Juniper SRX345 Setup guide

1
The SRX345 Services Gateway consolidates security, routing, switching, and
WAN interfaces for midsize distributed enterprises. With advanced threat
mitigation capabilities, the services gateway provides cost-eective and secure
connectivity across distributed enterprises.
The SRX345 Services Gateway has a capacity of 5 gigabits per second (Gbps)
and is 1 rack unit (U) tall. The services gateway has eight 1-Gigabit Ethernet
RJ-45 ports, eight 1-Gigabit Ethernet SFP ports, one management port, 4 GB of
DRAM memory, 8 GB of flash memory, and four Mini-Physical Interface Module
(Mini-PIM) slots.
The SRX345 Services Gateway is available with either a single AC power supply
or dual AC power supplies.
Package Contents
Verify that you have the following parts available:
•SRX345 Services Gateway (with either a single power supply or dual power
supplies)
•RJ-45 cable with DB-9 adapter
•Power cable for AC models only (1 for single power supply; 2 for dual power
supplies)
•Mounting brackets and screws
•USB cable
•Warranty and registration information
•End User License Agreement
•Safety Guide
•Quick Start Guide
How to Set Up Your SRX345 Services Gateway
Back Panel (Single AC Power Supply)
Back Panel (Dual AC Power Supplies)
Front Panel
Specification Single AC Power Supply Dual AC Power Supplies
Dimensions (D x W x H) 14.57 in. x 17.36 in. x 1.72 in.
(37.01 cm x 44.09 cm x 4.37 cm)
18.70 in. x 17.36 in. x 1.72 in.
(47.49 cm x 44.09 cm x 4.37 cm
Chassis weight 10.80 lb (4.89 kg) 14.33 lb (6.50 kg)
Average power
consumption
122 W 122 W
Average heat dissipation 420 BTU/hour 420 BTU/hour
Relative humidity 5% to 90%, noncondensing 5% to 90%, noncondensing
g000954
1G SFP
ports
1G Ethernet
ports
USB
port
Mini-USB
Console port
Power
butto
n
LEDs
Reset Config
button
Serial Console
port
Management
port
Mini-PIM
slots
ESD
point
g009646
Power
supply inputsFansSSD slot
g00095
5
AC power inputSSD slot Fans

How to Set Up Your SRX345 Services Gateway 2
Factory-Default Settings
Security Policies
Source Zone Destination Zone Policy Action
trust untrust permit
trust trust permit
NAT Rules
Source Zone Destination Zone Policy Action
trust untrust Source NAT to untrust zone
interface
Interfaces
Port Label Interface Security Zone DHCP State IP Address
0/0 and 0/15 ge-0/0/0
and ge-0/0/15
untrust Client Dynamically
assigned
0/1 to 0/14 VLAN Interface
irb.0 (ge-0/0/1
to ge-0/0/14)
trust Server 192.168.2.1/24
MGMT fxp0 Server 192.168.1.1/24
cl-1/0/0
dl0 untrust ISP assigned*
* Only if the LTE Mini-PIM is present
Services
Services
SSH
HTTPS
NETCONF over SSH
Protocols
Protocols
RSTP (all interfaces)
Screens
Screens
Basic set of screens are enabled on the untrust zone
Device Startup Mode
Device Startup Mode
Switching
Initial Configuration Process
g04361
6
Install Device
in a Rack
Connect the
Grounding Cable
Power On
the Device
Verify the
Settings
Configure
Using ZTP/J-Web
Connect to
Management Device
Install the Device in a Rack
1. Position a mounting bracket on each side of the chassis. Use a Phillips (+)
screwdriver, number 2 to install the screws that secure the mounting brackets
to the chassis. Use either the front or center mount position.
g000966
2. Have one person grasp the sides of the device, lift it, and position it in the rack.
Align the bottom hole in each mounting bracket with a hole in each rack rail,
making sure that the chassis is level.
3. Have a second person install a mounting screw into each of the two aligned
holes. Use a number-2 Phillips screwdriver to tighten the mounting screws.

How to Set Up Your SRX345 Services Gateway 3
4. Install the second screw in each mounting bracket.
g000967
5. Verify that the mounting screws on one side of the rack are aligned with the
mounting screws on the opposite side and that the device is level.
Connect the Grounding Cable
1. Attach an ESD strap to an ESD point and place the other end of the strap
around your bare wrist.
2. Connect the grounding cable to a proper earth ground.
3. Place the grounding cable lug over the grounding point on the side of the
chassis.
NOTE: The device should be permanently connected to ground during
normal operation. A licensed electrician must attach a cable lug to the
grounding cable. A cable with an incorrectly attached lug can damage
the device.
g000957
4. Secure the grounding cable lug to the grounding point with the screws.
Power On the Device
NOTE: Before connecting the device to the power supply, attach an ESD
strap to an ESD point and place the other end of the strap around your
bare wrist.
1. Insert the appliance coupler end of the power cord into the appliance inlet on
the power supply faceplate.
g00095
8

How to Set Up Your SRX345 Services Gateway 4
2. Insert the power cord plug into an external AC power source receptacle.
3. Turn on the power to the AC power receptacle.
NOTE: If you are using a SRX345 Services Gateway with dual AC power
supplies, then repeat Step 1 through Step 3 for the second power supply.
4. Note the following LED indications. Wait until the STATUS LED is solid green
before proceeding to the next step.
g00095
6
LED State
ALARM •Solid amber (noncritical alarm).
•Solid red (critical alarm).
•O (no alarms).
STAT •Solid green (operating normally).
•Solid red (error detected).
PWR •Solid green (receiving power).
•Solid amber (power-o triggered).
•O (no power).
HA •Solid green (all HA links are available).
•Solid amber (some HA links are unavailable).
•Solid red (HA links are not functional).
•O (HA is disabled).
mPIM1 , mPIM2, mPIM3,
and mPIM4
•Solid green (Mini-PIM is functioning normally).
•Solid red (Mini-PIM hardware failure).
•O (Mini-PIM is not present or Mini-PIM is not detected
by the device).
Connect the Management Device
1. To configure the device using J-Web (recommended), connect the
management port MGMT to the Ethernet port on the management device,
using an RJ-45 cable.
g000
974
Management port
RJ-45 cable Ethernet port
2. The services gateway functions as a DHCP server and automatically assigns
an IP address to the management device. Ensure that the management
device acquires an IP address on the 192.168.1.0/24 network.
If an IP address is not assigned to the management device, manually
configure an IP address in the 192.168.1.0/24 network. Do not assign the
192.168.1.1 IP address to the management device, as this IP address is
assigned to the services gateway. By default, the DHCP server is enabled
on the fxp0 interface and L3 VLAN interface, irb.0 (interface ge-0/0/1 to
ge-0/0/14, which is configured with an IP address of 192.168.2.1/24).
Configure the Device Using ZTP with Juniper
Networks Network Service Controller
Zero Touch Provisioning (ZTP) enables you to complete the initial configuration
of the SRX345 Services Gateway in your network automatically, with minimum
intervention.
Network Service Controller is a component of the Juniper Networks Contrail
Service Orchestration platform that simplifies and automates the design and
implementation of custom network services that use an open framework.

How to Set Up Your SRX345 Services Gateway 5
For more information, refer to the Network Service Controller section
in the datasheet at http://www.juniper.net/assets/us/en/local/pdf/
datasheets/1000559-en.pdf.
To configure the device automatically using ZTP:
NOTE: To complete the ZTP process, ensure that the services gateway
is connected to the Internet.
1. Access the J-Web interface (https://192.168.1.1). The recommended browser
is Internet Explorer version 10 or 11, Mozilla Firefox version 40 (or later), or
Google Chrome 55 (or later).
2. If you already have the authentication code, enter the code in the webpage
displayed.
On successful authentication, the initial configuration is applied and
committed on the services gateway. Optionally, the latest Junos OS image is
installed on the device before the initial configuration is applied.
If you do not have the authentication code, you can use the J-Web setup
wizard to configure the services gateway. Click Skip to J-Web and follow the
procedure in the “Configure the Device Using J-Web” section.
Configure the Device Using J-Web
To configure the device using J-Web, follow the steps in this section.
1. Enter the root authentication password.
2. Select one of the following setup modes:
•Guided Setup (uses a dynamic IP address)—Allows you to set up the
device in a custom security configuration. You can select either the Basic or
the Expert option.
•Default Setup (uses a dynamic IP address)—Allows you to quickly set up
the device with the default configuration. Any additional configuration can
be done after the wizard setup is completed.
•High Availability—Allows you to set up a chassis cluster with a default basic
configuration.
NOTE: The initial configuration requires that you specify the device
name and root password. You can skip all the other steps and go directly
to the Confirm & Apply page to apply the configuration.

How to Set Up Your SRX345 Services Gateway 6
Configure the Device Using the Guided Setup Mode
1. Connect port 0/0 or 0/15 to the ISP device to obtain a dynamic IP address.
2. Select the expertise level as Basic or Expert.
The following table compares the Basic and Expert levels:
Options Basic Expert
Number of internal zones allowed 3 ≥ 3
Internet zone configuration options •Static IP
•Dynamic IP
•Static IP
•Static pool
•Dynamic IP
Internal zone service configuration Allowed Allowed
Internal destination NAT
configuration
Not allowed Allowed
3. Configure the basic settings:
a. Device name
b. Password for the root account (Use the password that you entered in
Step 1 of the “Configure the Device Using J-Web” section.)
c. Management interface
d. Time
4. Configure the security topology:
a. Internet zone (Untrust)
b. Internal zones (Trust)
c. DMZ
5. Configure the security policy:
a. Licenses (Security services)
b. DMZ policy
c. Internet and internal policies
d. Remote VPN
6. Configure Network Address Translation:
a. Internal Source NAT
b. Internal Destination NAT
c. DMZ Destination NAT

How to Set Up Your SRX345 Services Gateway 7
7. Review the settings and click Apply Settings.
NOTE: Check the connectivity from the management device to the
SRX Series device. You might lose connectivity to the SRX Series device
if you have changed the management interface IP. Click the URL for
reconnection instructions on the Confirm & Apply page to reconnect,
if required.
8. Click Done to complete the setup.
Configure the Device Using the Default Setup Mode
1. Connect port 0/0 or 0/15 to the ISP device to obtain a dynamic IP address.
2. Configure the basic settings – device name, root account information,
management interface, and system time.
3. Configure the security policy – licenses.
4. Review the settings.
5. Click Apply Settings. Click Done to complete the setup.
NOTE: Check the connectivity from the management device to the
SRX Series device. You might lose connectivity to the SRX Series device
if you have changed the management interface IP. Click the URL for
reconnection instructions on the Confirm & Apply page to reconnect, if
required.
You can also configure the services gateway using the CLI, by connecting to the
Console port or the management port. For details, see the SRX345 Services
Gateway Hardware Guide.

How to Set Up Your SRX345 Services Gateway 8
Verify the Settings
Access http://www.juniper.net to ensure that you are connected to the Internet.
This connectivity ensures that you can pass trac through the services gateway.
If the page does not load, perform the following checks to see if you can identify
the problem:
•Verify your configuration settings, and ensure that you have applied the
configuration.
•Check if the ISP-supplied device connecting your SRX Series device to the
Internet is turned on and working properly. Try turning it o and on again.
After you complete these steps, the SRX Series device can pass trac from any
trust port to the untrust port.
NOTE: With this step, you have successfully completed the initial
configuration, and your SRX345 Services Gateway is ready for use.
Change the Configuration Settings (Optional)
After you complete the initial setup configuration, you can access the J-Web
setup wizard by clicking Configure > Device Setup > Set Up. You can either
edit the existing settings or create a new configuration. If you choose to create
a new configuration, then all the current configuration in the services gateway
will be deleted.
Power O the Device
You can power o the device in one of the following ways:
• Graceful shutdown—Press and immediately release the Power button.
• Forced shutdown—Press the Power button, and hold it for 10 seconds.
After powering o a power supply, wait at least 60 seconds before turning it
back on.

How to Set Up Your SRX345 Services Gateway 9
Reset the Configuration
Use the RESET CONFIG button to restore the device to the factory-default
configuration or to a rescue configuration. To press the RESET CONFIG button,
insert a small probe (such as a straightened paper clip) into the pinhole on the
front panel.
Pressing and quickly releasing the RESET CONFIG button loads and commits
the rescue configuration. The rescue configuration is a previously committed,
valid configuration set through J-Web or the CLI. The STATUS LED is solid amber
during this time.
Pressing and holding the RESET CONFIG button for 15 seconds or more,
until the STATUS LED is solid amber, deletes all configurations (backup
configurations and rescue configuration), and loads and commits the factory
configuration.
NOTE: After resetting the device, check the device status by viewing the
LEDs on the front panel. For information on the LED states, see the Power
On the Device section.
Next Steps
For information on configuring features on your services gateway, refer to the
following:
•Junos OS Documentation/Feature Configuration
http://www.juniper.net/techpubs/en_US/release-independent/junos/
information-products/pathway-pages/srx-series/product/index.html
•Getting Started Knowledge Base Article
https://kb.juniper.net/InfoCenter/index?page=content&id=KB15694
Reference
Technical Support
http://www.juniper.net/support/requesting-support.html
SRX345 Services Gateway Hardware Guide
http://www.juniper.net/techpubs/en_US/release-independent/junos/
information-products/pathway-pages/hardware/srx345/index.html
Supported Transceivers
https://pathfinder.juniper.net/hct/product/#prd=SRX345

Copyright © 2017, Juniper Networks, Inc. All rights reserved.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper
Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks
reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Part Number: 530-079801 Rev. 01, September 2017.