Juniper Junos OS User manual

Junos®OS
Getting Started Guide for Branch SRX Series
Release
12.3X48-D10
Modified: 2016-09-01
Copyright © 2016, Juniper Networks, Inc.

Juniper Networks, Inc.
1133 Innovation Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other
trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify,
transfer, or otherwise revise this publication without notice.
Junos®OS Getting Started Guide for Branch SRX Series
12.3X48-D10
Copyright © 2016, Juniper Networks, Inc.
All rights reserved.
The information in this document is current as of the date on the title page.
YEAR 2000 NOTICE
Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the
year 2038. However, the NTP application is known to have some difficulty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks
software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at
http://www.juniper.net/support/eula.html. By downloading, installing or using such software, you agree to the terms and conditions of
that EULA.
Copyright © 2016, Juniper Networks, Inc.ii

Table of Contents
AbouttheDocumentation............................................xi
DocumentationandReleaseNotes..................................xi
SupportedPlatforms.............................................xi
UsingtheExamplesinThisManual..................................xi
MergingaFullExample.......................................xii
MergingaSnippet............................................xii
DocumentationConventions......................................xiii
DocumentationFeedback.........................................xv
RequestingTechnicalSupport.....................................xv
Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
OpeningaCasewithJTAC.....................................xvi
Part 1 Overview
Chapter 1 Introduction to SRX Series Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
SRXSeriesOverview.................................................3
Part 2 Setting Up a Branch SRX Series Services Gateway
Chapter 2 Understanding Factory Default Configuration Settings . . . . . . . . . . . . . . . . . . 7
Understanding Factory Default Configuration Settings of an SRX210 . . . . . . . . . . . 7
DefaultConfigurationTopology.....................................7
DefaultPortSettings.............................................8
Default Settings for Interfaces, Zones, Policy, and NAT . . . . . . . . . . . . . . . . . . . 9
DefaultSystemServices..........................................10
Autoinstallation.................................................10
SRX210 Factory Default Settings—A Sample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Chapter 3 Configuring an SRX Series Device for the First Time . . . . . . . . . . . . . . . . . . . . 17
Understanding Methods to Manage the Branch SRX Series . . . . . . . . . . . . . . . . . . 17
Mandatory Settings to Configure the Branch SRX Series . . . . . . . . . . . . . . . . . . . . 18
Connecting the Branch SRX Series Through the Console Port for the First
Time..........................................................19
Configuring a Hostname to Identify a Branch SRX Series Services Gateway in
Your Network ..................................................20
Configuring Internet Access for the Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . 21
Configuring a Network Time Protocol Server for the Branch SRX Series . . . . . . . . 22
Validating the Branch SRX Series Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Verifying the Branch SRX Series Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
iiiCopyright © 2016, Juniper Networks, Inc.

Chapter 4 Resetting the SRX Series Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
ResettingtheBranchSRXSeries.......................................27
ResettingYourBranchSRXSeries..................................27
Resetting Your SRX Series to a Rescue Configuration . . . . . . . . . . . . . . . 27
Resetting Your SRX Series to Factory Settings . . . . . . . . . . . . . . . . . . . . . 27
Part 3 Configuring Basic SRX Series Features
Chapter 5 Configuring Security Zones and Policies for SRX Series . . . . . . . . . . . . . . . . . 31
Understanding Security Zones and Policies for SRX Series . . . . . . . . . . . . . . . . . . 31
Zones .........................................................31
SecurityPolicy..................................................32
Example: Configuring Security Zones and Policies for SRX Series . . . . . . . . . . . . . 32
Chapter6 ConfiguringNATforSRXSeries.....................................39
UnderstandingNATforSRXSeries.....................................39
Example: Configuring Destination NAT for SRX Series . . . . . . . . . . . . . . . . . . . . . 40
Chapter 7 Managing Licenses for SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Updating Licenses for a Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Chapter 8 Configuring UTM for Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Understanding Unified Threat Management for Branch SRX Series . . . . . . . . . . . 49
Example: Configuring Unified Threat Management for a Branch SRX Series . . . . . 51
Default UTM Policy for Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
DefaultUTMPolicy..............................................54
Predefined UTM Profile Configuration for Branch SRX Series . . . . . . . . . . . . . . . . 54
Antispam......................................................54
Antivirus ......................................................55
WebFiltering...................................................56
Chapter 9 Configuring Intrusion Detection and Prevention for SRX Series . . . . . . . . . 63
Understanding Intrusion Detection and Prevention for SRX Series . . . . . . . . . . . . 63
Example: Configuring Intrusion Detection and Prevention for SRX Series . . . . . . 64
Chapter 10 Understanding Stateful Firewall, IPsec VPN, and Chassis Cluster for
BranchSRXSeries.................................................71
Understanding Branch SRX Series Stateful Firewall Functionality . . . . . . . . . . . . . 71
Understanding IPsec VPN for SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Understanding Chassis Cluster for SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Part 4 Configuration Statements and Operational Commands
Chapter11 ConfigurationStatements..........................................75
Security Configuration Statement Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
[edit security address-book] Hierarchy Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
[editsecurityidp]HierarchyLevel......................................77
[editsecurityike]HierarchyLevel......................................87
[editsecurityipsec]HierarchyLevel....................................88
[editsecuritynat]HierarchyLevel.....................................90
[edit security policies] Hierarchy Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Copyright © 2016, Juniper Networks, Inc.iv
Getting Started Guide for Branch SRX Series

[editsecurityutm]HierarchyLevel.....................................98
[edit security zones] Hierarchy Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Chapter12 OperationalCommands...........................................107
requestsystemlicenseupdate.......................................108
showsecurityflowsession...........................................109
showsecurityidpactive-policy........................................115
showsecurityidpstatus.............................................116
show security nat destination summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
showsecuritypolicies...............................................120
showsecurityutmsession...........................................128
showsecurityutmstatus............................................129
showsecurityzones................................................130
showsystemlicense(View)..........................................133
showsystemservicesdhcpclient.....................................136
Part 5 Index
Index .........................................................141
vCopyright © 2016, Juniper Networks, Inc.
Table of Contents

Copyright © 2016, Juniper Networks, Inc.vi
Getting Started Guide for Branch SRX Series

List of Figures
Part 2 Setting Up a Branch SRX Series Services Gateway
Chapter 2 Understanding Factory Default Configuration Settings . . . . . . . . . . . . . . . . . . 7
Figure1:SRX210DeploymentTopology..................................8
Chapter 3 Configuring an SRX Series Device for the First Time . . . . . . . . . . . . . . . . . . . . 17
Figure 2: Connecting an SRX210 to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Part 3 Configuring Basic SRX Series Features
Chapter 5 Configuring Security Zones and Policies for SRX Series . . . . . . . . . . . . . . . . . 31
Figure 3: Topology for Security Policy Configuration . . . . . . . . . . . . . . . . . . . . . . . . 33
Chapter6 ConfiguringNATforSRXSeries.....................................39
Figure 4: Destination NAT Single Address Translation . . . . . . . . . . . . . . . . . . . . . . . 41
viiCopyright © 2016, Juniper Networks, Inc.

Copyright © 2016, Juniper Networks, Inc.viii
Getting Started Guide for Branch SRX Series

List of Tables
AbouttheDocumentation..........................................xi
Table1:NoticeIcons.................................................xiii
Table 2: Text and Syntax Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Part 2 Setting Up a Branch SRX Series Services Gateway
Chapter 2 Understanding Factory Default Configuration Settings . . . . . . . . . . . . . . . . . . 7
Table3:DefaultInterfacesSettings.....................................9
Table 4: Default Security Policy Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Table5:DefaultNATSettings.........................................10
Chapter 3 Configuring an SRX Series Device for the First Time . . . . . . . . . . . . . . . . . . . . 17
Table 6: Settings Used to Configure the SRX210 . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Part 3 Configuring Basic SRX Series Features
Chapter 5 Configuring Security Zones and Policies for SRX Series . . . . . . . . . . . . . . . . . 31
Table 7: Factory-Default Settings for Security Policies for Branch SRX Series
Devices .......................................................32
Table8:AddressBooksConfiguration...................................33
Table 9: Security Policy Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Chapter6 ConfiguringNATforSRXSeries.....................................39
Table10:DestinationNATMapping.....................................41
Chapter 8 Configuring UTM for Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Table 11: Default UTM Profiles on Branch SRX Series . . . . . . . . . . . . . . . . . . . . . . . 50
Part 4 Configuration Statements and Operational Commands
Chapter12 OperationalCommands...........................................107
Table 12: show security flow session Output Fields . . . . . . . . . . . . . . . . . . . . . . . . 110
Table 13: show security idp active-policy Output Fields . . . . . . . . . . . . . . . . . . . . . 115
Table 14: show security idp status Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Table 15: show security nat destination summary Output Fields . . . . . . . . . . . . . 118
Table 16: show security policies Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Table 17: show security zones Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Table 18: show system license Output Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Table 19: show system services dhcp client Output Fields . . . . . . . . . . . . . . . . . . 136
ixCopyright © 2016, Juniper Networks, Inc.

Copyright © 2016, Juniper Networks, Inc.x
Getting Started Guide for Branch SRX Series

About the Documentation
•Documentation and Release Notes on page xi
•Supported Platforms on page xi
•Using the Examples in This Manual on page xi
•Documentation Conventions on page xiii
•Documentation Feedback on page xv
•Requesting Technical Support on page xv
Documentation and Release Notes
To obtain the most current version of all Juniper Networks®technical documentation,
see the product documentation page on the Juniper Networks website at
http://www.juniper.net/techpubs/.
If the information in the latest release notes differs from the information in the
documentation, follow the product Release Notes.
Juniper Networks Books publishes books by Juniper Networks engineers and subject
matter experts. These books go beyond the technical documentation to explore the
nuances of network architecture, deployment, and administration. The current list can
be viewed at http://www.juniper.net/books.
Supported Platforms
For the features described in this document, the following platforms are supported:
•SRX Series
Using the Examples in This Manual
If you want to use the examples in this manual, you can use the load merge or the load
merge relative command. These commands cause the software to merge the incoming
configuration into the current candidate configuration. The example does not become
active until you commit the candidate configuration.
If the example configuration contains the top level of the hierarchy (or multiple
hierarchies), the example is a full example. In this case, use the load merge command.
xiCopyright © 2016, Juniper Networks, Inc.

If the example configuration does not start at the top level of the hierarchy, the example
isasnippet. In this case, use the load merge relative command. These procedures are
described in the following sections.
Merging a Full Example
To merge a full example, follow these steps:
1. From the HTML or PDF version of the manual, copy a configuration example into a
text file, save the file with a name, and copy the file to a directory on your routing
platform.
For example, copy the following configuration to a file and name the file ex-script.conf.
Copy the ex-script.conf file to the /var/tmp directory on your routing platform.
system {
scripts {
commit {
file ex-script.xsl;
}
}
}
interfaces {
fxp0 {
disable;
unit 0 {
family inet {
address 10.0.0.1/24;
}
}
}
}
2. Merge the contents of the file into your routing platform configuration by issuing the
load merge configuration mode command:
[edit]
user@host# load merge /var/tmp/ex-script.conf
load complete
Merging a Snippet
To merge a snippet, follow these steps:
1. From the HTML or PDF version of the manual, copy a configuration snippet into a text
file, save the file with a name, and copy the file to a directory on your routing platform.
For example, copy the following snippet to a file and name the file
ex-script-snippet.conf. Copy the ex-script-snippet.conf file to the /var/tmp directory
on your routing platform.
commit {
file ex-script-snippet.xsl; }
2. Move to the hierarchy level that is relevant for this snippet by issuing the following
configuration mode command:
Copyright © 2016, Juniper Networks, Inc.xii
Getting Started Guide for Branch SRX Series

[edit]
user@host# edit system scripts
[edit system scripts]
3. Merge the contents of the file into your routing platform configuration by issuing the
load merge relative configuration mode command:
[edit system scripts]
user@host# load merge relative /var/tmp/ex-script-snippet.conf
load complete
For more information about the load command, see CLI Explorer.
Documentation Conventions
Table 1 on page xiii defines notice icons used in this guide.
Table 1: Notice Icons
DescriptionMeaningIcon
Indicates important features or instructions.Informational note
Indicates a situation that might result in loss of data or hardware damage.Caution
Alerts you to the risk of personal injury or death.Warning
Alerts you to the risk of personal injury from a laser.Laser warning
Indicates helpful information.Tip
Alerts you to a recommended use or implementation.Best practice
Table 2 on page xiii defines the text and syntax conventions used in this guide.
Table 2: Text and Syntax Conventions
ExamplesDescriptionConvention
To enter configuration mode, type the
configure command:
user@host> configure
Represents text that you type.Bold text like this
xiiiCopyright © 2016, Juniper Networks, Inc.
About the Documentation

Table 2: Text and Syntax Conventions (continued)
ExamplesDescriptionConvention
user@host> show chassis alarms
No alarms currently active
Represents output that appears on the
terminal screen.
Fixed-width text like this
•A policy term is a named structure
that defines match conditions and
actions.
•Junos OS CLI User Guide
•RFC 1997, BGP Communities Attribute
•Introduces or emphasizes important
new terms.
•Identifies guide names.
•Identifies RFC and Internet draft titles.
Italic text like this
Configure the machine’s domain name:
[edit]
root@# set system domain-name
domain-name
Represents variables (options for which
you substitute a value) in commands or
configuration statements.
Italic text like this
•To configure a stub area, include the
stub statement at the [edit protocols
ospf area area-id] hierarchy level.
•The console port is labeled CONSOLE.
Represents names of configuration
statements, commands, files, and
directories; configuration hierarchy levels;
or labels on routing platform
components.
Text like this
stub <default-metric metric>;Encloses optional keywords or variables.< > (angle brackets)
broadcast | multicast
(string1 |string2 |string3)
Indicates a choice between the mutually
exclusive keywords or variables on either
side of the symbol. The set of choices is
often enclosed in parentheses for clarity.
| (pipe symbol)
rsvp { # Required for dynamic MPLS onlyIndicates a comment specified on the
same line as the configuration statement
to which it applies.
# (pound sign)
community name members [
community-ids ]
Encloses a variable for which you can
substitute one or more values.
[ ] (square brackets)
[edit]
routing-options {
static {
route default {
nexthop address;
retain;
}
}
}
Identifies a level in the configuration
hierarchy.
Indention and braces ( { } )
Identifies a leaf statement at a
configuration hierarchy level.
; (semicolon)
GUI Conventions
•In the Logical Interfaces box, select
All Interfaces.
•To cancel the configuration, click
Cancel.
Represents graphical user interface (GUI)
items you click or select.
Bold text like this
Copyright © 2016, Juniper Networks, Inc.xiv
Getting Started Guide for Branch SRX Series

Table 2: Text and Syntax Conventions (continued)
ExamplesDescriptionConvention
In the configuration editor hierarchy,
select Protocols>Ospf.
Separates levels in a hierarchy of menu
selections.
>(bold right angle bracket)
Documentation Feedback
We encourage you to provide feedback, comments, and suggestions so that we can
improve the documentation. You can provide feedback by using either of the following
methods:
•Online feedback rating system—On any page of the Juniper Networks TechLibrary site
at http://www.juniper.net/techpubs/index.html, simply click the stars to rate the content,
and use the pop-up form to provide us with information about your experience.
Alternately, you can use the online feedback form at
http://www.juniper.net/techpubs/feedback/.
•E-mail—Send your comments to [e-mail]. Include the document
or topic name, URL or page number, and software version (if applicable).
Requesting Technical Support
Technical product support is available through the Juniper Networks Technical Assistance
Center (JTAC). If you are a customer with an active J-Care or Partner Support Service
support contract, or are covered under warranty, and need post-sales technical support,
you can access our tools and resources online or open a case with JTAC.
•JTAC policies—For a complete understanding of our JTAC procedures and policies,
review the JTAC User Guide located at
http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf.
•Product warranties—For product warranty information, visit
http://www.juniper.net/support/warranty/.
•JTAC hours of operation—The JTAC centers have resources available 24 hours a day,
7 days a week, 365 days a year.
Self-Help Online Tools and Resources
For quick and easy problem resolution, Juniper Networks has designed an online
self-service portal called the Customer Support Center (CSC) that provides you with the
following features:
•Find CSC offerings: http://www.juniper.net/customers/support/
•Search for known bugs: http://www2.juniper.net/kb/
•Find product documentation: http://www.juniper.net/techpubs/
•Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/
xvCopyright © 2016, Juniper Networks, Inc.
About the Documentation

•Download the latest versions of software and review release notes:
http://www.juniper.net/customers/csc/software/
•Search technical bulletins for relevant hardware and software notifications:
http://kb.juniper.net/InfoCenter/
•Join and participate in the Juniper Networks Community Forum:
http://www.juniper.net/company/communities/
•Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/
To verify service entitlement by product serial number, use our Serial Number Entitlement
(SNE) Tool: https://tools.juniper.net/SerialNumberEntitlementSearch/
Opening a Case with JTAC
You can open a case with JTAC on the Web or by telephone.
•Use the Case Management tool in the CSC at http://www.juniper.net/cm/.
•Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).
For international or direct-dial options in countries without toll-free numbers, see
http://www.juniper.net/support/requesting-support.html.
Copyright © 2016, Juniper Networks, Inc.xvi
Getting Started Guide for Branch SRX Series

PART 1
Overview
•Introduction to SRX Series Devices on page 3
1Copyright © 2016, Juniper Networks, Inc.

Copyright © 2016, Juniper Networks, Inc.2
Getting Started Guide for Branch SRX Series

CHAPTER 1
Introduction to SRX Series Devices
•SRX Series Overview on page 3
SRX Series Overview
Juniper Networks SRX Series Services Gateways provide high-performance security,
routing, and network solutions for enterprise and service providers. The SRX Series pack
high port density, advanced security, and flexible connectivity into a single, easily managed
platform that supports fast, secure, and highly available data center and branch
operations.
The SRX Series are based on Junos OS, a full-featured networking operating system that
is optimized to provide maximum performance and efficient network security.
The SRX Series range from lower-end branch devices designed to secure small distributed
enterprise locations to high-end devices designed to secure enterprise infrastructure,
data centers, and server farms. The branch SRX Series include the SRX100, SRX110,
SRX210, SRX220, SRX240, SRX550, and SRX650 devices.
Related
Documentation
•Understanding Factory Default Configuration Settings of an SRX210 on page 7
•Understanding Methods to Manage the Branch SRX Series on page 17
3Copyright © 2016, Juniper Networks, Inc.

Copyright © 2016, Juniper Networks, Inc.4
Getting Started Guide for Branch SRX Series