Juniper SSG 500M Series User manual

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-017259-01, Revision 06
Security Products
SSG 500M-series
Hardware Installation and Configuration Guide

2
Copyright Notice
Copyright © 2009 Juniper Networks, Inc. All rights reserved.
Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, ScreenOS, and Steel-Belted Radius are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. JUNOSe is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or
registered service marks are the property of their respective owners.
All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any
obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication
without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense.
The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency
energy. If it is not installed in accordance with Juniper Networks’ installation instructions, it may cause interference with radio and television reception.
This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC
rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no
guarantee that interference will not occur in a particular installation.
If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user
is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Consult the dealer or an experienced radio/TV technician for help.
Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.

Table of Contents 3
Table of Contents
About This Guide 5
Organization ....................................................................................................5
Web User Interface Conventions ..............................................................6
Command Line Interface Conventions ......................................................6
Requesting Technical Support ..........................................................................7
Self-Help Online Tools and Resources........................................................7
Opening a Case with JTAC .........................................................................7
Feedback .........................................................................................................8
..................................................................................................................8
Chapter 1 Hardware Overview 9
Front Panel ......................................................................................................9
Port Descriptions .....................................................................................10
Power Button...........................................................................................11
Reset Config Button.................................................................................11
Device Status LEDs..................................................................................11
Ethernet Port LEDs ..................................................................................12
Physical Interface Module Slots ...............................................................13
USB Ports ................................................................................................13
Back Panel .....................................................................................................14
Power Supply Units .................................................................................14
AC Power Supply Unit.......................................................................15
DC Power Supply Unit.......................................................................16
Grounding Lug .........................................................................................16
Chapter 2 Installing and Connecting the Device 19
Before You Begin ...........................................................................................20
Installing Equipment ......................................................................................20
Organizing Interface Cables ...........................................................................22
Chassis Grounding .........................................................................................22
Connecting Power..........................................................................................22
AC Power ................................................................................................22
DC Power ................................................................................................23
Powering the Device On and Off....................................................................26
Connecting the Device to a Network ..............................................................26
Chapter 3 Configuring the Device 29
Accessing the Device......................................................................................30
Using a Console Connection ....................................................................30
Using the WebUI .....................................................................................32
Using Telnet ............................................................................................32
Default Device Settings ..................................................................................33

4Table of Contents
SSG 500M-series Installation and Configuration Guide
Basic Device Configuration ............................................................................33
Admin Name and Password ....................................................................34
Administrative Access .............................................................................34
Interface IP Address ................................................................................34
Management Services..............................................................................35
Hostname and Domain Name .................................................................35
Domain Name System Server..................................................................36
Date and Time.........................................................................................36
Default Route...........................................................................................36
High Availability Configuration.......................................................................37
PIM Configuration .......................................................................................... 40
Basic Firewall Protections ..............................................................................40
Verifying External Connectivity......................................................................40
Restarting the Device .....................................................................................41
Restarting the Device with the CLI Reset Command................................41
Restarting the Device with the WebUI .....................................................41
Resetting the Device to Factory Defaults........................................................42
Device Serial Number..............................................................................42
unset all...................................................................................................43
Reset Pinhole Button ...............................................................................43
Chapter 4 Servicing the Device 45
Required Tools and Parts ...............................................................................45
Replacing a PIM .............................................................................................46
Removing a Blank Faceplate....................................................................46
Removing a PIM ......................................................................................47
Installing a PIM........................................................................................47
Replacing Power Components (SSG 550M Only)............................................48
Removing a Power Supply Unit ...............................................................49
Installing a Power Supply Unit .................................................................50
Replacing an AC Power Cord ...................................................................51
Upgrading Memory ........................................................................................52
Replacing the Air Filter...................................................................................54
Appendix A Specifications 57
Physical..........................................................................................................57
Electrical ........................................................................................................58
Environmental Tolerance...............................................................................58
Certifications..................................................................................................59
RoHS and WEEE ............................................................................................59
Connectors.....................................................................................................60
Index.......................................................................................................................... 63

Organization 5
About This Guide
The Juniper Networks Secure Services Gateway (SSG) 500M-series devices are
integrated router and firewall platforms. They provide Internet Protocol Security
(IPSec) virtual private network (VPN) and firewall services for enterprise-edge
environments.
Juniper Networks offers two models of SSG 500M-series devices:
SSG 520M
SSG 550M
Organization
This guide contains the following chapters and appendix:
Chapter 1, “Hardware Overview,” describes the chassis and components of
SSG 500M-series devices.
Chapter 2, “Installing and Connecting the Device,” describes how to mount an
SSG 500M-series device and how to connect cables and power to it.
Chapter 3, “Configuring the Device,” describes how to configure and manage
an SSG 500M-series device and how to perform some basic configuration tasks.
Chapter 4, “Servicing the Device,” describes service and maintenance
procedures for an SSG 500M-series device.
Appendix A, “Specifications,” provides general system specifications for an
SSG 500M-series device.
NOTE: The configuration instructions and examples in this document are based on the
functionality of a device running ScreenOS Release 6.0.0. Your device might
function differently depending on the ScreenOS version you are running. For the
latest device documentation, refer to the Juniper Networks Technical Publications
website at www.juniper.net/techpubs/hardware. To determine which ScreenOS
versions are currently available for your device, refer to the Juniper Networks
Support website at http://www.juniper.net/customers/support/.

SSG 500M-series Installation and Configuration Guide
6Organization
Web User Interface Conventions
The Web user interface (WebUI) contains a navigational path and configuration
settings. To enter configuration settings, begin by clicking a menu item in the
navigation tree on the left side of the screen. As you proceed, your navigation path
appears at the top of the screen, with each page separated by angle brackets.
The following example shows the WebUI path and parameters for defining an
address:
Policy > Policy Elements > Addresses > List > New: Enter the following, then
click OK:
Address Name: addr_1
IP Address/Domain Name:
IP/Netmask: (select), 10.2.2.5/32
Zone: Untrust
To open online Help for configuration settings, click the question mark (?) in the
upper left of the screen.
The navigation tree also provides a Help > Config Guide configuration page to help
you configure security policies and Internet Protocol Security (IPSec). Select an
option from the list and follow the instructions on the page. Click the
? character in
the upper left for Online Help on the Config Guide.
Command Line Interface Conventions
The following conventions are used to present the syntax of command line
interface (CLI) commands in text and examples.
In text, commands are in boldface type and variables are in italic type.
In examples:
Variables are in italic type.
Anything inside square brackets [ ] is optional.
Anything inside braces { } is required.
If there is more than one choice, each choice is separated by a pipe ( | ). For
example, the following command means “set the management options for the
ethernet1, the ethernet2, or the ethernet3 interface”:
set interface { ethernet1 | ethernet2 | ethernet3 } manage
NOTE: When entering a keyword, you only have to type enough letters to identify the
word uniquely. For example, typing set adm u ang j12fmt54 is enough to enter
the command set admin user angel j12fmt54. Although you can use this shortcut
when entering commands, all the commands documented here are presented in
their entirety.

Requesting Technical Support 7
About This Guide
Requesting Technical Support
Technical product support is available through the Juniper Networks Technical
Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC
support contract, or are covered under warranty, and need postsales technical
support, you can access our tools and resources online or open a case with JTAC.
JTAC policies—For a complete understanding of our JTAC procedures and
policies, review the JTAC User Guide located at
http://www.juniper.net/customers/support/downloads/710059.pdf.
Product warranties—For product warranty information, visit
http://www.juniper.net/support/warranty/.
JTAC hours of operation—The JTAC centers have resources available 24 hours a
day, 7 days a week, 365 days a year.
Self-Help Online Tools and Resources
For quick and easy problem resolution, Juniper Networks has designed an online
self-service portal called the Customer Support Center (CSC) that provides you with
the following features:
Find CSC offerings—http://www.juniper.net/customers/support/
Find product documentation—http://www.juniper.net/techpubs/
Find solutions and answer questions using our Knowledge Base—
http://kb.juniper.net/
Download the latest versions of software and review your release notes—
http://www.juniper.net/customers/csc/software/
Search technical bulletins for relevant hardware and software notifications—
http://www.juniper.net/alerts/
Join and participate in the Juniper Networks Community Forum—
http://www.juniper.net/company/communities/
Open a case online in the CSC Case Manager—
http://www.juniper.net/customers/cm/
To verify service entitlement by product serial number, use our Serial Number
Entitlement (SNE) Tool—
https://tools.juniper.net/SerialNumberEntitlementSearch/
Opening a Case with JTAC
You can open a case with JTAC on the Web or by telephone.
Use the Case Manager tool in the CSC at http://www.juniper.net/customers/cm/.
Call 1-888-314-JTAC (1-888-314-5822—toll free in USA, Canada, and Mexico).

SSG 500M-series Installation and Configuration Guide
8Feedback
For international or direct-dial options in countries without toll-free numbers, visit
us at http://www.juniper.net/customers/support/requesting-support/.
Feedback
If you find any errors or omissions in this document, contact Juniper Networks at
[e-mail].

Front Panel 9
Chapter 1
Hardware Overview
This chapter provides detailed descriptions of the Secure Services Gateway
(SSG) 520M and SSG 550M device and components. It includes the following
sections:
“Front Panel” on page 9
“Back Panel” on page 14
Front Panel
Figure 1 shows the front panel of an SSG 500M-series device.
Figure 1: SSG 500M-series Front Panel (SSG 550M Shown, SSG 520M Similar)
SSG 550M
Device status
LEDs Power
button
Reset config
button Console port
AUX port
USB ports
PIM Slot 1
PIM Slot 2
PIM Slot 3
PIM Slot 4
PIM Slot 5
PIM Slot 6
Ethernet
ports

SSG 500M-series Installation and Configuration Guide
10 Front Panel
The following sections describe the elements on the front panel of an
SSG 500M-series device:
“Port Descriptions” on page 10
“Power Button” on page 11
“Reset Config Button” on page 11
“Device Status LEDs” on page 11
“Ethernet Port LEDs” on page 12
“Physical Interface Module Slots” on page 13
“USB Ports” on page 13
Port Descriptions
Table 1 describes the function, connector type, and speed/protocol (if applicable) of
the ports on the front panel of the SSG 500M-series device.
Table 1: SSG 500M-series Ports
Item Description Connector Speed/Protocol
Ethernet 0/0 to
0/3 Ports
Enables ethernet connections to workstations or a LAN connection
through a switch or hub. These connections also allow you to
manage the device through a Telnet session or the WebUI.
When configuring one of the ports, reference the interface name
that corresponds to the location of the port. From left to right on the
front panel, the interface names for the ports are ethernet0/0
through ethernet0/3. For the default zone bindings for each
Ethernet port, see “Default Device Settings” on page 33.
RJ-45 10/100 Mbps Ethernet
Autosensing duplex and
auto MDI/MDIX
USB Port Enables a 1.1 USB connection with the device. See “USB Ports” on
page 13 for more information about using the USB ports.
- 12M (full speed) or 1.5M
(low speed)
Console Port The console port is an RJ-45 serial data terminal equipment (DTE)
port that can be used for either local or remote administration. For
local administration, connect the port to a terminal with an
RJ-45-to-DB-9 (female-to-male) straight-through serial cable. For
remote administration, connect the port to a workstation with an
RJ-45-to-DB-9 (female-to-male) serial cable with a null modem
adapter.
See “Connectors” on page 60 for the RJ-45 connector pinouts.
RJ-45 9600 bps/RS-232C serial
AUX Port The auxiliary (AUX) port is an RJ-45 serial port wired as a DTE that
you can connect to a modem to allow remote administration. We do
not recommend using this port for regular remote administration.
The AUX port is typically assigned to be the backup serial interface.
The baud rate is adjustable from 9600 bps to 115200 bps and
requires hardware flow control.
See “Connectors” on page 60 for the RJ-45 connector pinouts.
RJ-45 9600 bps — 115
Kbps/RS-232C serial

Front Panel 11
Hardware Overview
Power Button
The power button is located on the left side of the front panel. You use the power
button to power the device on and off. When you power on the device, ScreenOS
starts as the power supply completes its startup sequence. See “Powering the
Device On and Off” on page 26 for more information.
Reset Config Button
The Reset Config button resets the device to factory default settings. You press this
button by inserting a thin, firm wire (such as a straightened paper clip) into the
pinhole on the front panel. See “Resetting the Device to Factory Defaults” on
page 42 for more information.
Device Status LEDs
The Device LEDs show information about current device status. Figure 2 illustrates
the position of each LED on the front of the SSG 500M-series device.
Figure 2: Device Status LEDs
When the device powers up, the POWER LED changes from off to blinking green,
and the STATUS LED changes in the following sequence: red, green, blinking green.
Startup takes approximately two minutes to complete. If you want to turn the
device off and on again, we recommend you wait a few seconds between shutting it
down and powering it back up. Table 2 lists the name, color, status, and description
of each device status LED.
Table 2: Device Status LED Descriptions
Name Color Status Description
POWER Green On steadily Device is receiving power
Red On steadily Power Supply Unit (PSU) failure
Off Device is operating normally or is not receiving
power
STATUS Green On steadily Device is starting or performing diagnostics
Blinking Device is operating normally
Red Blinking Error is detected

SSG 500M-series Installation and Configuration Guide
12 Front Panel
Ethernet Port LEDs
The Ethernet LEDs show the status of each Ethernet port. Figure 3 displays the
location of the LEDs on each Ethernet port.
Figure 3: Activity Link LEDs
Table 3 describes the Ethernet port LEDs.
ALARM Red On steadily Critical alarm:
Failure of hardware component or software
module
Firewall attacks detected
Amber On steadily Major alarm:
Low memory (less than 10% remaining)
High CPU utilization (more than 90% in use)
Session full
Maximum number of VPN tunnels reached
HA status changed or redundant group member
not found
Off No alarms
HA Green On steadily Unit is the primary (master) device
Amber On steadily Unit is the secondary (backup) device
Off High availability not enabled
Table 2: Device Status LED Descriptions (Continued)
Name Color Status Description
Table 3: Ethernet Port LEDs
Name Function Color State Description
LINK Link Green On steadily Port is online
Off Port is off line
TX/RX Activity Green Blinking Port is receiving data
Off Port might be on, but it is not receiving data
LINK
TX/RX

Front Panel 13
Hardware Overview
Physical Interface Module Slots
Physical interface modules (PIMs) let you add Ethernet and WAN interfaces to your
SSG 500M-series device. To install and remove PIMs, see “Replacing a PIM” on
page 46. For more information about installing and configuring PIMs, see the PIM
and Mini-PIM Installation and Configuration Guide.
Table 4 shows the PIM types you can install in the slots of an SSG 520M device. The
E located on some of the slots identifies where you can install enhanced PIMs
(ePIMs).
Table 5 shows the PIM types you can install in the slots of an SSG 550M device. The
E located on some of the slots identifies where you can install enhanced PIMs
(ePIMs).
USB Ports
The USB ports on the front panel of an SSG 500M-series device accept a universal
serial bus (USB) storage device.
The USB ports let you transfer data such as device configurations, image keys, and
ScreenOS software between a USB storage device and the internal flash storage of
the security device. The USB ports support USB 1.1 and USB 2.0 specifications.
You can also log messages to a USB storage device. For more information about
logging, refer to the Administration volume of the Concepts and Examples ScreenOS
Reference Guide.
CAUTION: PIMs are not hot-swappable. Always switch off the device before
inserting or removing PIMs.
Table 4: PIM Slots, SSG 520M
Slot PIM Types Slot PIM Types
1WAN PIM or uPIM only 4WAN PIM or uPIM only
2WAN PIM or uPIM only 5WAN PIM or uPIM only
3WAN PIM, uPIM or ePIM 6WAN PIM, uPIM or ePIM
Table 5: PIM Slots, SSG 550M
Slot PIM Types Slot PIM Types
1WAN PIM or uPIM only 4WAN PIM or uPIM only
2WAN PIM, uPIM or ePIM 5WAN PIM, uPIM or ePIM
3WAN PIM, uPIM or ePIM 6WAN PIM, uPIM or ePIM
NOTE: When you install PIMs with Small Form-factor Pluggable (SFP) interfaces, Juniper
strongly recommends the use of Juniper SFP transceivers. Juniper cannot
guarantee correct operation if non-Juniper transceivers are used. The transceiver
type can be different in each port, as long as a supported part number is used.

SSG 500M-series Installation and Configuration Guide
14 Back Panel
To transfer data between a USB storage device and an SSG 500M-series device:
1. Connect the USB storage device to either the upper or lower USB port on the
security device.
2. Save the files from the USB storage device to the internal flash storage on the
device with the save {software | config | image-key} from usb filename to
flash command.
3. Stop the USB port with the exec usb-device stop command before removing
the USB storage device.
4. Remove the USB storage device.
If you want to delete a file from the USB storage device, use the delete file
usb:/filename command.
If you want to view the saved file information on the USB storage device and
internal flash storage, use the get file command.
Back Panel
The back panel of an SSG 500M-series device contains the fan tray and power
supply unit(s) and a two-hole grounding lug.
Figure 4: Back Panel of an SSG 500M-series Device
Power Supply Units
The power supply units (PSUs) are located at the right side of the back panel:
The SSG 520M device is equipped with a single permanently installed AC or DC
power supply unit (PSU).
The SSG 550M device has slots for two field-installable PSUs and is supplied
with a single AC or DC PSU. You can add a second AC or DC PSU for increased
reliability.
CAUTION: Always execute the exec usb-device stop command before
disconnecting a USB storage device. Disconnecting a USB device without
executing the stop command may cause the device to restart.
Grounding
lugs
Power Supply Units

Back Panel 15
Hardware Overview
For PSU servicing instructions, see “Replacing Power Components (SSG 550M
Only)” on page 48.
The POWER LED on the front panel of an SSG 500M-series device glows either
green or red. Green indicates correct function and red indicates PSU failure.
Table 6 describes the LED states on the field-installable AC and DC PSUs.
AC Power Supply Unit
The fixed AC PSU faceplate for an SSG 520M device contains a power switch and a
male power-cord receptacle. The fixed AC PSU does not have a power LED on the
PSU.
Figure 5: SSG 520M Device Fixed AC PSU Faceplate
The field-replaceable AC PSU faceplate for an SSG 550M device contains an ejector
tab handle, an input power light, and a power cord receptacle.
NOTE: Do not mix SSG 550M PSU types. The only supported combinations are AC+AC
and DC+DC.
Table 6: Input Power LED Descriptions
Status Color Description
On steadily Green Input power is on and device is on
Amber Input power is on and device is off
Off Input power is off
O
I
Power switch
Powercord
receptacle

SSG 500M-series Installation and Configuration Guide
16 Back Panel
Figure 6: SSG 550M Device Replaceable AC PSU Faceplate
DC Power Supply Unit
The fixed DC PSU faceplate for an SSG 520M device contains an ejector tab, an
input power light, and two DC power terminal blocks that connect to power cables.
Figure 7: SSG 520M Device Fixed DC PSU Faceplate
The field-replaceable DC PSU faceplate contains an ejector tab, a handle, an input
power light, and two DC power terminal blocks that connect to power cables.
Figure 8: SSG 550M Device Replaceable DC PSU Faceplate
Grounding Lug
A two-hole grounding lug is provided on the left rear of the chassis to connect the
device to earth ground (see Figure 4 on page 14).
Ejector tab
Powercord
receptacle
Handle
Input
power light
-48V
RTN
Ejector tab
DC power
terminal
blocks
Input
power light
-48V
RTN
Ejector tab
DC power
terminal
blocks
Handle
Input
power light

Back Panel 17
Hardware Overview
To ground the device before connecting power, connect a grounding cable to earth
ground and then attach the cable to the lug on the rear of the chassis. For more
information, see “Chassis Grounding” on page 22.

SSG 500M-series Installation and Configuration Guide
18 Back Panel

19
Chapter 2
Installing and Connecting the Device
This chapter describes how to install an SSG 500M-series device in a standard
19-inch equipment rack and how to connect cables and power to the device. This
chapter includes the following sections:
“Before You Begin” on page 20
“Installing Equipment” on page 20
“Organizing Interface Cables” on page 22
“Chassis Grounding” on page 22
“Connecting Power” on page 22
“Powering the Device On and Off” on page 26
“Connecting the Device to a Network” on page 26
NOTE: For safety warnings and instructions, refer to the Juniper Networks Security
Products Safety Guide. When working on any equipment, be aware of the hazards
involved with electrical circuitry, and follow standard practices for preventing
accidents.

SSG 500M-series Installation and Configuration Guide
20 Before You Begin
Before You Begin
The location of the chassis, the layout of the equipment rack, and the security of
your wiring room are crucial for proper device operation.
Observing the following precautions can prevent shutdowns, equipment failures,
and injuries:
Before installation, always check that the power supply is disconnected from
any power source.
Ensure that the room in which you operate the device has adequate air
circulation and that the room temperature does not exceed 104° F (40°C).
Allow three feet (one meter) of clear space to the front and back of the device.
Do not place the device in an equipment-rack frame that blocks an intake or
exhaust port. Ensure that enclosed racks have fans and louvered sides.
This device exceeds 18 pounds (8.2 kilograms). Take precautions when lifting
and stabilizing the device.
Correct these hazardous conditions before any installation: moist or wet floors,
leaks, ungrounded or frayed power cables, or missing safety grounds.
Installing Equipment
You can rack-mount the SSG 550M-series device into a standard 19-inch equipment
rack. The device is shipped with mounting brackets. The equipment is suitable for
installation in locations where the National Electrical Code (NEC) applies, as well as
in Network Telecommunication Facilities.
You can center- or front-mount an SSG 500M-series device in a rack. In general, a
center-mount rack is preferable to a front-mount rack because the more even
distribution of weight in the center-mount rack provides greater stability.
To mount the device, you must have number-2 phillips screwdriver (not provided)
and four screws that are compatible with the equipment rack (not provided).
CAUTION: To prevent abuse and intrusion by unauthorized personnel, install the
device in a secure environment.
NOTE: If you are installing multiple devices in one rack, install the lowest one first and
proceed upward in the rack.
CAUTION: The device weighs between 23 lb. (10.4 kg) and 31 lb. (14.1 kg).
Installing it into the rack requires at least one person to lift the device and a
second person to secure the mounting screws.