Juniper SRX550 User manual

1
The SRX550 High Memory Services Gateway is a large branch oce
gateway that combines security, routing, switching, and WAN interfaces
with next-generation firewall and advanced threat mitigation capabilities
for cost-eective, secure connectivity across distributed enterprise
locations. The services gateway simplifies network complexity, protects and
prioritizes network resources, and improves user and application experience.
The SRX550 High Memory Services Gateway comes with 4 GB of DRAM
memory and 8 GB of flash memory.
Package Contents
Verify that you have the following parts available:
•SRX550 High Memory Services Gateway
•RJ-45 cable with DB-9 adapter
•AC power supply
•Power cable
•Mounting brackets and screws
•USB cable
•Warranty and registration information
•End User License Agreement
•Quick Start Guide
How to Set Up Your SRX550 High Memory Services Gateway
Back Panel
Front Panel
Specification Value
Dimensions (H x W x D) 3.5 in. x 17.5 in. x 18.2 in.
(8.89 cm x 44.45 cm x 46.23 cm)
Chassis weight 21.96 lb (9.96 kg)
Average power consumption 85 W
Average heat dissipation 238 BTU/hr
Relative humidity 5% to 90%, noncondensing
Noise level 51.8 dB per ISO 7779 standard
g00
7818
Power supply slotsACE slot
Grounding point
Air filter cover
ESD pointStorage slot
g009056
LEDs
Serial
console
port
USB
console
port
AUX
port
ES
D
point
USB 0 and
USB 1 ports
Power
button
Reset Config
button
Gigabit
Ethernet ports
SFP
Ethernet ports
Mini-PIM
slots
GPIM
slots
Mounting
bracket

How to Set Up Your SRX550 High Memory Services Gateway 2
Factory-Default Settings
Security Policies
Source Zone Destination Zone Policy Action
trust untrust permit
trust trust permit
NAT Rules
Source Zone Destination Zone Policy Action
trust untrust Source NAT to untrust zone
interface
Interfaces
Port Label Interface Security Zone DHCP State IP Address
0/0 and 0/9 ge-0/0/0 and
ge-0/0/9
untrust Client Unassigned
0/1 ge-0/0/1 trust Server 192.168.1.1/24
0/2 ge-0/0/2 trust Server 192.168.2.1/24
0/3 ge-0/0/3 trust Server 192.168.3.1/24
0/4 ge-0/0/4 trust Server 192.168.4.1/24
0/5 ge-0/0/5 trust Server 192.168.5.1/24
cl-1/0/0
dl0 untrust ISP Assigned*
* Only if the LTE Mini-PIM is present
Services
Services
SSH
HTTPS
NETCONF over SSH
Protocols
Protocols
RSTP (all interfaces)
Screens
Screens
Basic set of screens are enabled on the untrust zone
Device Startup Mode
Device Startup Mode
Switching
Initial Configuration Process
g04361
6
Install Device
in a Rack
Connect the
Grounding Cable
Power On
the Device
Verify the
Settings
Configure
Using ZTP/J-Web
Connect to
Management Device
NOTE: Before you begin the installation, see the Safety Guide at https://
www.juniper.net/documentation/hardware/safety-guide/translated/index.
html.

How to Set Up Your SRX550 High Memory Services Gateway 3
Install the Device in a Rack
1. Position a mounting bracket on each side of the chassis. Use a Phillips (+)
screwdriver, number 2 to install the screws that secure the mounting brackets
to the chassis. Use either the front mount position or the center mount
position.
g009062
g009063
2. Have one person grasp the sides of the device, lift it, and position it in the rack.
Align the bottom hole in each mounting bracket with a hole in each rack rail,
making sure that the chassis is level.Have a second person install a mounting
screw into each of the two aligned holes. Use a number-3 Phillips screwdriver
to tighten the mounting screws.
3. Install the second screw in each mounting bracket.
g009064
4. Verify that the mounting screws on one side of the rack are aligned with the
mounting screws on the opposite side and that the device is level.

How to Set Up Your SRX550 High Memory Services Gateway 4
Connect the Grounding Cable
1. Attach an ESD strap to an ESD point and place the other end of the strap
around your bare wrist.
2. Connect the grounding cable to a proper earth ground.
3. Place the grounding cable lug over the grounding point on the upper rear of
the chassis.
NOTE: The device should be permanently connected to ground during
normal operation. A licensed electrician must attach a cable lug to the
grounding cable. A cable with an incorrectly attached lug can damage
the device.
4. Secure the grounding cable lug to the grounding point with the screws.
100-240V~10A MAX
50~60 HZ
DC OK AC OK
Grounding screw
(M3 screw)
Grounding
lug
Grounding
point
g00
7820
Power On the Device
1. If you are using the AC model, perform the following steps:
a. Connect the power supply adapter to the power supply point on the device
and to a power source. We recommend using a surge protector. You must
allow the device between five and seven minutes to boot after you power
it on.
g03410
9
b. Secure the power cord to the cable tie holder using a tie-wrap.
2. If you are using the DC model, perform the following steps:
WARNING: Before performing the following procedure, ensure that
there is no power in the DC circuit. To ensure that all power is cut o,
locate the circuit breaker on the panel board that services the DC circuit,
switch the circuit breaker to the OFF (0) position, and tape the switch
handle of the circuit breaker in the OFF position.
a. Ensure that the voltage across the DC power source cable leads is 0 V and
that the cable leads do not become active while you are connecting DC
power.
b. Verify that the DC power cables are correctly labeled before making
connections to the power supply. In a typical power distribution scheme
where the return is connected to chassis ground at the battery plant, you
can use a multimeter to verify the resistance of the -48V and RTN DC
cables to chassis ground:
•The cable with very high resistance (indicating an open circuit) to chassis
ground will be connected to the V- (input) DC power input terminal.
•The cable with very low resistance (indicating a closed circuit) to chassis
ground will be connected to the V+ (return) DC power input terminal.

How to Set Up Your SRX550 High Memory Services Gateway 5
c. Remove the clear plastic cover from the terminal studs on the faceplate.
d. Remove the screws on the terminals by using a Phillips (+) screwdriver,
number 2.
e. Secure each positive (+) DC source power cable lug to a RTN (return)
terminal. Secure each negative (–) DC source power cable lug to a -48V
(input) terminal.
f. Replace the clear plastic cover over the terminal studs on the faceplate.
g. Remove the tape from the switch handle of the circuit breaker on the panel
board that services the DC circuit and switch the circuit breaker to the ON
(|) position.
3. Note the following LED indications. Wait until the STATUS LED is solid green
before proceeding to the next step.
g00905
7
LED State
Power •Solid green (receiving power).
STAT US •Solid green (operating normally).
ALARM •Amber (operating normally–the LED might glow amber
if a rescue configuration is not set. This is not a panic
condition).
MPIM-1 and MPIM-2 •O (Mini-PIM not present or not detected).
•Solid green (Mini-PIM is operating normally).
•Red (Mini-PIM hardware failure or counterfeit check
failed).
HA •O (HA not enabled).
•Solid green (all HA links are available).
RPS •Solid green (redundant power supply is operating
normally).
ACE •The ACE LED is not functional.
STORAGE •Solid green (the services gateway is transferring data to
or from the optional storage device).
Connect the Management Device
1. Connect any of the network ports numbered 0/1 through 0/5 on the services
gateway to the Ethernet port on the management device, using an RJ-45
cable.
g00906
9
Ethernet port
RJ-45 cable Ethernet port

How to Set Up Your SRX550 High Memory Services Gateway 6
2. Ensure that the management device acquires an IP address. The IP address
should be on the corresponding IP subnet for the interface you connected to
in step 1. The device functions as a DHCP server and will assign an IP address
to the management device.
For example, if you are connected to port 0/1, then the IP address of the
management device should be from the 192.168.1.x network. If an IP address
is not assigned to the management device, manually configure an IP address.
Do not assign the 192.168.1.1 IP address to the management device, as this IP
address is assigned to the device. You can use the ipconfig (or ifconfig for
Macintosh or Linux users) command to verify the IP address.
Refer to the Interfaces table on page 2 for information on the subnet for each
interface.
3. Connect port 0/0 or 0/9 to the ISP device to obtain a dynamic IP address.
4. Access the J-Web interface using the URL https://192.168.1.1 (if connected to
port 0/1). For ports other than 0/1, access the services gateway using the URL
https://192.168.x.1, where x is the port number. Refer to the Interfaces table on
page 2. The recommended browser is Internet Explorer version 10 or 11, Mozilla
Firefox version 46 (or later), or Google Chrome 55 (or later).
To configure the device using Zero Touch Provisioning, follow the procedure in
the “Configure the Device Using ZTP with Juniper Networks Network Service
Controller” section.
To configure the device using J-Web, click Skip to J-Web and follow the
procedure in the “Configure the Device Using J-Web” section.
Configure the Device Using ZTP with Juniper Networks
Network Service Controller
Zero Touch Provisioning (ZTP) enables you to complete the initial configuration
of the SRX550 High Memory Services Gateway in your network automatically,
with minimum intervention.
Network Service Controller is a component of the Juniper Networks Contrail
Service Orchestration platform that simplifies and automates the design and
implementation of custom network services that use an open framework.
For more information, refer to the Network Service Controller section
in the datasheet at http://www.juniper.net/assets/us/en/local/pdf/
datasheets/1000559-en.pdf.
To configure the device automatically using ZTP:
NOTE: To complete the ZTP process, ensure that the services gateway
is connected to the Internet. See the “Connect the Management Device”
section.
•If you already have the authentication code, enter the code in the webpage
displayed.
On successful authentication, the initial configuration is applied and
committed on the services gateway. Optionally, the latest Junos OS image is
installed on the device before the initial configuration is applied.
•If you do not have the authentication code, you can use the J-Web setup
wizard to configure the services gateway. Click Skip to J-Web and follow the
procedure in the “Configure the Device Using J-Web” section

How to Set Up Your SRX550 High Memory Services Gateway 7
Configure the Device Using J-Web
To configure the device using J-Web, follow the steps in this section.
1. Enter the root authentication password.
2. Select one of the following setup modes:
•Guided Setup (uses a dynamic IP address)—Allows you to set up the
device in a custom security configuration. You can select either the Basic
or the Expert option.
•Default Setup (uses a dynamic IP address)—Allows you to quickly set up
the device with the default configuration. Any additional configuration can
be done after the wizard setup is completed.High Availability—Allows you
to set up a chassis cluster with a default basic configuration.
•High Availability—Allows you to set up a chassis cluster with a default basic
configuration.
NOTE: The initial configuration requires that you specify the device
name and root password. You can skip all the other steps and go directly
to the Confirm & Apply page to apply the configuration.
Configure the Device Using the Guided Setup Mode
1. Select the expertise level as Basic or Expert.
The following table compares the Basic and Expert levels:
Options Basic Expert
Number of internal zones
allowed
3 ≥ 3
Internet zone configuration
options
•Static IP
•Dynamic IP
•Static IP
•Static pool
•Dynamic IP
Internal zone service
configuration
Allowed Allowed
Internal destination NAT
configuration
Not allowed Allowed
2. Configure the basic settings:
a. Device name
b. Password for the root account (Use the password that you entered in Step
1 of the “Configure the Device Using J-Web” section.)
c. Time

How to Set Up Your SRX550 High Memory Services Gateway 8
3. Configure the security topology:
a. Internet zone (Untrust)
b. Internal zones (Trust)
c. DMZ
4. Configure the security policy:
a. Licenses (Security services)
b. DMZ policy
c. Internet and internal policies
d. Remote VPN
5. Configure Network Address Translation:
a. Internal Source NAT
b. Internal Destination NAT
c. DMZ Destination NAT
6. Review the settings and click Apply Settings.
NOTE: Check the connectivity from the management device to the
SRX Series device. You might lose connectivity to the SRX Series device
if you have changed the internal zone IP. Click the URL for reconnection
instructions on the Confirm & Apply page to reconnect, if required.
7. Click Done to complete the setup.
Configure the Device Using the Default Setup Mode
NOTE: Verify that the management device is connected to port 0/1 on
the services gateway before proceeding to the next step.
1. Configure the basic settings – device name, root account information, and
system time.

How to Set Up Your SRX550 High Memory Services Gateway 9
2. Configure the security policy – licenses.
3. Review the settings and click Apply Settings. Click Done to complete the
setup.
You can also configure the services gateway using the CLI, by connecting to
the Console port. For details, see the SRX550 High Memory Services Gateway
Hardware Guide.
Verify the Settings
Access http://www.juniper.net to ensure that you are connected to the Internet.
This connectivity ensures that you can pass trac through the services gateway.
If the page does not load, perform the following checks to see if you can identify
the problem:
•Verify your configuration settings, and ensure that you have applied the
configuration.
•Check if the ISP-supplied device connecting your SRX Series device to the
Internet is turned on and working properly. Try turning it o and on again.
After you complete these steps, the SRX Series device can pass trac from any
trust port to the untrust port.
Change the Configuration Settings (Optional)
After you complete the initial setup configuration, you can access the J-Web
setup wizard by clicking Configure > Device Setup > Set Up. You can either
edit the existing settings or create a new configuration. If you choose to create
a new configuration, then all the current configuration in the services gateway
will be deleted.

Copyright © 2017, Juniper Networks, Inc. All rights reserved.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper
Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks
reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Part Number: 530-081626 Revision 01, November 2017.
Power O the Device
To power o the device, press the Power button on the front of the device and
hold it for 10 seconds. To remove power completely from the device, unplug the
AC power cord or DC power supply cable. After powering o a power supply,
wait at least 60 seconds before turning it back on.
NOTE: Graceful shutdown is not supported on the SRX550 High
Memory Services Gateway.
Reset the Configuration
Use the RESET CONFIG button to restore the device to the factory-default
configuration or to a rescue configuration. To press the RESET CONFIG button,
insert a small probe (such as a straightened paper clip) into the pinhole on the
front panel.
Pressing and quickly releasing the RESET CONFIG button loads and commits
the rescue configuration. The rescue configuration is a previously committed,
valid configuration set through J-Web or the CLI. The STATUS LED is solid amber
during this time.
Pressing and holding the RESET CONFIG button for 15 seconds or more,
until the STATUS LED is solid amber, deletes all configurations (backup
configurations and rescue configuration), and loads and commits the factory
configuration.
NOTE: After resetting the device, check the device status by viewing
the LEDs on the front panel. For information on the LED states, see the
“Power On the Device” section.
Next Steps:
For information on configuring features on your services gateway, refer to the
following:
•Junos OS Documentation/Feature Configuration
http://www.juniper.net/techpubs/en_US/release-independent/junos/
information-products/pathway-pages/srx-series/product/index.html
•Getting Started Knowledge Base Article
https://kb.juniper.net/InfoCenter/index?page=content&id=KB15694
Reference
Technical Support
http://www.juniper.net/support/requesting-support.html
SRX550 High Memory Services Gateway Hardware Guide
http://www.juniper.net/techpubs/en_US/release-independent/junos/
information-products/pathway-pages/hardware/SRX550/srx550-hm-index.
html
Supported Transceivers
https://pathfinder.juniper.net/hct/product/#prd=SRX550%20HM