Juniper SRX 3400 User manual

SRX 3400 Services Gateway
Getting Started Guide
2 February 2009
Part Number: 530-026091-01
Revision 01
This document describes how to install the SRX 3400 services gateway.
Contents About This Guide .............................................................................................3
Step 1: Prepare the Site ...................................................................................5
Rack-Mounting Requirements ...................................................................5
Required Tools ..........................................................................................5
Step 2: Install the Mounting Hardware ............................................................6
Step 3: Install the Device .................................................................................7
Install the Device Using a Lift ....................................................................7
Install the Device Without a Mechanical Lift ...........................................10
Remove Components .......................................................................10
Lift the Chassis into the Rack ............................................................11
Reinstall Components ......................................................................12
Step 4: Connect the External Devices and IOC Cables ...................................12
Connect to a Network for Out-of-Band Management ...............................13
Connect a Management Console .............................................................13
Connect the IOC Cables ..........................................................................13
Step 5: Connect the Ground and Power Cables .............................................14
Connect the Grounding Cable .................................................................14
Connect Power to an AC-Powered Services Gateway ..............................15
Connect Power to a DC-Powered Services Gateway ................................16
Step 6: Perform the Initial Software Configuration ........................................18
■1

Safety Warnings ............................................................................................22
Compliance Statements for EMC Requirements ............................................24
Canada ...................................................................................................24
European Union ......................................................................................24
List of Technical Publications ........................................................................24
Requesting Technical Support .......................................................................25
Revision History ............................................................................................26
2■
SRX 3400 Services Gateway Getting Started Guide

About This Guide
This guide contains information you need to install and configure the SRX 3400
services gateway quickly. For complete installation instructions, and instructions on
installing additional modules such as cards and power supplies, see the SRX 3400
Services Gateway Hardware Guide at http://www.juniper.net/techpubs/.
WARNING: This guide contains a summary of safety warnings in “Safety
Warnings”on page 22. For a complete list of warnings for this device, including
translations, see the SRX 3400 Services Gateway Hardware Guide at
http://www.juniper.net/techpubs/.
The SRX 3400 services gateway is a high-performance, scalable, carrier-class security
device with multi-processor architecture. The services gateway has a capacity of up
to 20 gigabits per second (Gbps), full duplex. The device is 3 rack units (U) tall. Sixteen
devices can be stacked in a single floor-to-ceiling rack, for increased port density per
unit of floor space. The device provides seven Common Form-factor Module (CFM)
slots that can be populated with up to four Services Processing Cards (SPCs), up to
two Network Processing Cards (NPCs), and up to four I/O cards (IOCs). The device
also has one dedicated slot for the Switch Fabric Board (SFB), two slots for Routing
Engines, two slots for power supplies, and one slot for the fan tray and air filter.
Figure 1: Front View of the SRX 3400 Services Gateway
Cooling
air exhaust
ESD
point
IOC in
slot 1
SFB
USB
ports
Console
ports
g036000
Slot
number
guide CFM slots
for IOCs
and SPCs
About This Guide ■3
About This Guide

Figure 2: Rear View of the SRX 3400
g036001
ESD
point
Power
supplies
Routing
Engine
Chassis
grounding
point
Fan tray
door
Cooling
air inlets
Slot
number
guide
CFM slots
for SPCs
and NPCs
By installing different combinations of IOCs and SPCs, you can tailor both the number
of network ports and the maximum security processing capacity to suit your network.
Table 1 on page 4 describes the minimum system configuration for the SRX 3400.
Table 1: Minimum System Configuraton
MinimumComponent
1SFB
1SPC
1NPC
1Routing Engine
1Power Supply
1Fan Tray
Three types of IOC interface cards are available:
■16-port copper Ethernet/Fast Ethernet/Gigabit Ethernet (10/100/1000 Mbps) card
■16-port SFP Gigabit Ethernet card
■2-port XFP 10 Gigabit Ethernet card
You can install any combination of IOC types in the services gateway.
4■About This Guide
SRX 3400 Services Gateway Getting Started Guide

NOTE: Some combinations of CFMs installed in the device may exceed the power
supply capacity if the device is powered by one or even two DC power supplies. If
the device configuration exceeds the available power, the power management feature
disables one or more of the CFMs to prevent damage to the device or power supplies.
See the SRX 3400 Services Gateway Hardware Guide for information about supported
configurations.
The services gateway is shipped in a cardboard carton. Quick start installation
instructions and an accessory box are also included in the shipping container.
Step 1: Prepare the Site
Rack-Mounting Requirements
■You can install the device in a four-post rack or cabinet or a two-post rack.
CAUTION: When installing the device in a two-post rack, you must install the
mounting brackets in the chassis center holes as shown in Figure 3 on page 6.
■The rack rails must be spaced widely enough to accommodate the external
dimensions of the device chassis: 5.25 in. (13.3 cm) high, 25.5 in. (64.8 cm)
deep, and 17.5 in. (44.5 cm) wide. The outer edges of the mounting brackets
extend the width to 19 in. (48.3 cm).
■The rack must be strong enough to support the weight of the fully configured
device, up to 75 lbs (34.1 kg). If you stack five fully configured devices in one
rack, it must be capable of supporting about 375 lb (170 kg).
■For service personnel to remove and install hardware components, there must
be adequate space at the front and back of the device. Allow at least
30 in. (76.2 cm) in front of the device and 24 in. (61 cm) behind the device.
■The rack or cabinet must have an adequate supply of cooling air.
■Ensure that the cabinet allows the chassis hot exhaust air to exit the cabinet
without recirculating into the device.
■The device must be installed in a rack that is secured to the building structure.
■The device should be mounted at the bottom of the rack if it is the only unit in
the rack.
■When mounting the device in a partially filled rack, load the rack from the bottom
to the top with the heaviest component at the bottom of the rack.
Required Tools
To unpack the services gateway and prepare for installation, you need the following
tools:
■A mechanical lift—recommended
Step 1: Prepare the Site ■5
Step 1: Prepare the Site

■Phillips screwdrivers, numbers 1 and 2
■Electrostatic discharge (ESD) wrist strap
Step 2: Install the Mounting Hardware
The specific mounting hardware required depends on the type of rack being used.
Use the appropriate procedure steps to install the mounting hardware for your
situation.
To install the mounting hardware:
1. Locate the rack mount brackets in the accessory kit.
2. Use the screws provided to secure the rack mount brackets to the sides of the
chassis:
■For a two-post rack, mount the brackets at the mid-mount holes as shown
in Figure 3 on page 6.
■For a four-post rack, mount the brackets near the front edge of the chassis
as shown in Figure 4 on page 6.
Figure 3: Attaching Mounting Hardware for Two-Post Rack
g030257
Figure 4: Attaching Mounting Hardware for Cabinet or Four-Post Rack
g036007
6■Step 2: Install the Mounting Hardware
SRX 3400 Services Gateway Getting Started Guide

3. For installation in a four-post rack or a cabinet, install the support shelf on the
rear posts as shown in Figure 5 on page 7.
Figure 5: Attaching Four-Post and Cabinet Support Shelf
Rear rack uprights
g036094
Step 3: Install the Device
Because of the device's size and weight, we recommend you install the device using
a mechanical lift. The procedure for installing the device depends on whether you
use a mechanical lift:
■Install the Device Using a Lift on page 7
■Install the Device Without a Mechanical Lift on page 10
Install the Device Using a Lift
1. Ensure the rack is in its permanent location and is secured to the building. Ensure
that the installation site allows adequate clearance for both airflow and
maintenance. For details, see the SRX 3400 Services Gateway Hardware Guide.
2. Load the device onto the lift, making sure it rests securely on the lift platform
(see Figure 6 on page 8).
Step 3: Install the Device ■7
Step 3: Install the Device

Figure 6: Load the Device onto the Lift
0
1
2
3
4
g030261
3. Using the lift, position the device in the rack:
■For two-post rack mounting, align the bottom hole in each mounting bracket
with a hole in each rack rail.
■For four-post rack or cabinet mounting, position the device so that the bottom
rear edge of the chassis rests on the support shelf you installed earlier as
shown in Figure 5 on page 7.
4. Install a mounting screw into each of the two aligned holes as shown in
Figure 7 on page 9 (two-post rack) or Figure 8 on page 9 (four-post rack). Use
a number-2 phillips screwdriver to tighten the screws.
8■Step 3: Install the Device
SRX 3400 Services Gateway Getting Started Guide

Figure 7: Installing the Device in a Two-Post Rack
g030258
Figure 8: Installing the Device in a Four-Post Rack
0
1
2
3
4
g036095
Rear shelf
5. Install the remaining screws in each mounting bracket.
6. Move the lift away from the rack.
7. Visually inspect the alignment of the device. If the device is installed properly in
the rack, all the mounting screws on one side of the rack should be aligned with
the mounting screws on the opposite side, and the device should be level.
Step 3: Install the Device ■9
Step 3: Install the Device

Install the Device Without a Mechanical Lift
To install the device without a mechanical lift:
■Remove Components on page 10
■Lift the Chassis into the Rack on page 11
■Reinstall Components on page 12
Remove Components
To make the services gateway light enough to install manually, you first remove most
components from the chassis as shown in Figure 9 on page 10 and
Figure 10 on page 11. The procedure in this section for removing components from
the chassis is for initial installation only and assumes that you have not connected
power cables to the services gateway:
■Power supplies
■Switch Fabric Board (SFB)
■Routing Engine
■I/O Cards (IOCs)
■Network Processing Cards (NPCs)
■Services Processing Cards (SPCs)
■Fan tray
Figure 9: Components to Remove from the Front of the Device
0
1
2
3
4
g030263
Cards in
CFM slots
SFB
10 ■Step 3: Install the Device
SRX 3400 Services Gateway Getting Started Guide

Figure 10: Components to Remove from the Rear of the Device
g030264
Power
supplies
Routing
Engine
Fan tray
(behind door)
Cards in
CFM slots
To remove the components from the device:
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 3400 Services Gateway Hardware Guide.
2. Release each component by loosening its retaining screws and unlatching its
ejector handles as appropriate. For full instructions on removing device
components, see the SRX 3400 Services Gateway Hardware Guide.
3. Slide each component out of the chassis evenly so that it does not become stuck
or damaged.
4. Label each component as you remove it so you can reinstall it in the correct
location.
5. Immediately store each removed component in an antistatic bag.
6. Do not stack removed components. Lay each one on a flat surface.
NOTE: For complete instructions on removing device components, see “Installing
the Services Gateway Without a Mechanical Lift”in the SRX 3400 Services Gateway
Hardware Guide.
Lift the Chassis into the Rack
Lifting the chassis and mounting it in a rack requires two people. The empty chassis
weighs approximately 32.3 lb (14.7 kg).
1. Ensure the rack is in its permanent location and is secured to the building.
2. Position the chassis in front of the rack or cabinet. Use a pallet jack if one is
available.
3. With one person on each side, lift the chassis into position in the rack:
■For two-post rack mounting, align the bottom hole in each mounting bracket
with a hole in each rack rail.
Step 3: Install the Device ■11
Step 3: Install the Device

■For four-post rack or cabinet mounting, position the device so that the bottom
rear edge of the chassis rests on the support shelf you installed earlier as
shown in Figure 5 on page 7.
Figure 11: Lift the Chassis into the Rack
0
1
2
3
4
g030259
4. Use the screws to attach the left and right brackets to the rack.
5. Visually inspect the alignment of the chassis. If the chassis is installed properly
in the rack, all the mounting screws on one side of the rack should be aligned
with the mounting screws on the opposite side, and the chassis should be level.
Reinstall Components
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 3400 Services Gateway Hardware Guide.
2. Slide each component into the chassis evenly so that it does not become stuck
or damaged.
3. Tighten the captive screws or lock any levers for each component installed.
NOTE: Make sure that all empty slots are covered with blank panels before operating
the device.
Step 4: Connect the External Devices and IOC Cables
To connect external devices and IOC cables:
■Connect to a Network for Out-of-Band Management on page 13
■Connect a Management Console on page 13
■Connect the IOC Cables on page 13
12 ■Step 4: Connect the External Devices and IOC Cables
SRX 3400 Services Gateway Getting Started Guide

Figure 12: Connect External Devices and IOC Cables
0
1
2
3
4
g036011
RE CONSOLE
0
1
SCB FRONT 0PWR
HAREAR 1 FAN
ALARM
Connect to a Network for Out-of-Band Management
1. Plug one end of the RJ-45 Ethernet cable into the RE ETHERNET 0 port on the
Switch Fabric Board (SFB).
2. Plug the other end of the cable into the network device.
Connect a Management Console
1. Plug the RJ-45 end of the serial cable into the RE CONSOLE 0 port on the Switch
Fabric Board (SFB).
2. Plug the female DB-9 end into the device's serial port.
Connect the IOC Cables
1. Have ready a length of the type of cable used by the IOC. For cable specifications,
see the SRX 3400 Services Gateway Hardware Guide.
2. If you are connecting a fiber IOC cable, the connector port may be covered by
a rubber safety cap. If it is, remove the cap.
WARNING: Do not look directly into a fiber-optic transceiver or into the ends of
fiber-optic cables. Fiber-optic transceivers and fiber-optic cable connected to a
transceiver emit laser light that can damage your eyes.
Step 4: Connect the External Devices and IOC Cables ■13
Step 4: Connect the External Devices and IOC Cables

CAUTION: Do not leave a fiber-optic transceiver uncovered except when inserting
or removing cable. The safety cap keeps the port clean and prevents accidental
exposure to laser light.
3. Insert the cable connector into the cable connector port on the IOC faceplate.
CAUTION: Avoid bending fiber-optic cable beyond its minimum bend radius. An arc
smaller than a few inches in diameter can damage the cable and cause problems
that are difficult to diagnose.
CAUTION: Do not let fiber-optic cable hang free from the connector. Do not allow
fastened loops of cable to dangle, which stresses the cable at the fastening point.
Step 5: Connect the Ground and Power Cables
Depending on your configuration, your device uses either AC or DC power supplies.
Perform the appropriate procedures for each power supply in your device.
NOTE: The device is not shipped with an AC power cord. Make sure you order or
obtain an AC power cord with a plug appropriate for your geographical location.
■Connect the Grounding Cable on page 14
■Connect Power to an AC-Powered Services Gateway on page 15
■Connect Power to a DC-Powered Services Gateway on page 16
Connect the Grounding Cable
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 3400 Services Gateway Hardware Guide.
2. Connect the grounding cable to a proper earth ground.
3. Verify that a licensed electrician has attached the cable lug provided with the
services gateway to the grounding cable.
4. Place the grounding cable lug over the grounding point. The grounding point is
sized for M5 screws. See Figure 13 on page 15.
5. Secure the grounding cable lug to the grounding point, first with the washers,
then with the screws.
14 ■Step 5: Connect the Ground and Power Cables
SRX 3400 Services Gateway Getting Started Guide

Figure 13: Connecting the Grounding Cable
g036091
6. Verify that the grounding cabling is correct, that it does not touch or block access
to device components, and that it does not drape where people could trip on it.
Connect Power to an AC-Powered Services Gateway
WARNING: The device must be properly grounded before you connect the AC power
cords.
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 3400 Services Gateway Hardware Guide.
2. Locate the power cord or cords you will use to connect the device to AC power.
See the SRX 3400 Services Gateway Hardware Guide for specifications.
3. For each power supply:
a. Insert the appliance coupler end of the power cord into the appliance inlet
on the power supply.
b. Insert the power cord plug into an external AC power source receptacle.
NOTE: Each power supply must be connected to a dedicated AC power feed and a
dedicated external circuit breaker. We recommend that you use a 15 A (250 VAC)
minimum, or as permitted by local code.
Step 5: Connect the Ground and Power Cables ■15
Step 5: Connect the Ground and Power Cables

c. Snap the wire bail over the power cord as shown in Figure 14 on page 16
to prevent the power cord from accidentally disengaging.
d. Dress the power cord appropriately. Verify that the power cord does not
block the air exhaust and access to device components or drape where
people could trip on it.
Figure 14: Connecting AC Power to the Services Gateway
g036009
4. If sufficient power is available and the AC power supply is correctly installed,
the power supply powers up automatically. If the AC power supply is installed
correctly, the PWR LED on the SFB lights steadily.
If the PWR LED indicates that the power supply is not functioning normally,
repeat the installation and cabling procedures.
Connect Power to a DC-Powered Services Gateway
WARNING: The device must be properly grounded before you connect the DC power
cables.
Table 2: DC Power System Input Voltage
SpecificationItem
Operating range: –40.5 to –72 VDCDC input voltage
16 ■Step 5: Connect the Ground and Power Cables
SRX 3400 Services Gateway Getting Started Guide

CAUTION: You must ensure that power connections maintain the proper polarity.
The power source cables might be labeled (+) and (–)to indicate their polarity. There
is no standard color coding for DC power cables. The color coding used by the external
DC power source at your site determines the color coding for the leads on the power
cables that attach to the terminal studs on each power supply.
1. Ensure that the voltage across the DC power source cable leads is 0 V and that
there is no chance that the cable leads might become active during installation.
2. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 3400 Services Gateway Hardware Guide.
3. For each power supply:
a. Remove the clear plastic cover protecting the terminal studs on the faceplate.
b. Attach the positive (+) DC source power cable lug to the RTN (return)
terminal.
Figure 15: Connect DC Power Cables
g036010
c. Secure the cable lug to the terminal on the power supply, first with the square
washer, then with the screw. Apply between 23 lb-in. (2.6 Nm) and 25 lb-in.
(2.8 Nm) of torque.
Step 5: Connect the Ground and Power Cables ■17
Step 5: Connect the Ground and Power Cables

d. Attach the negative (–) DC source power cable lug to the –48V (input)
terminal.
e. Secure the cable lug to the terminal on the power supply, first with the square
washer, then with the screw. Apply between 23 lb-in. (2.6 Nm) and 25 lb-in.
(2.8 Nm) of torque.
f. Replace the clear plastic cover over the terminal studs on the faceplate.
4. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to an approved site ESD grounding point. See the instructions
for your site.
5. Connect each DC power cable to the appropriate external DC power source.
NOTE: For information about connecting to external DC power sources, see the
instructions for your site.
6. Switch on the external circuit breakers to provide voltage to the DC power source
cable leads.
7. If sufficient power is available and the DC power supply is correctly installed,
the power supply will power up automatically. If the DC power supply is installed
correctly and functioning normally, the PWR LED on the SFB lights steadily.
If the PWR LED indicates that the power supply is not functioning normally,
repeat the installation and cabling procedures.
Step 6: Perform the Initial Software Configuration
This procedure connects the device to the network but does not enable it to forward
traffic. For complete information about enabling the device to forward traffic, including
examples, see the appropriate JUNOS software configuration guides.
To configure the software:
1. If you have not already done so, press the POWER button on the Switch Fabric
Board (SFB) to start the device.
2. Log in as the root user. There is no password.
3. Start the CLI.
root# cli
root@>
4. Enter configuration mode.
configure
[edit]
root@#
18 ■Step 6: Perform the Initial Software Configuration
SRX 3400 Services Gateway Getting Started Guide

5. Set the root authentication password by entering a cleartext password, an
encrypted password, or an SSH public key string (DSA or RSA).
[edit]
root@# set system root-authentication plain-text-password
New password: password
Retype new password: password
6. Configure an administrator account on the device.
[edit]
root@# set system login user admin class super-user authentication
plain-text-password
7. Configure the password for the administrator account.
[edit]
root@# set system root-authentication plain-text-password
8. Commit the configuration to activate it on the device.
[edit]
root@# commit
9. Log in as the administrative user you configured in step 6.
10. Configure the name of the device. If the name includes spaces, enclose the name
in quotation marks (“”).
configure
[edit]
admin@# set system host-name host-name
11. Configure the IP address and prefix length for the device’s Ethernet interface.
[edit]
admin@# set interfaces fxp0 unit 0 family inet address address/prefix-length
12. Configure the traffic interface.
[edit]
admin@# set interfaces ge-0/0/0 unit 0 family inet address address/prefix-length
admin@# set interfaces ge-0/0/1 unit 0 family inet address address/prefix-length
13. Configure the default route.
[edit]
admin@# set routing-options static route 0.0.0.0/0 next-hop gateway
14. Configure basic security zones and bind them to traffic interfaces.
[edit]
admin@# set security zones security-zone trust interfaces ge-0/0/0
admin@# set security zones security-zone untrust interfaces ge-0/0/1
Step 6: Perform the Initial Software Configuration ■19
Step 6: Perform the Initial Software Configuration

15. Configure basic security policies.
[edit]
admin@# set security policies from-zone trust to-zone untrust policy policy-name
match source-address any destination-address any application any
root@# set security policies from-zone trust to-zone untrust policy policy-name
then permit
16. Check the configuration for validity.
[edit]
admin@# commit check
configuration check succeeds
17. Commit the configuration to activate it on the device.
[edit]
admin@# commit
commit complete
18. Optionally, display the configuration to verify that it is correct.
admin@# show
## Last changed: 2008-05-07 22:43:25 UTC
version "9.2I0 [builder]";
system {
autoinstallation;
host-name henbert;
root-authentication {
encrypted-password "$1$oTVn2KY3$uQe4xzQCxpR2j7sKuV.Pa0"; ##
SECRET-DATA
}
login {
user admin {
uid 928;
class super-user;
authentication {
encrypted-password "$1$cdOPmACd$QvreBsJkNR1EF0uurTBkE.";
## SECRET-DATA
}
}
}
services {
ssh;
web-management {
http {
interface ge-0/0/0.0;
}
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
20 ■Step 6: Perform the Initial Software Configuration
SRX 3400 Services Gateway Getting Started Guide