Juniper SRX3600 User manual

SRX3600 Services Gateway Getting
Started Guide
January 2011
Part Number: 530-038205
Revision 01
Contents AboutThisGuide....................................................3
Step 1: Prepare the Site for SRX3600 Services Gateway Installation . . . . . . . . . . . 5
RackMountingRequirements......................................5
Tools Required to Unpack and Prepare the SRX3600 Services Gateway for
Installation ..................................................5
Step 2: Install the Mounting Hardware in a Four-Post Rack or Cabinet or an
Open-FrameRack................................................6
Step3:InstalltheServicesGateway.....................................7
Install the Services Gateway Using a Mechanical Lift . . . . . . . . . . . . . . . . . . . . 8
Install the Device Without Using a Mechanical Lift . . . . . . . . . . . . . . . . . . . . . 10
Remove Components ........................................10
LifttheChassisintotheRack...................................12
ReinstallComponents........................................13
Step4:ConnecttheGroundingCable...................................13
Step 5: Connect the External Devices and IOC Cables . . . . . . . . . . . . . . . . . . . . . . 14
Connect to a Network for Out-of-Band Management . . . . . . . . . . . . . . . . . . . 14
ConnectaManagementConsole...................................15
ConnecttheIOCCables..........................................16
Step6:ConnectPowerCables.........................................16
Connect Power to an AC-Powered Services Gateway . . . . . . . . . . . . . . . . . . . 17
Connect Power to a DC-Powered Services Gateway . . . . . . . . . . . . . . . . . . . . 18
Step 7: Perform the Initial Software Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 20
EnterConfigurationMode........................................20
Configure User Accounts and Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
ConfigureSystemAttributes.......................................21
CommittheConfiguration........................................22
SafetyWarnings....................................................24
SRX3600 Services Gateway Compliance Statements for EMC Requirements . . 26
Canada .......................................................26
EuropeanCommunity............................................26
1Copyright © 2011, Juniper Networks, Inc.

Japan.........................................................26
UnitedStates...................................................27
SRX3600 Services Gateway NEBS and ETSI Compliance . . . . . . . . . . . . . . . . . . . 27
SRX3600 Services Gateway NEBS and ETSI Standards . . . . . . . . . . . . . . . . . 27
SRX3600 Services Gateway NEBS and ETSI Configuration
Requirements...............................................27
SRX Series Documentation and Release Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
RequestingTechnicalSupport........................................29
RevisionHistory....................................................30
Copyright © 2011, Juniper Networks, Inc.2
SRX3600 Services Gateway Getting Started Guide

About This Guide
This guide contains information that you need to install and configure the SRX3600
Services Gateway quickly. For complete installation instructions and instructions on
installing additional modules such as cards and power supplies, see the SRX3600 Services
Gateway Hardware Guide at http://www.juniper.net/techpubs/ .
WARNING: This guide contains a summary of safety warnings in “Safety
Warnings” on page 24. For a complete list of warnings for this device, including
translations, see the SRX3600 Services Gateway Hardware Guide at
http://www.juniper.net/techpubs/ .
The SRX3600 Services Gateway is a high-performance, scalable, carrier-class security
device with multiprocessor architecture. The services gateway has a capacity of up to
30 gigabits per second (Gbps), full duplex. The services gateway is 5 rack units (U) tall.
Nine services gateways can be stacked in a single floor-to-ceiling rack, for increased port
density per unit of floor space. The services gateway provides 12 Common Form-factor
Module (CFM) slots that can be populated with up to seven Services Processing Cards
(SPCs), up to three Network Processing Cards (NPCs), and up to six I/O cards (IOCs).
The services gateway also has one dedicated slot for the Switch Fabric Board (SFB), one
slots for a Routing Engine, one slot for an SRX Clustering Module (SCM), four slots for
power supplies, and one slot for the fan tray and air filter.
Figure 1 on page 3 and Figure 2 on page 4 show the front and rear of the SRX3600
Services Gateway.
Figure 1: Front View of the SRX3600 Services Gateway
g036035
Cooling
air exhaust
ESD
point
IOC in
slot 1
Slot
number
guide
CFM slots
for IOCs
and SPCs
SFB
USB
ports
Console
port
Management
Ethernet port
3Copyright © 2011, Juniper Networks, Inc.
About This Guide

Figure 2: Rear View of the SRX3600 Services Gateway
g036105
ESD
point
Chassis
grounding
point
Fan tray
door
CFM
slots for
SPCs
Cooling
air inlets
Routing Engine
in slot RE0
Power
supplies
Slot
number
guide
CFM slots
for NPCs
and SPCs
Slot RE1
for SCM
By installing different combinations of IOCs and SPCs, you can tailor both the number
of network ports and the maximum security processing capacity to suit your network.
Table 1 on page 4 describes the minimum system configuration for the SRX3600 Services
Gateway.
Table 1: Minimum System Configuration
MinimumComponent
1SFB
1SPC
1NPC
1Routing Engine
2Power supply
1Fan tray
Three types of IOC interface cards are available:
•16-port copper Ethernet/Fast Ethernet/Gigabit Ethernet (10/100/1000 Mbps) card
•16-port small form-factor pluggable (SFP) Gigabit Ethernet card
•2-port 10-gigabit small form-factor pluggable (XFP) Ethernet card
You can install any combination of IOC types in the services gateway.
Copyright © 2011, Juniper Networks, Inc.4
SRX3600 Services Gateway Getting Started Guide

The services gateway is shipped in a cardboard carton. A printed copy of this document
and an accessory box are also included in the shipping container.
Step 1: Prepare the Site for SRX3600 Services Gateway Installation
•Rack Mounting Requirements on page 5
•Tools Required to Unpack and Prepare the SRX3600 Services Gateway for
Installation on page 5
Rack Mounting Requirements
•You can install the services gateway in a four-post rack or cabinet or a two-post rack.
WARNING: When you install the services gateway in a two-post rack, you
must attach the mounting brackets at the middle of each chassis side, as
shown in Figure 3 on page 6. Do not attempt to install the services gateway
in a two-post rack with the mounting brackets attached at the front of the
chassis. Such an installation might overstress either the brackets or the
rack, causing the chassis to fall and inflict injury.
•The rack rails must be spaced widely enough to accommodate the external dimensions
of the services gateway chassis: 8.75 in. (22.2 cm) high, 25.5 in. (64.8 cm) deep, and
17.5 in. (44.5 cm) wide. The outer edges of the mounting brackets extend the width to
19 in. (48.3 cm).
•The rack must be strong enough to support the weight of the fully configured services
gateway, up to 116 lb (52.6 kg). If you stack five fully configured services gateways in
one rack, it must be capable of supporting about 579 lb (263 kg).
•For service personnel to remove and install hardware components, there must be
adequate space at the front and back of the services gateway. Allow at least
30 in. (76.2 cm) in front of the services gateway and 24 in. (61 cm) behind the services
gateway.
•The rack or cabinet must have an adequate supply of cooling air.
•Ensure that the cabinet allows the chassis hot exhaust air to exit the cabinet without
recirculating into the services gateway.
•The services gateway must be installed in a rack that is secured to the building structure.
•The services gateway should be mounted at the bottom of the rack if it is the only unit
in the rack.
•When mounting the services gateway in a partially filled rack, load the rack from the
bottom to the top, with the heaviest component at the bottom of the rack.
Tools Required to Unpack and Prepare the SRX3600 Services Gateway for Installation
To unpack the services gateway and prepare for installation, you need the following
tools:
5Copyright © 2011, Juniper Networks, Inc.
Step 1: Prepare the Site for SRX3600 Services Gateway Installation

•A mechanical lift—recommended
•Phillips screwdrivers, numbers 1 and 2
•Electrostatic discharge (ESD) wrist strap
•Antistatic mat
Proceed to “Step 2: Install the Mounting Hardware in a Four-Post Rack or Cabinet or an
Open-Frame Rack” on page 6.
Step 2: Install the Mounting Hardware in a Four-Post Rack or Cabinet or an Open-Frame
Rack
The specific mounting hardware required depends on the type of rack being used. Use
the appropriate procedure steps to install the mounting hardware for your type of rack.
To install the mounting hardware:
1. Locate the rack mount brackets in the accessory kit.
2. Use the screws provided to secure the rack mount brackets to the sides of the chassis:
•For a two-post rack, mount the brackets at the mid-mount holes, as shown in Figure
3 on page 6.
•For a four-post rack, mount the brackets near the front edge of the chassis, as shown
in Figure 4 on page 7.
Figure 3: Attaching Mounting Hardware for Two-Post Rack
g036042
Copyright © 2011, Juniper Networks, Inc.6
SRX3600 Services Gateway Getting Started Guide

Figure 4: Attaching Mounting Hardware for Cabinet or Four-Post Rack
g036093
3. For installation in a four-post rack or a cabinet, install the support shelf on the rear
posts as shown in Figure 5 on page 7.
Figure 5: Attaching Four-Post and Cabinet Support Shelf
Rear rack uprights
g036094
Step 3: Install the Services Gateway
Because of the services gateway’s size and weight, we recommend that you install the
services gateway using a mechanical lift. The procedure for installing the services gateway
depends on whether you use a mechanical lift:
•Install the Services Gateway Using a Mechanical Lift on page 8
•Install the Device Without Using a Mechanical Lift on page 10
7Copyright © 2011, Juniper Networks, Inc.
Step 3: Install the Services Gateway

Install the Services Gateway Using a Mechanical Lift
1. Ensure that the rack is in its permanent location and is secured to the building. Ensure
that the installation site allows adequate clearance for both airflow and maintenance.
For details, see the SRX3600 Services Gateway Hardware Guide.
2. Load the services gateway onto the lift, making sure it rests securely on the lift platform
(see Figure 6 on page 8).
Figure 6: Load the Device onto the Lift
g030262
3. Using the lift, position the device in the rack:
•For two-post rack mounting, align the bottom hole in each mounting bracket with
a hole in each rack rail.
•For four-post rack or cabinet mounting, position the device so that the bottom rear
edge of the chassis rests on the support shelf that you installed earlier, as shown
in Figure 5 on page 7.
4. Install a mounting screw into each of the two aligned holes, as shown in Figure 7 on
page 9 (two-post rack) or Figure 8 on page 9 (four-post rack). Use a number-2
Phillips screwdriver to tighten the screws.
Copyright © 2011, Juniper Networks, Inc.8
SRX3600 Services Gateway Getting Started Guide

Figure 7: Installing the Device in a Two-Post Rack
g036043
Figure 8: Installing the Device in a Four-Post Rack
g036096
5. Install the remaining screws in each mounting bracket.
6. Move the lift away from the rack.
7. Visually inspect the alignment of the services gateway. If the services gateway is
installed properly in the rack, all the mounting screws on one side of the rack should
be aligned with the mounting screws on the opposite side, and the services gateway
should be level.
Proceed to “Step 4: Connect the Grounding Cable” on page 13.
9Copyright © 2011, Juniper Networks, Inc.
Install the Services Gateway Using a Mechanical Lift

Install the Device Without Using a Mechanical Lift
To install the services gateway without a mechanical lift:
•Remove Components on page 10
•Lift the Chassis into the Rack on page 12
•Reinstall Components on page 13
Remove Components
To make the services gateway light enough to install manually, you first remove most of
the components from the chassis, as shown in Figure 9 on page 10 and Figure 10 on
page 11:
•Power supplies
•Switch Fabric Board (SFB)
•Routing Engine
•I/O Cards (IOCs)
•Network Processing Cards (NPCs)
•Services Processing Cards (SPCs)
•Fan tray
Figure 9: Components to Remove from the Front of the Services Gateway
g030265
SFB
Cards in
CFM slots
Copyright © 2011, Juniper Networks, Inc.10
SRX3600 Services Gateway Getting Started Guide

Figure 10: Components to Remove from the Rear of the Services Gateway
g030266
Fan tray
(behind door)
Routing
Engine
Power
supplies
Cards in
CFM slots
NOTE: The procedure in this section for removing components from the
chassis is for initial installation only and assumes that you have not connected
power cables to the services gateway.
To remove the components from the services gateway:
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist, and connect
the strap to one of the ESD points on the chassis. For more information about ESD,
see the SRX3600 Services Gateway Hardware Guide.
2. Release each component by loosening its retaining screws and unlatching its ejector
handles as appropriate. For full instructions on removing services gateway components,
see the SRX3600 Services Gateway Hardware Guide.
3. Slide each component out of the chassis evenly so that it does not become stuck or
damaged.
4. Label each component as you remove it so that you can reinstall it in the correct
location.
5. Immediately store each removed component in an antistatic bag.
6. Do not stack removed components. Set each one on a flat surface.
NOTE: For complete instructions on removing services gateway components,
see “Installing the Services Gateway Without a Mechanical Lift” in the
SRX3600 Services Gateway Hardware Guide.
11Copyright © 2011, Juniper Networks, Inc.
Remove Components

Lift the Chassis into the Rack
Lifting the chassis and mounting it in a rack requires two people. The empty chassis
weighs approximately 43.6 lb (19.8 kg).
1. Ensure that the rack is in its permanent location and is secured to the building.
2. Position the chassis in front of the rack or cabinet. Use a pallet jack if one is available.
3. With one person on each side, lift the chassis into position in the rack:
•For two-post rack mounting, align the bottom hole in each mounting bracket with
a hole in each rack rail.
•For four-post rack or cabinet mounting, position the device so that the bottom rear
edge of the chassis rests on the support shelf that you installed earlier, as shown
in Figure 5 on page 7.
WARNING: Do not attempt to lift the chassis by the handles on the power
supplies or on the Common Form-factor Modules (CFMs). The handles
may break off causing the chassis to fall and inflict injury.
Figure 11: Lift the Chassis into the Rack
g030260
4. Use the screws to attach the left and right brackets to the rack.
5. Visually inspect the alignment of the chassis. If the chassis is installed properly in the
rack, all the mounting screws on one side of the rack should be aligned with the
mounting screws on the opposite side, and the chassis should be level.
Copyright © 2011, Juniper Networks, Inc.12
SRX3600 Services Gateway Getting Started Guide

Reinstall Components
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist, and connect
the strap to one of the ESD points on the chassis. For more information about ESD,
see the SRX3600 Services Gateway Hardware Guide.
2. Slide each component into the chassis evenly so that it does not become stuck or
damaged.
4. Tighten the captive screws or lock any levers for each component installed.
NOTE: Make sure that all empty slots are covered with blank panels before
operating the services gateway.
Proceed to “Step 4: Connect the Grounding Cable” on page 13.
Step 4: Connect the Grounding Cable
1. Verify that a licensed electrician has attached the cable lug, provided with the services
gateway, to the grounding cable.
2. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and connect
the strap to an approved site ESD grounding point. See the instructions for your site.
3. Ensure that all grounding surfaces are clean and brought to a bright finish before
making grounding connections.
4. Connect the grounding cable to a proper earth ground.
5. Disconnect the ESD grounding strap from the site ESD grounding point.
6. Connect the ESD grounding strap to one of the ESD points on the chassis. For more
information about ESD, see the SRX3600 Services Gateway Hardware Guide.
7. Place the grounding cable lug over the grounding point. The grounding point is sized
for M5 screws. See Figure 12 on page 14.
13Copyright © 2011, Juniper Networks, Inc.
Reinstall Components

Figure 12: Connecting the Grounding Cable
g036092
8. Secure the grounding cable lug to the chassis, first with the washers, and then with
the screws.
9. Dress the grounding cable and verify that it does not touch or block access to services
gateway components, and that it does not drape where people could trip on it.
Proceed to “Step 5: Connect the External Devices and IOC Cables” on page 14.
Step 5: Connect the External Devices and IOC Cables
To connect external devices and I/O Card (IOC) cables:
•Connect to a Network for Out-of-Band Management on page 14
•Connect a Management Console on page 15
•Connect the IOC Cables on page 16
Connect to a Network for Out-of-Band Management
1. Plug one end of the RJ-45 Ethernet cable into the RE ETHERNET 0 port on the Switch
Fabric Board (SFB) as shown in Figure 13 on page 15.
Copyright © 2011, Juniper Networks, Inc.14
SRX3600 Services Gateway Getting Started Guide

Figure 13: Connect Out-of-Band Management Network
g036112
2. Plug the other end of the cable into the network device.
Connect a Management Console
1. Plug the RJ-45 end of the serial cable into the RE CONSOLE 0 port on the SFB as shown
in Figure 14 on page 15.
Figure 14: Connect Management Console Cable
g036046
RE CONSOLE
0
1
SCB FRONT0PWR
HAREAR 1FAN
ALARM
2. Plug the female DB-9 end into the device’s serial port.
15Copyright © 2011, Juniper Networks, Inc.
Connect a Management Console

Connect the IOC Cables
1. Have ready a length of the type of cable used by the IOC. For cable specifications, see
the SRX3600 Services Gateway Hardware Guide.
2. If the cable connector port is covered by a rubber safety plug, remove the plug.
WARNING: Do not look directly into a fiber-optic transceiver or into the
ends of fiber-optic cables. Fiber-optic transceivers and fiber-optic cable
connected to a transceiver emit laser light that can damage your eyes.
CAUTION: Do not leave a fiber-optic transceiver uncovered except when
inserting or removing cable. The safety cap keeps the port clean and
prevents accidental exposure to laser light.
3. Insert the cable connector into the cable connector port on the faceplate.
4. Arrange the cable in the cable management system to prevent it from dislodging or
developing stress points. Secure the cable so that it is not supporting its own weight
as it hangs to the floor. Place excess cable out of the way in a neatly coiled loop in
the cable management system. Placing fasteners on the loop helps to maintain its
shape.
CAUTION: Avoid bending fiber-optic cable beyond its minimum bend
radius. An arc smaller than a few inches in diameter can damage the cable
and cause problems that are difficult to diagnose.
CAUTION: Do not let fiber-optic cable hang free from the connector. Do
not allow fastened loops of cable to dangle, which stresses the cable at
the fastening point.
Proceed to “Step 6: Connect Power Cables” on page 16.
Step 6: Connect Power Cables
Depending on your configuration, your services gateway uses either AC or DC power
supplies. Perform the appropriate procedures for each power supply in your services
gateway.
Copyright © 2011, Juniper Networks, Inc.16
SRX3600 Services Gateway Getting Started Guide

NOTE: The device is not shipped with AC power cords. Make sure that you
order or obtain AC power cords with plugs that are appropriate for your
geographical location.
•Connect Power to an AC-Powered Services Gateway on page 17
•Connect Power to a DC-Powered Services Gateway on page 18
Connect Power to an AC-Powered Services Gateway
WARNING: The device must be properly grounded before you connect the
AC power cords.
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist, and connect
the strap to one of the ESD points on the chassis. For more information about ESD,
see the SRX3600 Services Gateway Hardware Guide.
2. Locate the power cords you will use to connect the device to AC power. See the
SRX3600 Services Gateway Hardware Guide for specifications.
3. For each power supply:
a. Insert the appliance coupler end of the power cord into the appliance inlet on the
power supply.
b. Insert the power cord plug into an external AC power source receptacle.
NOTE: Each power supply must be connected to a dedicated AC power
feed and a dedicated external circuit breaker. We recommend that you
use a 15 A (250 VAC) minimum, or as permitted by local code.
c. Snap the wire bail over the power cord as shown in Figure 15 on page 18 to prevent
the power cord from accidentally disengaging.
d. Dress the power cord appropriately. Verify that the power cord does not block the
air exhaust and access to services gateway components or drape where people
could trip on it.
17Copyright © 2011, Juniper Networks, Inc.
Connect Power to an AC-Powered Services Gateway

Figure 15: Connecting AC Power to the Services Gateway
g036044
4. If sufficient power is available and the AC power supply is correctly installed, the power
supply powers up automatically. If the AC power supply is installed correctly, the PWR
LED on the Switch Fabric Board (SFB) lights steadily.
If the PWR LED indicates that the power supply is not functioning normally, repeat
the installation and cabling procedures.
Connect Power to a DC-Powered Services Gateway
WARNING: The services gateway must be properly grounded before you
connect the DC power cables.
Table 2: DC Power System Input Voltage
SpecificationItem
Operating range: –40.5 to –72 VDCDC input voltage
CAUTION: You must ensure that power connections maintain the proper
polarity. The power source cables might be labeled (+) and (–) to indicate
their polarity. There is no standard color coding for DC power cables. The
color coding used by the external DC power source at your site determines
the color coding for the leads on the power cables that attach to the terminal
studs on each power supply.
Copyright © 2011, Juniper Networks, Inc.18
SRX3600 Services Gateway Getting Started Guide

1. Ensure that the voltage across the DC power source cable leads is 0 V and that there
is no chance that the cable leads might become active during installation.
2. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist, and connect
the strap to one of the ESD points on the chassis. For more information about ESD,
see the SRX3600 Services Gateway Hardware Guide.
3. For each power supply:
a. Remove the clear plastic cover protecting the terminal studs on the faceplate.
b. Attach the positive (+) DC source power cable lug to the RTN (return) terminal as
shown in Figure 16 on page 19.
Figure 16: Connect DC Power Cables
g036045
c. Secure the cable lug to the terminal on the power supply, first with the square
washer, and then with the screw. Apply between 23 lb-in. (2.6 Nm) and 25 lb-in.
(2.8 Nm) of torque.
d. Attach the negative (–) DC source power cable lug to the –48V (input) terminal.
e. Secure the cable lug to the terminal on the power supply, first with the square
washer, and then with the screw. Apply between 23 lb-in. (2.6 Nm) and 25 lb-in.
(2.8 Nm) of torque.
f. Replace the clear plastic cover over the terminal studs on the faceplate.
4. Disconnect the ESD grounding strap from the chassis, and connect it to an approved
site ESD grounding point. See the instructions for your site.
5. Connect each DC power cable to the appropriate external DC power source.
NOTE: For information about connecting to external DC power sources,
see the instructions for your site.
19Copyright © 2011, Juniper Networks, Inc.
Connect Power to a DC-Powered Services Gateway

6. Switch on the external circuit breakers to provide voltage to the DC power source
cable leads.
7. If sufficient power is available and the DC power supply is correctly installed, the power
supply will power up automatically. If the DC power supply is installed correctly and
functioning normally, the PWR LED on the SFB lights steadily.
If the PWR LED indicates that the power supply is not functioning normally, repeat
the installation and cabling procedures.
Proceed to “Step 7: Perform the Initial Software Configuration” on page 20.
Step 7: Perform the Initial Software Configuration
This procedure connects the services gateway to the network but does not enable it to
forward traffic. For complete information about enabling the services gateway to forward
traffic, including examples, see the appropriate Junos OS configuration guides.
To configure the software:
•Enter Configuration Mode on page 20
•Configure User Accounts and Passwords on page 20
•Configure System Attributes on page 21
•Commit the Configuration on page 22
Enter Configuration Mode
1. If you have not already done so, press the POWER button on the Switch Fabric Board
(SFB) to start the services gateway.
2. Log in as the root user. There is no password.
3. Start the command-line interface (CLI).
root# cli
root@>
4. Enter configuration mode.
configure
[edit]
root@#
Configure User Accounts and Passwords
1. Set the root authentication password by entering a cleartext password, an encrypted
password, or an SSH public key string (DSA or RSA).
[edit]
root@# set system root-authentication plain-text-password
New password: password
Retype new password: password
Copyright © 2011, Juniper Networks, Inc.20
SRX3600 Services Gateway Getting Started Guide