Juniper Srx345 Setup guide

The SRX345 Services Gateway consolidates security, routing, switching, and

WAN interfaces for midsize distributed enterprises. With advanced threat

mitigation capabilities, the services gateway provides cost-eective and secure

connectivity across distributed enterprises.

The SRX345 Services Gateway has a capacity of 5 gigabits per second (Gbps)

and is 1 rack unit (U) tall. The services gateway has eight 1-Gigabit Ethernet

RJ-45 ports, eight 1-Gigabit Ethernet SFP ports, one management port, 4 GB of

DRAM memory, 8 GB of ﬂash memory, and four Mini-Physical Interface Module

(Mini-PIM) slots.

The SRX345 Services Gateway is available with either a single AC power supply

or dual AC power supplies.

Package Contents

Verify that you have the following parts available:

•SRX345 Services Gateway (with either a single power supply or dual power

supplies)

•RJ-45 cable with DB-9 adapter

•Power cable for AC models only (1 for single power supply; 2 for dual power

supplies)

•Mounting brackets and screws

•USB cable

•Warranty and registration information

•End User License Agreement

•Safety Guide

•Quick Start Guide

How to Set Up Your SRX345 Services Gateway

Back Panel (Single AC Power Supply)

Back Panel (Dual AC Power Supplies)

Front Panel

Speciﬁcation Single AC Power Supply Dual AC Power Supplies

Dimensions (D x W x H) 14.57 in. x 17.36 in. x 1.72 in.

(37.01 cm x 44.09 cm x 4.37 cm)

18.70 in. x 17.36 in. x 1.72 in.

(47.49 cm x 44.09 cm x 4.37 cm

Chassis weight 10.80 lb (4.89 kg) 14.33 lb (6.50 kg)

Average power

consumption

122 W 122 W

Average heat dissipation 420 BTU/hour 420 BTU/hour

Relative humidity 5% to 90%, noncondensing 5% to 90%, noncondensing

g000954

1G SFP

ports

1G Ethernet

ports

USB

port

Mini-USB

Console port

Power

butto

LEDs

Reset Conﬁg

button

Serial Console

port

Management

port

Mini-PIM

slots

ESD

point

g009646

Power

supply inputsFansSSD slot

g00095

AC power inputSSD slot Fans

How to Set Up Your SRX345 Services Gateway 2

Factory-Default Settings

Security Policies

Source Zone Destination Zone Policy Action

trust untrust permit

trust trust permit

NAT Rules

Source Zone Destination Zone Policy Action

trust untrust Source NAT to untrust zone

interface

Interfaces

Port Label Interface Security Zone DHCP State IP Address

0/0 and 0/15 ge-0/0/0

and ge-0/0/15

untrust Client Dynamically

assigned

0/1 to 0/14 VLAN Interface

irb.0 (ge-0/0/1

to ge-0/0/14)

trust Server 192.168.2.1/24

MGMT fxp0 Server 192.168.1.1/24

cl-1/0/0

dl0 untrust ISP assigned*

* Only if the LTE Mini-PIM is present

Services

SSH

HTTPS

NETCONF over SSH

Protocols

RSTP (all interfaces)

Screens

Basic set of screens are enabled on the untrust zone

Device Startup Mode

Switching

Initial Conﬁguration Process

g04361

Install Device

in a Rack

Connect the

Grounding Cable

Power On

the Device

Verify the

Settings

Conﬁgure

Using ZTP/J-Web

Connect to

Management Device

Install the Device in a Rack

1. Position a mounting bracket on each side of the chassis. Use a Phillips (+)

screwdriver, number 2 to install the screws that secure the mounting brackets

to the chassis. Use either the front or center mount position.

g000966

2. Have one person grasp the sides of the device, lift it, and position it in the rack.

Align the bottom hole in each mounting bracket with a hole in each rack rail,

making sure that the chassis is level.

3. Have a second person install a mounting screw into each of the two aligned

holes. Use a number-2 Phillips screwdriver to tighten the mounting screws.

How to Set Up Your SRX345 Services Gateway 3

4. Install the second screw in each mounting bracket.

g000967

5. Verify that the mounting screws on one side of the rack are aligned with the

mounting screws on the opposite side and that the device is level.

Connect the Grounding Cable

1. Attach an ESD strap to an ESD point and place the other end of the strap

around your bare wrist.

2. Connect the grounding cable to a proper earth ground.

3. Place the grounding cable lug over the grounding point on the side of the

chassis.

NOTE: The device should be permanently connected to ground during

normal operation. A licensed electrician must attach a cable lug to the

grounding cable. A cable with an incorrectly attached lug can damage

the device.

g000957

4. Secure the grounding cable lug to the grounding point with the screws.

Power On the Device

NOTE: Before connecting the device to the power supply, attach an ESD

strap to an ESD point and place the other end of the strap around your

bare wrist.

1. Insert the appliance coupler end of the power cord into the appliance inlet on

the power supply faceplate.

g00095

How to Set Up Your SRX345 Services Gateway 4

2. Insert the power cord plug into an external AC power source receptacle.

3. Turn on the power to the AC power receptacle.

NOTE: If you are using a SRX345 Services Gateway with dual AC power

supplies, then repeat Step 1 through Step 3 for the second power supply.

4. Note the following LED indications. Wait until the STATUS LED is solid green

before proceeding to the next step.

g00095

LED State

ALARM •Solid amber (noncritical alarm).

•Solid red (critical alarm).

•O (no alarms).

STAT •Solid green (operating normally).

•Solid red (error detected).

PWR •Solid green (receiving power).

•Solid amber (power-o triggered).

•O (no power).

HA •Solid green (all HA links are available).

•Solid amber (some HA links are unavailable).

•Solid red (HA links are not functional).

•O (HA is disabled).

mPIM1 , mPIM2, mPIM3,

and mPIM4

•Solid green (Mini-PIM is functioning normally).

•Solid red (Mini-PIM hardware failure).

•O (Mini-PIM is not present or Mini-PIM is not detected

by the device).

Connect the Management Device

1. To conﬁgure the device using J-Web (recommended), connect the

management port MGMT to the Ethernet port on the management device,

using an RJ-45 cable.

g000

974

Management port

RJ-45 cable Ethernet port

2. The services gateway functions as a DHCP server and automatically assigns

an IP address to the management device. Ensure that the management

device acquires an IP address on the 192.168.1.0/24 network.

If an IP address is not assigned to the management device, manually

conﬁgure an IP address in the 192.168.1.0/24 network. Do not assign the

192.168.1.1 IP address to the management device, as this IP address is

assigned to the services gateway. By default, the DHCP server is enabled

on the fxp0 interface and L3 VLAN interface, irb.0 (interface ge-0/0/1 to

ge-0/0/14, which is conﬁgured with an IP address of 192.168.2.1/24).

Conﬁgure the Device Using ZTP with Juniper

Networks Network Service Controller

Zero Touch Provisioning (ZTP) enables you to complete the initial conﬁguration

of the SRX345 Services Gateway in your network automatically, with minimum

intervention.

Network Service Controller is a component of the Juniper Networks Contrail

Service Orchestration platform that simpliﬁes and automates the design and

implementation of custom network services that use an open framework.

How to Set Up Your SRX345 Services Gateway 5

For more information, refer to the Network Service Controller section

in the datasheet at http://www.juniper.net/assets/us/en/local/pdf/

datasheets/1000559-en.pdf.

To conﬁgure the device automatically using ZTP:

NOTE: To complete the ZTP process, ensure that the services gateway

is connected to the Internet.

1. Access the J-Web interface (https://192.168.1.1). The recommended browser

is Internet Explorer version 10 or 11, Mozilla Firefox version 40 (or later), or

Google Chrome 55 (or later).

2. If you already have the authentication code, enter the code in the webpage

displayed.

On successful authentication, the initial conﬁguration is applied and

committed on the services gateway. Optionally, the latest Junos OS image is

installed on the device before the initial conﬁguration is applied.

If you do not have the authentication code, you can use the J-Web setup

wizard to conﬁgure the services gateway. Click Skip to J-Web and follow the

procedure in the “Conﬁgure the Device Using J-Web” section.

Conﬁgure the Device Using J-Web

To conﬁgure the device using J-Web, follow the steps in this section.

1. Enter the root authentication password.

2. Select one of the following setup modes:

•Guided Setup (uses a dynamic IP address)—Allows you to set up the

device in a custom security conﬁguration. You can select either the Basic or

the Expert option.

•Default Setup (uses a dynamic IP address)—Allows you to quickly set up

the device with the default conﬁguration. Any additional conﬁguration can

be done after the wizard setup is completed.

•High Availability—Allows you to set up a chassis cluster with a default basic

conﬁguration.

NOTE: The initial conﬁguration requires that you specify the device

name and root password. You can skip all the other steps and go directly

to the Conﬁrm & Apply page to apply the conﬁguration.

How to Set Up Your SRX345 Services Gateway 6

Conﬁgure the Device Using the Guided Setup Mode

1. Connect port 0/0 or 0/15 to the ISP device to obtain a dynamic IP address.

2. Select the expertise level as Basic or Expert.

The following table compares the Basic and Expert levels:

Options Basic Expert

Number of internal zones allowed 3 ≥ 3

Internet zone conﬁguration options •Static IP

•Dynamic IP

•Static IP

•Static pool

•Dynamic IP

Internal zone service conﬁguration Allowed Allowed

Internal destination NAT

conﬁguration

Not allowed Allowed

3. Conﬁgure the basic settings:

a. Device name

b. Password for the root account (Use the password that you entered in

Step 1 of the “Conﬁgure the Device Using J-Web” section.)

c. Management interface

d. Time

4. Conﬁgure the security topology:

a. Internet zone (Untrust)

b. Internal zones (Trust)

c. DMZ

5. Conﬁgure the security policy:

a. Licenses (Security services)

b. DMZ policy

c. Internet and internal policies

d. Remote VPN

6. Conﬁgure Network Address Translation:

a. Internal Source NAT

b. Internal Destination NAT

c. DMZ Destination NAT

How to Set Up Your SRX345 Services Gateway 7

7. Review the settings and click Apply Settings.

NOTE: Check the connectivity from the management device to the

SRX Series device. You might lose connectivity to the SRX Series device

if you have changed the management interface IP. Click the URL for

reconnection instructions on the Conﬁrm & Apply page to reconnect,

if required.

8. Click Done to complete the setup.

Conﬁgure the Device Using the Default Setup Mode

1. Connect port 0/0 or 0/15 to the ISP device to obtain a dynamic IP address.

2. Conﬁgure the basic settings – device name, root account information,

management interface, and system time.

3. Conﬁgure the security policy – licenses.

4. Review the settings.

5. Click Apply Settings. Click Done to complete the setup.

NOTE: Check the connectivity from the management device to the

SRX Series device. You might lose connectivity to the SRX Series device

if you have changed the management interface IP. Click the URL for

reconnection instructions on the Conﬁrm & Apply page to reconnect, if

required.

You can also conﬁgure the services gateway using the CLI, by connecting to the

Console port or the management port. For details, see the SRX345 Services

Gateway Hardware Guide.

How to Set Up Your SRX345 Services Gateway 8

Verify the Settings

Access http://www.juniper.net to ensure that you are connected to the Internet.

This connectivity ensures that you can pass trac through the services gateway.

If the page does not load, perform the following checks to see if you can identify

the problem:

•Verify your conﬁguration settings, and ensure that you have applied the

conﬁguration.

•Check if the ISP-supplied device connecting your SRX Series device to the

Internet is turned on and working properly. Try turning it o and on again.

After you complete these steps, the SRX Series device can pass trac from any

trust port to the untrust port.

NOTE: With this step, you have successfully completed the initial

conﬁguration, and your SRX345 Services Gateway is ready for use.

Change the Conﬁguration Settings (Optional)

After you complete the initial setup conﬁguration, you can access the J-Web

setup wizard by clicking Conﬁgure > Device Setup > Set Up. You can either

edit the existing settings or create a new conﬁguration. If you choose to create

a new conﬁguration, then all the current conﬁguration in the services gateway

will be deleted.

Power O the Device

You can power o the device in one of the following ways:

• Graceful shutdown—Press and immediately release the Power button.

• Forced shutdown—Press the Power button, and hold it for 10 seconds.

After powering o a power supply, wait at least 60 seconds before turning it

back on.

How to Set Up Your SRX345 Services Gateway 9

Reset the Conﬁguration

Use the RESET CONFIG button to restore the device to the factory-default

conﬁguration or to a rescue conﬁguration. To press the RESET CONFIG button,

insert a small probe (such as a straightened paper clip) into the pinhole on the

front panel.

Pressing and quickly releasing the RESET CONFIG button loads and commits

the rescue conﬁguration. The rescue conﬁguration is a previously committed,

valid conﬁguration set through J-Web or the CLI. The STATUS LED is solid amber

during this time.

Pressing and holding the RESET CONFIG button for 15 seconds or more,

until the STATUS LED is solid amber, deletes all conﬁgurations (backup

conﬁgurations and rescue conﬁguration), and loads and commits the factory

conﬁguration.

NOTE: After resetting the device, check the device status by viewing the

LEDs on the front panel. For information on the LED states, see the Power

On the Device section.

Next Steps

For information on conﬁguring features on your services gateway, refer to the

following:

•Junos OS Documentation/Feature Conﬁguration

http://www.juniper.net/techpubs/en_US/release-independent/junos/

information-products/pathway-pages/srx-series/product/index.html

•Getting Started Knowledge Base Article

https://kb.juniper.net/InfoCenter/index?page=content&id=KB15694

Reference

Technical Support

http://www.juniper.net/support/requesting-support.html

SRX345 Services Gateway Hardware Guide

http://www.juniper.net/techpubs/en_US/release-independent/junos/

information-products/pathway-pages/hardware/srx345/index.html

Supported Transceivers

https://pathﬁnder.juniper.net/hct/product/#prd=SRX345

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper

Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks