Juniper NETWORK AND SECURITY MANAGER NSMXPRESS - ... User manual

Network and Security Manager
NSMXpress Quick Start
November 17, 2010
Revision 1
NSMXpress is an appliance version of Network and Security Manager (NSM). NSMXpress
simplifies the complexity of network administration by providing a single, integrated
management interface that controls device parameters.
This robust hardware management system installs in minutes with full high availability
(HA) support, making it easy to scale and deploy. Enterprise customers with limited
resources can benefit significantly from NSMXpress because it eliminates the need to
have dedicated resources for maintaining a network and security management solution.
NSMXpress makes it easy for administrators to control device configuration, network
settings, and security policy settings for multiple families of Juniper devices including:
•IDP Series Intrusion Detection and Prevention Appliances and Firewall and VPN devices
running ScreenOS
•Devices running Junos OS, such as J Series Services Routers, SRX Series Services
Gateways, EX Series Ethernet Switches, M Series Multiservice Edge Routers, and MX
Series Ethernet Services routers
•SA Series SSL VPN Appliances
•IC Series Unified Access Control Appliances
For a complete list of supported device families and platforms, see the Network and
Security Manager Administration Guide.
Up to 10 administrators can log into NSMXpress concurrently.
This quick start explains the following steps for installing and configuring NSMXpress
and for configuring NSM.
1. Install the NSMXpress appliance hardware.
2. Set up the NSMXpress appliance using the serial port.
1Copyright © 2010, Juniper Networks, Inc.

3. Configure the NSMXpress software using the Web interface.
4. Configure the NSM software which is preinstalled onto the NSMXpress appliance,
with site-specific parameters.
Contents HardwareInstallation.................................................4
NSMXpressPorts................................................4
InstallingtheHardware............................................5
InitialSetupConfiguration.............................................6
BootNSMXpress.................................................7
SetUpYourAppliance............................................7
WebInterfaceConfiguration....................................8
ConfiguringtheNSMSoftware.........................................8
ConfiguringBasicSettings.........................................9
ConfiguringHighAvailability........................................11
AdvancedOptions...............................................14
Enabling and Configuring Remote Replication of the Database . . . . . . . 15
Enabling and Configuring SRS (Regional Server Only) . . . . . . . . . . . . . . . 16
InstallingNSMSoftware..........................................17
ManagingNSMAdministration.........................................17
ChangingtheSuperuserPassword..................................17
Downloading NSM MIBS (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . 18
ExportingAuditLogs.............................................18
Exporting Device Logs (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . . . 18
Generating Reports (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
ModifyingNSMConfigurationFiles..................................19
BackingUptheNSMDatabase....................................20
ChangingtheNSMManagementIP.................................21
SchedulingSecurityUpdates......................................21
ManagingSystemAdministration......................................22
Rebooting or Shutting Down NSMXpress . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
ChangingtheUserPassword......................................23
ConfiguringtheNetwork..........................................23
NetworkInterfaces...........................................23
RoutingandGateways........................................24
HostnameandDNSClients...................................24
HostAddresses.............................................25
ManagingRADIUSServers........................................25
AddingaRADIUSServer......................................26
Changing the Priority of RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . . 27
DeletingaRADIUSServer.....................................27
Editing RADIUS Server Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
MonitoringwithSNMP...........................................28
SNMPConfiguration.........................................28
SNMPSystemInformation....................................29
SNMPTrapConfiguration.....................................30
Copyright © 2010, Juniper Networks, Inc.2
NSMXpress Quick Start

ForwardingSyslogMessages......................................31
ViewingSyslogReceivers......................................31
Adding and Configuring Syslog Receivers . . . . . . . . . . . . . . . . . . . . . . . . . 32
Editing Syslog Receiver Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
DeletingSyslogReceivers.....................................34
ChangingtheSystemTime.......................................34
InstallingUpdates...............................................34
ManagingUsers.................................................35
CreatingNewNSMXpressUsers................................35
DeletingaUser..............................................37
EditingUserAttributes........................................37
UnderstandingUserProfiles...................................37
ConfiguringtheWebInterface.....................................39
Maintaining NSMXpress .............................................39
ViewingSystemStatistics........................................39
CPU ......................................................40
LogRate...................................................40
CPULoad..................................................40
MemoryData...............................................40
Network Data ..............................................40
ProcessCount..............................................40
DiskData..................................................40
TileAllGraphs..............................................40
UpgradingtheRecoveryPartition...................................41
Troubleshooting ....................................................42
AuditingUserOperations.........................................42
Error Logs .....................................................43
NetworkUtilities................................................44
Ping ......................................................44
Traceroute .................................................45
Lookup....................................................46
IPSubnetCalculator.........................................46
TechSupport...................................................47
ViewingSystemInformation..........................................47
ListofTechnicalPublications.........................................48
RequestingTechnicalSupport........................................49
Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
OpeningaCasewithJTAC........................................50
RevisionHistory.....................................................51
3Copyright © 2010, Juniper Networks, Inc.

Hardware Installation
We recommend that you install NSMXpress on your LAN to ensure that it can
communicate with your applicable resources, such as authentication servers, DNS servers,
internal Web servers through HTTP/HTTPS, external Web sites through HTTP/HTTPS
(optional), the Juniper update server via HTTP, Network File System (NFS) file servers
(optional), and client/server applications (optional).
NOTE: If you decide to install NSMXpress in your DMZ, ensure that it can
connect to your internal resources.
NSMXpress Ports
Table 1 on page 4 provides required port information on the NSMXpress.
Table 1: Required Ports on NSMXpress
Depends on
ConfigurationInternetLANDescriptionPortDirection
NoNoYesSSH command-line management22In
NoNoYesWeb interface for administrator
login
443
YesYesLANWeb interface for listening for NSM
API messages.
8443
NoYesYesConnections from managed
devices to NSMXpress
7800
NoNoYesConnections from the NSM GUI
Client to NSM
7801
YesNoYesHeartbeat between peers in an HA
cluster
7802
YesYesYesConnections from managed IDP
devices to NSM
7803
YesYesYesConnections from devices running
Junos , Secure Access devices, or
Infranet Controller devices
7804
Copyright © 2010, Juniper Networks, Inc.4
NSMXpress Quick Start

Table 1: Required Ports on NSMXpress (continued)
Depends on
ConfigurationInternetLANDescriptionPortDirection
NoYesYesSSH connection to new managed
device
22Out
YesNoYesTelnet connection to new
managed device
23
NoNoYesDNS lookups53
YesYesNoSystem Security Updates from
Juniper Networks
80
YesNoYesShared Disk portmap lookup111
YesYesYesNetwork Time Protocol (NTP) time
synchronization
123
YesNoYesShared Disk NFS connection2049
For more information on ports, refer to the Network and Security Manager Installation
Guide.
Installing the Hardware
Follow these steps to unpack the NSMXpress appliance and connect it to your network.
To install NSMXpress:
1. Place the shipping container on a flat surface and remove the hardware components
with care.
2. Remove the NSMXpress device from the shipping container and place it on a flat
surface.
3. Mount NSMXpress in your server rack using the attached mounting brackets.
4. Plug the power cord into the AC receptacle on the rear panel.
If your NSMXpress contains two power supplies, plug a power cord into each AC
receptacle.
5. Plug the other end of the power cord into a wall socket.
If your NSMXpress contains two power supplies, plug each power cord into a separate
power circuit to ensure that the NSMXpress continues to receive power if one of the
power circuits fails.
6. Plug the Ethernet cable into the port marked ETH0 on the front panel. See Figure 1 on
page 6.
5Copyright © 2010, Juniper Networks, Inc.
Hardware Installation

Figure 1: Front Panel of NSMXpress
7. Plug the null modem serial cable into the console port. See Figure 1 on page 6.
This cable was shipped with your NSMXpress. If you do not have this cable, use any
other null modem serial cable.
8. Push the power button in the upper left corner of the front panel.
The green LED below the power button turns on. The NSMXpress hard disk LED turns
on whenever the appliance reads data from or writes data to an NSMXpress hard disk.
The internal port uses two LEDs to indicate the LAN connection status, which is
described in Table 2 on page 6.
Hardware installation is now complete. The next step is to set up the software, as
described in “Initial Setup Configuration” on page 6.
Table 2 on page 6 provides LED information for the ETH0 and ETH1 ports.
Table 2: Ethernet Port LEDs
LED2LED 1LAN Status
OffOff10 Mbps connection
OffGreen100 Mbps connection
OffOrange1000 Mbps connection
BlinkingOrange, Green, or OffData is being transferred
OffOffNo connection
Initial Setup Configuration
When you first turn on an unconfigured NSMXpress appliance, you need to enter basic
network and machine information through the serial console to make your appliance
accessible to the network. After entering these settings, you can continue configuring
the appliance using the CLI or the Web interface. You are not prompted for the initial
setup information again.
Copyright © 2010, Juniper Networks, Inc.6
NSMXpress Quick Start

This section describes the required serial console setup and the tasks you need to perform
when connecting to your NSMXpress for the first time:
•Boot NSMXpress on page 7
•Set Up Your Appliance on page 7
Boot NSMXpress
To configure NSMXpress for the first time, you must attach your NSMXpress appliance
to a console terminal running an emulation utility such as HyperTerminal.
1. Configure a console terminal or terminal emulation utility to use the following serial
connection parameters:
•9600 bits per second
•8-bit no parity (8N1)
•1 stop bit
•No flow control
2. Connect the terminal or laptop to the null modem serial cable plugged into the
NSMXpress console port.
3. Turn on the NSMXpress appliance.
When NSMXpress is powered on, the serial console displays diagnostic information
before proceeding to the boot countdown. When complete, the serial console displays
the login prompt terminal emulator.
NSMXpress.juniper.net login:
4. Enter admin as your default login name.
5. Enter abc123 as your default password.
6. Change your default password when prompted. Enter the default password first,
followed by your new password. All passwords are case-sensitive.
Set Up Your Appliance
This section provides the minimum information necessary to make your appliance active
on the network.
To set up your appliance either as a regional server or a central manager, follow these
steps:
1. Enter the IP address for interface eth0 and press Enter.
2. Enter the subnet mask for interface eth0 and press Enter.
3. Enter the default route or default gateway address for interface eth0 and press Enter.
Applying changes...
Re-loading database
ip_tables: (C) 2000–2002 Netfilter core team
ip_tables: (C) 2000–2002 Netfilter core team
7Copyright © 2010, Juniper Networks, Inc.
Initial Setup Configuration

ip_tables: (C) 2000–2002 Netfileter core team
Done!
Your NSMXpress is now active on the network.
To configure your system via a web browser, connect to:
https://10.150.43.205/admin
To configure your system via command line, type:
nsm_setup
For operation of NSM server, switch to user “nsm”.
Please consult NSM product documentation for details.
[admin@NSMXpress ~]$
To configure the NSM software using the CLI, see the NSMXpress User Guide. To configure
the NSM software using the Web interface, go to “Web Interface Configuration” on
page 8.
Web Interface Configuration
To configure NSM on your system from a Web interface, use the following steps.
1. Copy the URL (starting with https://) from the terminal emulator after installing
NSMXpress:
Your NSMXpress is now active on the network.
To configure your system via a web browser, connect to:
https//10.150.43.205/administration
2. Open a Web browser and paste the URL into the address text box.
3. Press Enter to open the NSMXpress login page.
4. Enter the admin user name and password and then click Login.
5. See “Configuring the NSM Software” on page 8 for details about how to install and
configure NSM on your NSMXpress appliance from the Web interface.
Configuring the NSM Software
After logging in as an ‘admin’ user, an initial setup script walks you through additional
configuration system settings before finalizing the NSM installation. This chapter describes
that setup process.
Your NSMXpress appliance comes preconfigured as a regional server or a central manager.
Most installation and configuration steps in this section are identical for both types of
server. All exceptions are noted.
Copyright © 2010, Juniper Networks, Inc.8
NSMXpress Quick Start

After logging into the NSMXpress Web interface, NSMXpress provides you with the
following installation options:
•Configuring Basic Settings on page 9
•Configuring High Availability on page 11
•Advanced Options on page 14
•Installing NSM Software on page 17
Configuring Basic Settings
To install the regional server or central manager software using the minimum
requirements:
1. Install your NSMXpress hardware as described in “Hardware Installation” on page 4.
2. Boot and setup your NSMXpress appliance as described in “Initial Setup Configuration”
on page 6.
3. Enter the https://<ip>/administration URL for your appliance in a Web browser. See
“Web Interface Configuration” on page 8 for details.
4. Log into the Web interface. The System Info page opens.
5. Click the link Install NSM Regional Server (see Figure 2 on page 10) to go to the Install
Regional Server window or click the Install NSM Central Manager link to view the Install
NSM Central Manager window (see Figure 3 on page 10), as the case may be.
NOTE: The “admin” user default username is admin and the password is
the one you created in Step 6 of “Boot NSMXpress” on page 7.
9Copyright © 2010, Juniper Networks, Inc.
Configuring the NSM Software

Figure 2: Regional Server Configuration Main Menu
Figure 3: Central Manager Configuration Main Menu
Copyright © 2010, Juniper Networks, Inc.10
NSMXpress Quick Start