at up to 8 Mbps over serial
links.
Type Name Color State Description
ISDN STATUS Green On steadily Online with no alarms or failures.
Red On steadily Active with a local alarm; device has detected a
failure.
CH B1 Green On steadily Indicates that B-Channel 1 is active
Off Indicates that B-Channel 1 is not active
CH B2 Green On steadily Indicates that B-Channel 2 is active
Off Indicates that B-Channel 2 is not active

SSG 140 Series Hardware Installation and Configuration Guide
16 Back Panel
Figure 6: SSG 140 PIMs
Table 6 lists the cables that you can order from Juniper Networks to connect to a
port on the serial PIM. The device to which you are connecting and the serial
interface type determine which cable you need.
T1/E1 STATUS Green On steadily Online with no alarms or failures.
Red On steadily Active with a local alarm; device has detected a
failure.
Sync Serial STATUS Green On steadily Online with no alarms or failures.
Red On steadily Active with a local alarm; device has detected a
failure.
Type Name Color State Description
CAUTION: PIMs are not hot-swappable. You must install them in the back panel
slots before powering on the device.
ISDN
T1
E1
Synch Serial

Back Panel 17
Table 6: Juniper Serial Cables
Power Switch
The power switch is located on the right side of the back panel, as shown in
Figure 7. You use the power switch to power the SSG 140 device on and off. When
you power on the device, ScreenOS boots up as the power supply completes its
startup sequence.
Figure 7: Power Switch, AC Power Appliance Inlet, and Fuse Cover
AC Power Appliance Inlet
The AC power appliance inlet is located on the right side of the back panel, as
shown in Figure 7. You use the AC power appliance inlet to connect the SSG 140
device to an AC power source using the supplied AC power cord.
Fuse Cover
The fuse cover is located on the right side of the back panel, as shown in Figure 7.
To change the fuse, see “Replacing the Fuse” on page 48.
Product Number Interface Type Length (in feet) Connector Type
JX-CBL-EIA530-DCE EIA 530 (DCE) 10 feet Female
JX-CBL-EIA530-DTE EIA 530 (DTE) 10 feet Male
JX-CBL-RS232-DCE RS-232 (DCE) 10 feet Female
JX-CBL-RS232-DTE RS-232 (DTE) 10 feet Male
JX-CBL-RS449-DCE RS-449 (DCE) 10 feet Female
JX-CBL-RS449-DTE RS-449 (DTE) 10 feet Male
JX-CBL-V35-DCE V.35 (DCE) 10 feet Female
JX-CBL-V35-DTE V.35 (DTE) 10 feet Male
JX-CBL-X21-DCE X.21 (DCE) 10 feet Female
JX-CBL-X21-DTE X.21 (DTE) 10 feet Male
Power
Switch AC Power Appliance Inlet
Fuse
Cover

SSG 140 Series Hardware Installation and Configuration Guide
18 Back Panel

19
Chapter 2
Installing and Connecting the Device
This chapter describes how to install an SSG 140 device in a standard 19-inch
equipment rack and how to connect cables and power to the device. Topics in this
chapter include:
“Before You Begin” on page 20
“Equipment Installation” on page 20
“Connecting Interface Cables to the Device” on page 22
“Connecting AC Power to the Device” on page 22
“Powering the Device On and Off” on page 22
“Connecting the Device to a Network” on page 23
NOTE: For safety warnings and instructions, please refer to the Juniper Networks Security
Products Safety Guide. Before working on any equipment, you should be aware of
the hazards involved with electrical circuitry and should be familiar with standard
practices for preventing accidents.

SSG 140 Series Hardware Installation and Configuration Guide
20 Before You Begin
Before You Begin
The location of the chassis, the layout of the equipment rack, and the security of
your wiring room are crucial for proper device operation.
Observing the following precautions can prevent shutdowns, equipment failures,
and injuries:
Before installation, always check that the power supply is disconnected from
any power source.
Ensure that the room in which you operate the device has adequate air
circulation and that the room temperature does not exceed 104° F (40°C).
Allow 3 feet (1 meter) of clear space to the front and back of the device.
Do not place the device in an equipment rack frame that blocks the air vents on
the sides of the chassis. Ensure that enclosed racks have fans and louvered
sides.
Correct these hazardous conditions before any installation: moist or wet floors,
leaks, ungrounded or frayed power cables, or missing safety grounds.
Equipment Installation
You can mount the SSG 140 device into a standard 19-inch equipment rack.
To mount the SSG 140 device, you must have the following items:
Mounting brackets (provided)
Number-2 phillips head screwdriver (not provided)
Four sheet-metal screws that are compatible with the equipment rack (not
provided)
To install an SSG 140 device into a rack, perform the following steps:
1. Attach the left and right mounting brackets to the front of each side of the
chassis as shown in Figure 8.
CAUTION: To prevent abuse and intrusion by unauthorized personnel, install the
SSG 140 device in a secure environment.
NOTE: If you are installing multiple devices in one rack, install the lowest one first and
proceed upward in the rack.