Juniper SRX300 Series User manual

Quick Start
SRX300
IN THIS GUIDE
Step 1: Begin | 1
Step 2: Up and Running | 5
Step 3: Keep Going | 11
Step 1: Begin
IN THIS SECTION
Meet the SRX300 | 2
Install the SRX300 in a Rack | 2
Power On | 5
In this guide, we provide a simple, three-step path, to quickly get you up and running with your new SRX300. We’ve
simplified and shortened the installation and configuration steps, and included how-to videos. You’ll learn how to install
the SRX300 in a rack, power it up, and deploy it on your network.
NOTE: We think you'll want to check out our Guided Setup: SRX300 Line Firewalls. Our Guided Setup picks
up where this Day One+ ends, providing step-by-step instructions on how to easily secure and validate your
branch location.
Are you interested in getting hands-on experience with the topics and operations covered in this guide? Visit
Juniper Networks Virtual Labs and reserve your free sandbox today! You’ll find the Junos Day One Experience
sandbox in the stand alone category.

Meet the SRX300
The Juniper Networks®SRX300 Firewall provides next-generation security, routing, switching, and WAN connectivity in
a small desktop device. The SRX300 features eight 1GbE ports, including six RJ-45 network ports, and two small form-factor
pluggable (SFP) transceiver ports. It also has a USB 3.0 port (type A), and a console port (RJ-45+mini USB).
Install the SRX300 in a Rack
IN THIS SECTION
What’s in the Box? | 2
What Else Do I Need? | 2
Rack It | 3
You can install the SRX300 on a desktop, on a wall, or in a rack. This procedure shows you how to install it in a rack.
What’s in the Box?
•SRX300 Firewall
•A power cord appropriate for your geographic location
•A USB cable
What Else Do I Need?
DB-9 to RJ-45 cable or a DB-9 to RJ-45 adapter with a CAT5E copper cable—We no longer include a DB-9 to RJ-45 cable
or a DB-9 to RJ-45 adapter with a CAT5E copper cable as part of the device package. If you require a console cable, you
can order it separately with the part number JNP-CBL-RJ45-DB9 (DB-9 to RJ-45 adapter with a CAT5E copper cable).
2

To mount the SRX300 in a rack, you’ll need to order a rack mount kit appropriate for your installation. If you don’t have
a power supply adapter tray, order the SRX300-RMK0 rack mount kit. If you already have a power supply adapter tray,
order the SRX300-RMK1 rack mount kit.
The SRX300-RMK0 rack mount kit has:
•Twelve flat-head M3x5mm Phillips mounting screws
•One mounting bracket
•Power supply adapter tray and two adapter stopper brackets
The SRX300-RMK1 rack mount kit has:
•Eight flat-head M3x5mm Phillips mounting screws
•Two mounting brackets
You’ll also need:
•Someone to help you do the installation
•Rack mount screws appropriate for your rack
•A number two Phillips (+) screwdriver
Rack It
1. Review General Safety Guidelines and Warnings.
2. Wrap and fasten one end of the electrostatic discharge (ESD) grounding strap around your bare wrist, and connect the
other end to a site ESD point.
3. Attach the mounting bracket and power supply adapter tray to the sides of the SRX300 using the screws that came
with the rack mount kit and the number two Phillips (+) screwdriver.
3

4. Place the power supply adapter in the tray.
5. Lift the SRX300 and position it in the rack. Line up the bottom hole in the mounting brackets with a hole in each rack
rail, making sure the SRX300 is level.
6. While you’re holding the SRX300 in place, have a second person insert and tighten the rack mount screws to secure
the adapter tray and mounting brackets to the rack rails. Make sure to tighten the screws in the two bottom holes first
and then tighten the screws in the two top holes.
7. Check that the mounting brackets on each side of the rack are level.
4

Power On
Now that you’ve installed your SRX300 in the rack, you’re ready to connect it to power.
1. Wrap and fasten one end of the electrostatic discharge (ESD) grounding strap around your bare wrist, and connect the
other end to a site ESD point.
2. Plug the DC connector end of the power cable into the power connector at the back of the SRX300.
3. Plug the AC adapter end of the power cable into the power supply adapter.
4. If the AC power source outlet has a power switch, turn it off.
5. Plug in the power cord to the AC power outlet.
6. If the AC power outlet has a power switch, turn it on.
The SRX300 powers up as soon as you connect it to power. When the STAT LED on the front panel is lit solid green,
the SRX300 is ready to use.
Step 2: Up and Running
IN THIS SECTION
SRX300 Provisioning Options | 6
Initial Configuration Using the CLI | 6
Now that the SRX300 is powered on, let’s do some initial configuration to get it up and running on the network.
5

NOTE: Be sure to check out our Guided Setup: SRX300 Line Firewalls. Our Guided Setup picks up where this
Day One+ leaves off, providing step-by-step instructions on how to easily secure and validate your branch
location.
SRX300 Provisioning Options
It’s simple to provision and manage the SRX300 and other devices on your network. Choose the configuration tool that’s
right for you:
•Junos CLI commands. In this guide we show you how to configure the SRX300 with CLI commands that leverage the
plug and play factory defaults.
•J-Web, Juniper Networks GUI that is preinstalled on the SRX300. For information on performing initial configuration
using the J-Web setup wizard see Configure SRX Devices Using the J-Web Setup Wizard in the J-Web User Guide for
SRX Series Devices.
•Juniper Sky™ Enterprise, Juniper Networks-hosted public cloud-based Software as a Service (SaaS) solution. You’ll need
to have a Juniper Sky Enterprise subscription service before you can use it to configure the SRX300. For more information,
check out the Juniper Sky Enterprise Getting Started Guide.
•Contrail Service Orchestration (CSO). If you are using Junos OS Release 19.2 or earlier, you can use Juniper Networks
Network Service Controller to configure the SRX300 with ZTP. Network Service Controller is a component of CSO. See
Configure the Device Using ZTP with Juniper Networks Network Service Controller.
To use CSO, you’ll need an authentication code. See the Contrail Service Orchestration (CSO ) Deployment Guide.
Initial Configuration Using the CLI
IN THIS SECTION
Connect to the Serial Console Port | 7
Perform Initial Configuration | 8
Congratulations! Your SRX is Up and Running | 9
You can use the console port on the SRX to do the initial configuration. This section assumes you start from a factory
default configuration. See SRX300 Firewall Hardware Guide for details on the SRX300 factory default configuration.
6

After you configure the SRX300, you can log in on a local LAN port, or remotely over the WAN interface, to manage and
configure the SRX using the CLI or J-Web.
We recommend that you use the ge-0/0/0 interface for WAN connectivity on the SRX300. By default, this interface is
set to receive its Internet access configuration from the service provider.
NOTE: This examples assumes you are using DHCP to configure the WAN interface. If the WAN provider does
not support DHCP, you’ll need to manually configure the WAN interface and related static routing. See Junos
Initial Configuration.
Have this information handy before you begin the initial configuration:
•Root password
•Hostname
Connect to the Serial Console Port
1. Plug one end of the Ethernet cable into the RJ-45 to DB-9 serial port adapter for your SRX300.
NOTE: We no longer include a DB-9 to RJ-45 cable or a DB-9 to RJ-45 adapter with a CAT5E copper cable
as part of the device package. If you require a console cable, you can order it separately with the part number
JNP-CBL-RJ45-DB9 (DB-9 to RJ-45 adapter with a CAT5E copper cable).
2. Plug the RJ-45 to DB-9 serial port adapter into the serial port on the management device.
3. Connect the other end of the Ethernet cable to the serial console port on the SRX300.
SRX300
7

4. Start your asynchronous terminal emulation application (such as Microsoft Windows HyperTerminal) and select the
appropriate COM port to use (for example, COM1).
5. Verify that the serial port settings are set to the default:
•Baud rate—9600
•Parity—N
•Data bits—8
•Stop bits—1
•Flow control—none
NOTE: You can also connect to the SRX300 using a mini-USB console port. See the SRX300 Hardware Guide.
Perform Initial Configuration
1. Login as the root user and start the CLI. You don't need a password if you're running the factory default.
login: root
root@%cli
root>
NOTE: You can view the factory-default settings with the show configuration operational mode command.
2. Enter configuration mode.
root> configure
[edit]
root#
3. Since you're doing the initial configuration manually, you'll need to remove ZTP from the configuration. This stops the
periodic log messages that report on ZTP status.
Set the root authentication password and commit the change to deactivate ZTP.
[edit]
root# delete chassis auto-image-upgrade
root# delete system phone-home
root# set system root-authentication plain-text-password
New password: password
8

Retype new password: password
Issue the commit command to activate the candidate configuration that disables ZTP:
[edit]
root# commit
4. Enable root login over SSH, and allow SSH access over the WAN interface (ge-0/0/0).
[edit]
root# set system services ssh root-login allow
root# set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh
5. Configure the hostname.
[edit]
root# set system host-name host_name
6. That’s it! The initial configuration is complete. Commit the configuration to activate the changes on the SRX.
[edit]
root# commit
Congratulations! Your SRX is Up and Running
Your SRX300 is now online and providing secure Internet access to devices attached to the LAN ports. You can manage
the device locally and remotely, using the Junos CLI, J-Web, or a cloud based provisioning service. Here's what your
network looks like:
9

jn-000270
Sky Enterprise
Remote Management
Station
SRX300
(Factory Default
+ Initial CLI Config)
DHCP Clients
Internet
CSO
DHCP Server
UntrustTrust
ge-0/0/0
(DHCP Client)
SNAT
(DHCP Server
192.168.1.0/24)
Local Management
Station (Optional)
ge-0/0/1-6
A few things to keep in mind about your new SRX300 branch network:
•You access the SRX CLI or J-Web user interface locally using the 192.168.1.1 address. To access the SRX remotely,
specify the IP address assigned by the WAN provider. Simply issue a show interfaces ge-0/0/0 terse CLI command to
confirm the address in use by the WAN interface.
•Devices attached to the LAN ports are configured to use DHCP. They receive their network configuration from the
SRX. These devices obtain an IP address from the 192.168.1.0/24 address pool and use the SRX as their default gateway.
•All LAN ports are in the same subnet with Layer 2 connectivity. All traffic is permitted between trust zone interfaces.
•All traffic originating in the trust zone is permitted in the untrust zone. Matching response traffic is allowed back from
the untrust to the trust zone. Traffic that originates from the untrust zone is blocked from the trust zone.
•The SRX performs source NAT (S-NAT) using the WAN interface’s IP for traffic sent to the WAN that originated from
the trust zone.
•Traffic associated with specific system services (HTTPS, DHCP, TFTP, and SSH) is permitted from the untrust zone to
the local host. All local host services and protocols are allowed for traffic that originates from the trust zone.
If you’d like to quickly configure and validate a secure branch office, be sure to check out our Guided Setup: SRX300 Line
Firewalls.
10