Juniper SRX5600 User manual

SRX 5600 Services Gateway
Getting Started Guide
August 2008
Part Number: 530-023490-01
Revision 02
This document describes how to install the SRX 5600 services gateway.
Contents About This Guide .............................................................................................3
Step 1: Prepare the Site ...................................................................................4
Rack-Mounting Requirements ...................................................................4
Required Tools ..........................................................................................5
Step 2: Install the Mounting Hardware ............................................................6
Install the Mounting Hardware in a Four-Post Rack or Cabinet or an
Open-Frame Rack ..............................................................................6
Step 3: Install the Device .................................................................................8
Install the Device Using a Lift ....................................................................8
Install the Device Without a Mechanical Lift ...........................................10
Remove Components .......................................................................11
Lift the Chassis into the Rack ............................................................11
Reinstall Components ......................................................................12
Step 4: Connect External Devices and IOC Cables .........................................12
Connect to a Network for Out-of-Band Management ...............................13
Connect a Management Console .............................................................13
Connect the IOC Cables ..........................................................................13
Step 5: Connect Ground and Power Cables ...................................................14
Connect the Grounding Cable .................................................................14
Connect Power to an AC-Powered Services Gateway ..............................15
Connect Power to a DC-Powered Services Gateway ................................16
Step 6: Perform Initial Software Configuration ..............................................18
Safety Warnings ............................................................................................22
■1

Compliance Statements for NEBS ..................................................................24
Compliance Statements for EMC Requirements ............................................24
Canada ...................................................................................................24
European Union ......................................................................................24
JUNOS Software Documentation for J-series Services Routers and SRX-series
Services Gateways ..................................................................................24
Requesting Technical Support .......................................................................26
Revision History ............................................................................................27
2■
SRX 5600 Services Gateway Getting Started Guide

About This Guide
This guide contains information you need to install and configure the SRX 5600
services gateway quickly. For complete installation instructions, see the SRX 5600
Services Gateway Hardware Guide at http://www.juniper.net/techpubs/.
WARNING: This guide contains a summary of safety warnings in “Safety
Warnings”on page 22. For a complete list of warnings for this device, including
translations, see the SRX 5600 Services Gateway Hardware Guide at
http://www.juniper.net/techpubs/.
The SRX 5600 services gateway is a high-performance, highly-scalable, carrier-class
security device with multi-processor architecture. The services gateway has a capacity
of up to 60 gigabits per second (Gbps), full duplex. The device is eight rack units (RU)
tall. Five devices can be stacked in a single floor-to-ceiling rack, for increased port
density per unit of floor space. The device provides eight slots that can be populated
with up to six Services Processing Cards (SPCs) and I/O cards(IOCs) and two Switch
Control Boards (SCBs) in nonredundant fabric configurations.
By installing different combinations of IOCs and SPCs, you can tailor both the number
of Gigabit ports and the maximum security processing capacity to suit your network.
Table 1 on page 3 describes the minimum system configuration for the SRX 5600.
Table 1: Minimum System Configuraton
MinimumComponent
1SPC
1IOC
1SCB
1Routing Engine
Fully populated, the device provides up to 200 Gigabit Ethernet or up to 20 10-Gigabit
Ethernet ports. Two types of IOC interface cards are available, each of which consists
of four Packet Forwarding Engines and enables a throughput of 10 Gbps. You can
install any combination of IOC types in the services gateway.
The SRX 5600 provides redundancy and resiliency. The hardware system is fully
redundant, including power supplies and SCBs.
The services gateway is shipped in a cardboard box strapped securely to a wooden
pallet. Plastic straps secure the top and bottom in place. The device chassis is bolted
to this pallet. Quick start installation instructions and a cardboard accessory box are
also included in the shipping container.
About This Guide ■3
About This Guide

Step 1: Prepare the Site
Figure 1: Rack Clearance and Chassis Dimensions
Rack-Mounting Requirements
■You can install the device in a four-post rack or cabinet or an open-frame rack.
■The rack rails must be spaced widely enough to accommodate the device chassis's
external dimensions: 14.0 in. (35.6 cm) high, 24.5 in. (62.2 cm) deep, and
17.45 in. (44.3 cm) wide. The outer edges of the mounting brackets extend the
width to 19 in. (48.3 cm).
■The rack must be strong enough to support the weight of the fully configured
device, up to 163.5 lb (74.2 kg). If you stack five fully configured devices in one
rack, it must be capable of supporting about 818 lb (371.0 kg).
■For service personnel to remove and install hardware components, there must
be adequate space at the front and back of the device. Allow at least
30 in. (76.2 cm) in front of the device and 24 in. (61 cm) behind the device.
■The rack or cabinet must have an adequate supply of cooling air.
■Ensure that the cabinet allows the chassis hot exhaust air to exit the cabinet
without recirculating into the device.
4■Step 1: Prepare the Site
SRX 5600 Services Gateway Getting Started Guide

■The device must be installed into a rack that is secured to the building structure.
■The device should be mounted at the bottom of the rack if it is the only unit in
the rack.
■When mounting the device in a partially filled rack, load the rack from the bottom
to the top with the heaviest component at the bottom of the rack.
Required Tools
To unpack the services gateway and prepare for installation, you need the following
tools:
■A mechanical lift—recommended
■Phillips (+) screwdrivers, numbers 1 and 2
■2.5 mm flat-blade (–) screwdriver
■3/8-in. nut driver
■1/2-in. or 13-mm open-end or socket wrench to remove bracket bolts from the
shipping pallet
■Electrostatic discharge (ESD) wrist strap
■Antistatic mat
Step 1: Prepare the Site ■5
Step 1: Prepare the Site

Step 2: Install the Mounting Hardware
To install the mounting hardware in a four-post rack or cabinet or an open-frame
rack:
■Install the Mounting Hardware in a Four-Post Rack or Cabinet or an Open-Frame
Rack on page 6
Install the Mounting Hardware in a Four-Post Rack or Cabinet or an Open-Frame Rack
To install the mounting shelf on the front rails of a four-post rack or cabinet, or the
rails of an open-frame rack:
1. If needed, install cage nuts in the holes specified in Table 2 on page 6.
2. On the back of each rack rail, partially insert a mounting screw into the lowest
hole specified in Table 2 on page 6.
3. Install the mounting shelf on the back of the rack rails. Rest the bottom slot of
each flange on a mounting screw.
4. Partially insert screws into the open holes in each flange of the mounting shelf
(see Figure 2 on page 7 or Figure 3 on page 8).
5. Tighten all the screws completely.
Table 2: Mounting Hole Locations
Mounting ShelfDistance Above “U”DivisionHole
X
1.14 U2.00 in. (5.1 cm)4
X
0.86 U1.51 in. (3.8 cm)3
X
0.50 U0.88 in. (2.2 cm)2
X
0.14 U0.25 in. (0.6 cm)1
6■Step 2: Install the Mounting Hardware
SRX 5600 Services Gateway Getting Started Guide

Figure 2: Mounting Hardware for a Four-Post Rack or Cabinet
Step 2: Install the Mounting Hardware ■7
Step 2: Install the Mounting Hardware

Figure 3: Mounting Hardware for an Open-Frame Rack
Step 3: Install the Device
Because of the device's size and weight, we recommend you install the device using
a mechanical lift. The procedure for installing the device depends on whether you
use a mechanical lift:
■Install the Device Using a Lift on page 8
■Install the Device Without a Mechanical Lift on page 10
Install the Device Using a Lift
1. Ensure the rack is in its permanent location and is secured to the building. Ensure
that the installation site allows adequate clearance for both airflow and
maintenance. For details, see the SRX 5600 Services Gateway Hardware Guide.
2. Load the device onto the lift, making sure it rests securely on the lift platform
(see Figure 4 on page 9).
8■Step 3: Install the Device
SRX 5600 Services Gateway Getting Started Guide

Figure 4: Load the Device onto the Lift
3. Using the lift, position the device in front of the rack or cabinet, centering it in
front of the mounting shelf.
4. Lift the chassis approximately 0.75 in. above the surface of the mounting shelf
and position it as close as possible to the shelf.
5. Carefully slide the device onto the mounting shelf so that the bottom of the
chassis and the mounting shelf overlap by approximately two inches.
6. Slide the chassis onto the mounting shelf until the mounting brackets contact
the rack rails. The shelf ensures that the holes in the mounting brackets and the
front-mounting flanges of the chassis align with the holes in the rack rails.
7. Move the lift away from the rack.
8. Install a mounting screw into each of the open mounting holes aligned with the
rack, starting from the bottom.
9. Visually inspect the alignment of the device. If the device is installed properly in
the rack, all the mounting screws on one side of the rack should be aligned with
the mounting screws on the opposite side and the device should be level.
Step 3: Install the Device ■9
Step 3: Install the Device

Install the Device Without a Mechanical Lift
To install the device without a mechanical lift:
■Remove Components on page 11
■Lift the Chassis into the Rack on page 11
■Reinstall Components on page 12
Figure 5: Components to Remove from the Front of the Device
Figure 6: Components to Remove from the Rear of the Device
10 ■Step 3: Install the Device
SRX 5600 Services Gateway Getting Started Guide

Remove Components
Before lifting the device, you must remove the following components:
■Power supplies
■Switch Control Boards (SCBs)
■I/O Cards (IOCs)
■Services Processing Cards (SPCs)
■Fan tray
To remove the components from the device:
1. Slide each component out of the chassis evenly so that it does not become stuck
or damaged.
2. Label each component as you remove it so you can reinstall it in the correct
location.
3. Immediately store each removed component in an electrostatic bag.
4. Do not stack removed components. Lay each one on a flat surface.
NOTE: For complete instructions on removing device components, see “Install the
Services Gateway Without a Mechanical Lift”in the SRX 5600 Services Gateway
Hardware Guide.
Lift the Chassis into the Rack
Lifting the chassis and mounting it in a rack requires three people. The empty chassis
weighs approximately 150 lb (60.4 kg).
1. Ensure the rack is in its permanent location and is secured to the building.
2. Position the chassis in front of the rack or cabinet, centering it in front of the
mounting shelf. Use a pallet jack if one is available.
3. With one person on each side and one person in the front, hold onto the bottom
of the chassis and carefully lift it onto the large and small (if installed) mounting
shelves.
4. Slide the chassis onto the mounting shelf until the mounting brackets contact
the rack rails. The shelf ensures that the holes in the mounting brackets and the
front-mounting flanges of the chassis align with the holes in the rack rails.
5. To install the chassis in an open-frame rack, install a mounting screw into each
of the open mounting holes aligned with the rack, starting from the bottom.
6. Visually inspect the alignment of the chassis. If the chassis is installed properly
in the rack, all the mounting screws on one side of the rack should be aligned
with the mounting screws on the opposite side and the chassis should be level.
Step 3: Install the Device ■11
Step 3: Install the Device

Figure 7: Lift the Chassis into the Rack
Reinstall Components
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 5600 Services Gateway Hardware Guide.
2. Slide each component into the chassis evenly so that it does not become stuck
or damaged.
3. Tighten the captive screws or lock any levers for each component installed.
NOTE: Make sure that all empty slots are covered with blank panels before operating
the device.
Step 4: Connect External Devices and IOC Cables
To connect external devices and IOC cables, perform the following procedures:
■Connect to a Network for Out-of-Band Management on page 13
■Connect a Management Console on page 13
■Connect the IOC Cables on page 13
12 ■Step 4: Connect External Devices and IOC Cables
SRX 5600 Services Gateway Getting Started Guide

Figure 8: Connect External Devices and IOC Cables
Connect to a Network for Out-of-Band Management
1. Turn off the power to the management device.
2. Plug one end of the RJ-45 Ethernet cable into the appropriate ETHERNET port on
the Routing Engine.
3. Plug the other end of the cable into the network device.
Connect a Management Console
1. Turn off the power to the management device.
2. Plug RJ-45 end of the serial cable into the appropriate CONSOLE or AUX port on
the Routing Engine.
3. Plug the female DB-9 end into the device's serial port.
Connect the IOC Cables
1. Have ready a length of the type of cable used by the IOC. For cable specifications,
see the SRX 5600 Services Gateway Hardware Guide.
2. If the IOC cable connector port is covered by a rubber safety plug, remove the
plug.
WARNING: Do not look directly into a fiber-optic transceiver or into the ends of
fiber-optic cables. Fiber-optic transceivers and fiber-optic cable connected to a
transceiver emit laser light that can damage your eyes.
CAUTION: Do not leave a fiber-optic transceiver uncovered except when inserting
or removing cable. The safety cap keeps the port clean and prevents accidental
exposure to laser light.
Step 4: Connect External Devices and IOC Cables ■13
Step 4: Connect External Devices and IOC Cables

3. Insert the cable connector into the cable connector port on the IOC faceplate.
4. Arrange the cable in the cable management system to prevent it from dislodging
or developing stress points. Secure the cable so that it is not supporting its own
weight as it hangs to the floor. Place excess cable out of the way in a neatly
coiled loop in the cable management system. Placing fasteners on the loop helps
to maintain its shape.
CAUTION: Avoid bending fiber-optic cable beyond its minimum bend radius. An arc
smaller than a few inches in diameter can damage the cable and cause problems
that are difficult to diagnose.
CAUTION: Do not let fiber-optic cable hang free from the connector. Do not allow
fastened loops of cable to dangle, which stresses the cable at the fastening point.
Step 5: Connect Ground and Power Cables
Depending on your configuration, your device uses either AC or DC power supplies.
Perform the appropriate procedures for each power supply in your device.
■Connect the Grounding Cable on page 14
■Connect Power to an AC-Powered Services Gateway on page 15
■Connect Power to a DC-Powered Services Gateway on page 16
Connect the Grounding Cable
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to an approved site ESD grounding point. See the instructions
for your site.
2. Connect the grounding cable to a proper earth ground.
3. Verify that a licensed electrician has attached the cable lug provided with the
services gateway to the grounding cable.
4. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 5600 Services Gateway Hardware Guide.
5. Place the grounding cable lug over the grounding point. The grounding point is
sized for UNC 1/4-20 nuts.
6. Secure the grounding cable lug to the grounding point, first with the washers,
then with the screws.
7. Verify that the grounding cabling is correct, that the grounding cable does not
touch or block access to device components, and that it does not drape where
people could trip on it.
14 ■Step 5: Connect Ground and Power Cables
SRX 5600 Services Gateway Getting Started Guide

Connect Power to an AC-Powered Services Gateway
WARNING: The device must be properly grounded before you connect the AC power
cords.
1. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 5600 Services Gateway Hardware Guide.
2. Locate the power cords shipped with the device, which should have a plug
appropriate for your geographical location. See the SRX 5600 Services Gateway
Hardware Guide.
3. For each power supply:
a. Move the power switch on the power supply faceplate to the OFF position
(O).
b. Insert the appliance coupler end of the power cord into the appliance inlet
on the power supply.
c. Insert the power cord plug into an external AC power source receptacle.
NOTE: Each power supply must be connected to a dedicated AC power feed and a
dedicated external circuit breaker. We recommend that you use a 15 A (250 VAC)
minimum, or as permitted by local code.
d. Dress the power cord appropriately. Verify that the power cord does not
block the air exhaust and access to device components, or drape where
people could trip on it.
Step 5: Connect Ground and Power Cables ■15
Step 5: Connect Ground and Power Cables

Figure 9: Connecting AC Power to the Services Gateway
4. Switch the AC switch on each power supply to the ON position (—) and observe
the status LEDs on each power supply faceplate. If an AC power supply is correctly
installed and functioning normally, the AC OK and DC OK LEDs light steadily, and
the PS FAIL LED does not light.
If any of the status LEDs indicates that the power supply is not functioning
normally, repeat the installation and cabling procedures.
Connect Power to a DC-Powered Services Gateway
WARNING: The device must be properly grounded before you connect the DC power
cables.
Table 3: DC Power System Input Voltage
SpecificationItem
Operating range: –40.5 to –72 VDCDC input voltage
16 ■Step 5: Connect Ground and Power Cables
SRX 5600 Services Gateway Getting Started Guide

Figure 10: Connect DC Power Cables
CAUTION: You must ensure that power connections maintain the proper polarity.
The power source cables might be labeled (+) and (–)to indicate their polarity. There
is no standard color coding for DC power cables. The color coding used by the external
DC power source at your site determines the color coding for the leads on the power
cables that attach to the terminal studs on each power supply.
1. Ensure that the voltage across the DC power source cable leads is 0 V and that
there is no chance that the cable leads might become active during installation.
2. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to one of the ESD points on the chassis. For more information
about ESD, see the SRX 5600 Services Gateway Hardware Guide.
3. For each power supply:
a. Switch the circuit breaker on the power supply faceplate to the OFF position
(O).
b. Remove the clear plastic cover protecting the terminal studs on the faceplate.
c. Attach the positive (+) DC source power cable lug to the RTN (return)
terminal.
d. Secure the power cable lugs to the terminal studs on the power supply, first
with the split washer, then with the nut. Apply between 23 lb-in. (2.6 Nm)
and 25 lb-in. (2.8 Nm) of torque.
e. Attach the negative (–) DC source power cable lug to the –48V (input)
terminal.
Step 5: Connect Ground and Power Cables ■17
Step 5: Connect Ground and Power Cables

f. Secure the power cable lugs to the terminal studs on the power supply, first
with the split washer, then with the nut. Apply between 23 lb-in. (2.6 Nm)
and 25 lb-in. (2.8 Nm) of torque.
g. Replace the clear plastic cover over the terminal studs on the faceplate.
4. Attach an electrostatic discharge (ESD) grounding strap to your bare wrist and
connect the strap to an approved site ESD grounding point. See the instructions
for your site.
5. Connect each DC power cable to the appropriate external DC power source.
NOTE: For information about connecting to external DC power sources, see the
instructions for your site.
6. Switch on the external circuit breakers to provide voltage to the DC power source
cable leads.
7. Switch on the circuit breakers on each power supply to the ON position (|).
Observe the status LEDs on each power supply faceplate. If a DC power supply
is correctly installed and functioning normally, the PWR OK, BRKR ON, and
INPUT OK LEDs light green steadily.
Step 6: Perform Initial Software Configuration
This procedure connects the device to the network but does not enable it to forward
traffic. For complete information about enabling the device to forward traffic, including
examples, see the appropriate JUNOS software configuration guides.
To configure the software:
1. If you have not already done so, switch the circuit breaker or toggle switch for
each power supply to the ON position to start the device. The OK LED on the
power supply faceplate should blink, then light steadily.
2. Log in as the root user. There is no password.
3. Start the CLI.
root# cli
root@>
4. Enter configuration mode.
configure
[edit]
root@#
5. Set the root authentication password by entering either a cleartext password,
an encrypted password, or an SSH public key string (DSA or RSA).
[edit]
root@# set system root-authentication plain-text-password
New password: password
18 ■Step 6: Perform Initial Software Configuration
SRX 5600 Services Gateway Getting Started Guide

Retype new password: password
6. Configure an administrator account on the device.
[edit]
root@# set system login user admin class super-user authentication
plain-text-password
7. Configure the password for the administrator account.
[edit]
root@# set system root-authentication plain-text-password
8. Commit the configuration to activate it on the device.
[edit]
root@# commit
9. Log in as the administrative user you configured in step 6.
10. Configure the name of the device. If the name includes spaces, enclose the name
in quotation marks (“”).
configure
[edit]
admin@# set system host-name host-name
11. Configure the IP address and prefix length for the device’s Ethernet interface.
[edit]
admin@# set interfaces fxp0 unit 0 family inet address address/prefix-length
12. Configure the traffic interface.
[edit]
admin@# set interfaces ge-6/2/0 unit 0 family inet address address/prefix-length
admin@# set interfaces ge-6/3/5 unit 0 family inet address address/prefix-length
13. Configure the default route.
[edit]
admin@# set routing-options static route 0.0.0.0/0 next-hop gateway
14. Configure basic security zones and bind them to traffic interfaces.
[edit]
admin@# set security zones security-zone trust interfaces ge-6/3/5
admin@# set security zones security-zone untrust interfaces ge-6/2/0
15. Configure basic security policies.
[edit]
admin@# set security policies from-zone trust to-zone untrust policy policy-name
match source-address any destination-address any application any
root@# set security policies from-zone trust to-zone untrust policy policy-name
then permit
Step 6: Perform Initial Software Configuration ■19
Step 6: Perform Initial Software Configuration

16. Check the configuration for validity.
[edit]
admin@# commit check
configuration check succeeds
17. Commit the configuration to activate it on the device.
[edit]
admin@# commit
commit complete
18. Optionally, display the configuration to verify that it is correct.
admin@# show
## Last changed: 2008-05-07 22:43:25 UTC
version "9.2I0 [builder]";
system {
autoinstallation;
host-name henbert;
root-authentication {
encrypted-password "$1$oTVn2KY3$uQe4xzQCxpR2j7sKuV.Pa0"; ##
SECRET-DATA
}
login {
user admin {
uid 928;
class super-user;
authentication {
encrypted-password "$1$cdOPmACd$QvreBsJkNR1EF0uurTBkE.";
## SECRET-DATA
}
}
}
services {
ssh;
web-management {
http {
interface ge-0/0/0.0;
}
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
20 ■Step 6: Perform Initial Software Configuration
SRX 5600 Services Gateway Getting Started Guide