NetScreen Technologies 5GT User manual

NETSCREEN-5GT
User’s Guide
In English, Spanish, Japanese, Simplified Chinese, and
Traditional Chinese
Version 5.0.0 P/N 093-0987-000 Rev. B

Copyright Notice
Copyright © 2003 NetScreen Technologies, Inc. All rights reserved.
NetScreen, NetScreen Technologies, GigaScreen, and the NetScreen logo are registered trademarks of NetScreen
Technologies, Inc. NetScreen-5GT, NetScreen-5XP, NetScreen-5XT, NetScreen-25, NetScreen-50, NetScreen-100,
NetScreen-204, NetScreen-208, NetScreen-500, NetScreen-5200, NetScreen-5400, NetScreen-Global PRO, NetScreen-
Global PRO Express, NetScreen-Remote Security Client, NetScreen-Remote VPN Client, NetScreen-IDP 10, NetScreen-
IDP 100, NetScreen-IDP 500, GigaScreen ASIC, GigaScreen-II ASIC, and NetScreen ScreenOS are trademarks of
NetScreen Technologies, Inc. All other trademarks and registered trademarks are the property of their respective
companies.
Information in this document is subject to change without notice.
No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any
purpose, without receiving written permission from:
NetScreen Technologies, Inc.
Building #3
805 11th Avenue
Sunnyvale, CA 94089
www.netscreen.com
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply
with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide
reasonable protection against harmful interference when the equipment is operated in a commercial environment. The
equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the
instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a
residential area is likely to cause harmful interference, in which case users will be required to correct the interference at
their own expense.
The following information is for FCC compliance of Class B devices: The equipment described in this manual generates
and may radiate radio-frequency energy. If it is not installed in accordance with NetScreen’s installation instructions, it
may cause interference with radio and television reception. This equipment has been tested and found to comply with the
limits for Class B digital devices in accordance with the specifications in part 15 of the FCC rules. These specifications are
designed to provide reasonable protection against such interference in a residential installation. However, there is no
guarantee that interference will not occur in a particular installation.
If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the
equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Consult the dealer or an experienced radio/TV technician for help.
• Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH
IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY
THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR NETSCREEN REPRESENTATIVE FOR A COPY.

NetScreen-5GT iii
Language Contents
English ..................................................................................................................... 1
Spanish .................................................................................................................. 21
Japanese .............................................................................................................. 43
Simplified Chinese ................................................................................................. 63
Traditional Chinese ................................................................................................ 83

Language Contents
iv User’s Guide

NetScreen-5GT 1
Contents
Preface ................................................................................................................... 3
Organization ............................................................................................... 3
CLI Conventions .......................................................................................... 3
NetScreen Publications ............................................................................... 4
Chapter 1 Connecting the Device......................................................................... 5
Connecting the NetScreen Device to the Network ..................................... 5
Connecting the Power ................................................................................ 5
Rack Mounting (Optional) .......................................................................... 5
Chapter 2 Configuring the Device ......................................................................... 7
Default Settings ........................................................................................... 8
Accessing the Device ............................................................................... 11
Configuring the Untrust Interface .............................................................. 13
Changing Your Login Name and Password .............................................. 14
Verifying External Connectivity ................................................................. 14
Resetting the Device to Factory Defaults .................................................. 14
Chapter 3 Hardware Descriptions ........................................................................ 17
Port and Power Connectors ...................................................................... 17
Status LEDs ................................................................................................ 18
Appendix A Specifications.................................................................................... 19

Contents
2User’s Guide

NetScreen-5GT 3
Preface
The NetScreen-5GT device provides IPSec VPN and firewall services for a broadband
telecommuter, a branch office, or a retail outlet. While at the entry level of the NetScreen
appliance product line, the NetScreen-5GT device uses the same firewall, VPN, and traffic
management technology as NetScreen’s high-end central site products.
NetScreen offers three versions of the NetScreen-5GT device:
•The 10-user version supports up to 10 users.
•The Plus version supports an unrestricted number of users.
•The Extended version provides the same capabilities as the Plus version with
additional features: High Availability (NSRP Lite), the DMZ security zone, and
additional sessions and tunnel capacity.
ORGANIZATION
This manual has three chapters and one appendix.
Chapter 1, “Connecting the Device” describes how to install the NetScreen-5GT device in
a rack, connect the device to your network, and connect the power.
Chapter 2, “Configuring the Device” describes the default settings and operation of the
NetScreen-5GT and the configuration required to use the device with its default settings.
Chapter 3, “Hardware Descriptions” provides an overview of the NetScreen-5GT ports,
LEDs, and power requirements.
Appendix A, “Specifications” provides a list of physical specifications about the NetScreen-
5GT device.
CLI CONVENTIONS
The following conventions are used when presenting the syntax of a command line
interface (CLI) command:
•Anything inside square brackets [ ] is optional.
•Anything inside braces { } is required.
•If there is more than one choice, each choice is separated by a pipe ( | ). For
example,
set interface { ethernet1 | ethernet2 | ethernet3 }
manage
means “set the management options for the ethernet1, ethernet2, or ethernet3
interface”.

Preface
4User’s Guide
•Variables appear in italic. For example:
set admin user name password
When a CLI command appears within the context of a sentence, it is in bold (except for
variables, which are always in italic). For example: “Use the get system command to
display the serial number of a NetScreen device.”
NETSCREEN PUBLICATIONS
To obtain technical documentation for any NetScreen product, visit:
www.netscreen.com/resources/manuals/.
To obtain the latest software version, visit: www.netscreen.com/services/download_soft.
Select a category of software product from the dropdown list, then follow the displayed
instructions. (You must be a registered user to download NetScreen software.)
If you find any errors or omissions in the following content, please contact us at the e-mail
address below:
[email protected]
Note: When typing a keyword, you only have to type enough letters to identify the word
uniquely. For example, typing set adm u joe j12fmt54 is enough to enter the command
set admin user joe j12fmt54. Although you can use this shortcut when entering
commands, all the commands documented here are presented in their entirety.

NetScreen-5GT 5
1
Chapter 1
Connecting the Device
This chapter describes how to connect a NetScreen-5GT device to the network and connect
the power. If you are using the optional NetScreen-5GT rack mount kit, rack mounting
instructions are included at the end of this chapter.
CONNECTING THE NETSCREEN DEVICE TO THE NETWORK
You can establish a high-speed connection to an external router, DSL modem, or cable
modem, and provide firewall and general security for your network. Connect the provided
Ethernet cable from the Untrusted port on the NetScreen-5GT device to the external
router or modem.
The NetScreen-5GT device contains four trusted ports. You can use one of these ports to
connect the device to a LAN via an internal switch or hub. You can also connect one or all
of the ports directly to workstations, eliminating the need for a hub or switch. You can use
either cross-over or straight-through cables to connect NetScreen-5GT ports to other
devices.
CONNECTING THE POWER
To connect the power to the NetScreen-5GT device:
1. Plug the DC connector end of the power cable into the DC power receptacle on
the back of the device.
2. Plug the AC adapter end of the power cable into an AC power source.
RACK MOUNTING (OPTIONAL)
With a NetScreen-5GT rack-mount kit, you can mount one or two NetScreen-5GT devices
in a standard 19-inch equipment rack. The NetScreen-5GT rack-mount kit includes these
instructions and a rack-mounting tray. The dimensions of the tray are as follows:
•Width: 19 inches
•Height: 1 5/8 inches; that is, 1 RU (rack unit)
•Depth: 10 3/4 inches
Note: For safety warnings and instructions, refer to the NetScreen Safety Guide. The
instructions in this guide warn you about situations that could cause bodily injury. Before
working on any equipment, be aware of the hazards involved with electrical circuitry and
be familiar with standard practices for preventing accidents.
Warning: NetScreen recommends using a surge protector for the power connection.

Chapter 1 Connecting the Device
6User’s Guide
In addition to a NetScreen-5GT device, rack-mount kit, and equipment rack, you also
need the following:
•Phillips-head screwdriver
•Four screws that match the thread size of the equipment rack
To mount the device in a rack:
1. Use the Phillips-head screwdriver to remove the two screws from the underside
of each NetScreen-5GT device that you intend to mount. The screws are located
on the underside of the NetScreen-5GT near the front panel. (Keep the screws
for use in the next step.)
2. Insert the NetScreen-5GT devices on the rack-mount tray and screw them to the
tray with the screws that you removed in step 1.
3. Screw the left and right tray plates to the equipment rack.
You can run power cords and ethernet cables through the openings in the floor of the tray
or out the depressions in the back wall. You can also use the space behind the devices to
hold power supplies. The switching power supplies, which you can order separately, fit
easily in a 1-RU height space.
Remove the screws.
Insert the devices
on the tray.
Screw the devices
to the tray.
Screw the tray
to the rack.

NetScreen-5GT 7
2
Chapter 2
Configuring the Device
This chapter describes how to configure a NetScreen-5GT after you have installed and
connected it to your network and to a power source. After completing the necessary
configurations, users in your network will be able to access the Internet through the
NetScreen device while resources in your network are protected from outside computers.
Note: You must register your product at www.netscreen.com/cso so that certain ScreenOS
services, such as internal antivirus or Deep Inspection Signature Service, can be activated
on the device. After registering your product, use the WebUI or CLI to obtain the
subscription for the service. For more information about registering your product and
obtaining subscriptions for specific services, see the “System Parameters” chapter in
Volume 2 of the NetScreen Concepts & Examples ScreenOS Reference Guide.
Note: If you access the device for the first time using the ScreenOS WebUI graphical
interface, the Initial Configuration Wizard appears when you log in to the WebUI. This
Wizard guides you through the configuration described in this chapter. For more
information about starting the Initial Configuration Wizard, refer to the Getting Started
Guide for the NetScreen-5GT.

Chapter 2 Configuring the Device
8User’s Guide
DEFAULT SETTINGS
This section describes the default settings and operation of the NetScreen-5GT as it is
shipped from the factory. These default settings are such that, in most cases, there are
only a few items that you must configure. The figure below shows the default
configuration for the NetScreen-5GT.
The Untrust interface is bound to the Untrust zone and is configured with the IP address
0.0.0.0/0. To allow the NetScreen device (and the devices on your network) to connect to
the Internet, you must configure the Untrust interface according to information obtained
from your Internet Service Provider (ISP). Refer to “Untrust Interface Address” on page 9.
Any user in the subnetwork can manage the NetScreen device if they know the login and
password. To change the default login and password, refer to “Login and Password” on
page 9. To restrict management of the NetScreen device to specific workstations, refer to
“Restricting Management” on page 10.
The Trust interface is bound to the Trust zone and is configured with the subnetwork
address 192.168.1.1/24. This means that all devices in your network that you connect to
the Trust interface must be in the same subnetwork and have IP addresses in that
subnetwork. The NetScreen device is also configured to assign IP addresses for the
192.168.1.1/24 subnetwork to your devices. For more information, refer to “Trust Interface
Address” on page 10.
The NetScreen device allows any type of traffic to the Internet that originates from
devices in your network, but does not allow any traffic that originates in the Internet to
reach your network. You can configure additional restrictions; refer to “Additional
Policies” on page 11.
Trust Interface
192.168.1.1/24
Untrust Interface
0.0.0.0/0
Trust Zone
Untrust Zone
To Internet
The NetScreen device
assigns IP addresses to
devices in your network
via DHCP. Addresses are
in the range 192.168.1.33
- 192.168.1.126.
WebUI and Telnet access to the NetScreen device allowed from any device in the subnetwork.
All types of traffic
originated from your
network is allowed to the
Internet, but traffic
originated from the
Internet is not allowed to
your network. External Router
Hub

Default Settings
NetScreen-5GT 9
Required Configuration
This section describes the configurations that you must complete to use the NetScreen-
5GT with its default settings.
Untrust Interface Address
You must configure an IP address for the Untrust interface to enable the NetScreen
device to connect to the Internet. This IP address represents your network to the outside
world and is obtained from your Internet Service Provider (ISP) in one of the following
ways:
•Your ISP gives you a specific, fixed IP address and netmask for your network.
•Your network receives an IP address from a server via Dynamic Host
Configuration Protocol (DHCP).
•Your network receives an IP address from a server via Point-to-Point Protocol
over Ethernet (PPPoE).
See “Configuring the Untrust Interface” on page 13.
Login and Password
NetScreen highly recommends that you change your login and password to the NetScreen
device, as all NetScreen products use the same default login name and password. See
“Changing Your Login Name and Password” on page 14.
Optional Configuration
The following optional configurations are not described in detail in this manual. Refer to
the appropriate sections in the NetScreen Concepts & Examples ScreenOS Reference
Guide for more information.
Port Mode
The port mode is the binding of physical ports, logical interfaces, and zones. The default
port mode, Trust-Untrust, binds the Trust interface to the Trust zone and the Untrust
interface to the Untrust zone. Changing the port mode changes these bindings. This
manual only covers configuring the NetScreen device in the Trust-Untrust port mode. For
more information about port modes and how to change them, refer to the “Zones” chapter
in Volume 2 of the NetScreen Concepts & Examples ScreenOS Reference Guide.
Note: If you have any problems completing a configuration and you need to restore the
device to its default settings, see “Resetting the Device to Factory Defaults” on page 14.
Warning: Changing the port mode removes any existing configurations on the NetScreen
device. Therefore, change the port mode before configuring the device.

Chapter 2 Configuring the Device
10 User’s Guide
Restricting Management
By default, anyone in your network can manage the NetScreen device if they know the
login and password. You can configure the NetScreen device to be managed only from a
specific host on your network. (And you can choose which services — for example, WebUI,
Telnet, ping — you want enabled on the NetScreen device.) Refer to the “Administration”
chapter in Volume 3 of the NetScreen Concepts & Examples ScreenOS Reference Guide.
Operational Mode
The operational mode is the way an interface on a NetScreen device processes traffic
between zones. By default, the NetScreen-5GT operates in Route mode with network
address translation (NAT) enabled on the Trust interface. This means that when devices
in the Trust zone send traffic to the Internet, the NetScreen device replaces the original
source IP addresses with the IP address of the Untrust interface. While the NetScreen
device assigns “private” IP addresses to the devices in your network, these addresses
remain hidden to computers outside your network.
If all devices in your network have public IP addresses, you can configure the NetScreen
device for Transparent mode or Route mode without NAT enabled. In Transparent mode,
the NetScreen device forwards traffic without checking IP addresses. In Route mode
without NAT enabled, the NetScreen device routes traffic by checking IP addresses. For
more information about configuring the device for Transparent mode or Route mode
without NAT enabled, refer to the “Interface Modes” chapter in Volume 2 of the NetScreen
Concepts & Examples ScreenOS Reference Guide.
Trust Interface Address
You can change the IP address and netmask of the Trust interface if necessary.
(Remember that the IP addresses of devices in your network are never seen by computers
outside your network; outside computers see only the IP address of the Untrust interface.)
For example, you might need to change the Trust interface to match the IP addresses that
already exist on your network. If you change the IP address and netmask of the Trust
interface, you also need to change either the range of addresses that the NetScreen device
assigns via DHCP to devices in the network, or disable the DHCP server on the Trust
interface.
To assign a different IP address and netmask to the Trust interface, refer to the
“Interfaces” chapter in Volume 2 of the NetScreen Concepts & Examples ScreenOS
Reference Guide.
To change the DHCP settings for the NetScreen device, refer to the “System Parameters”
chapter in Volume 2 of the NetScreen Concepts & Examples ScreenOS Reference Guide.

Accessing the Device
NetScreen-5GT 11
Additional Policies
The NetScreen-5GT device is configured with a default policy that permits workstations
in your network to access any kind of service with outside computers, while outside
computers are not allowed to access or start sessions with your workstations. You can
configure policies that direct the NetScreen device to permit outside computers to start
specific kinds of sessions with your computers. To create or modify policies, refer to the
“Policies” chapter in Volume 2 of the NetScreen Concepts & Examples ScreenOS Reference
Guide.
ACCESSING THE DEVICE
You can configure and manage the NetScreen-5GT device in several ways:
•WebUI: The ScreenOS WebUI is a graphical interface that is available through a
Web browser. To use the WebUI, you must be on the same subnetwork as the
NetScreen device. See “Using the WebUI” on page 11.
•Telnet: Telnet is an application that allows you to access devices through an IP
network. To access and configure the device, you enter ScreenOS Command Line
Interface (CLI) commands in a Telnet session from your workstation. See “Using
Telnet” on page 12.
•NetScreen-Security Manager 2004 (NSM) and NetScreen Rapid Deployment
(RD): If you are using NSM, you can optionally configure NetScreen appliances
with RD. Refer to the Rapid Deployment Getting Started Guide for more
information.
•Console connection: The Console port on the NetScreen-5GT device allows you to
access the device through a serial cable connected to your workstation or
terminal. To access and configure the device, you enter ScreenOS CLI
commands on your terminal or in a terminal emulation program on your
workstation. See “Using a Console Connection” on page 12.
Using the WebUI
To use the WebUI, you must be on the same subnetwork as the NetScreen device. To
access the NetScreen-5GT device with the WebUI management application:
1. Connect your workstation (or your LAN hub) to the Trusted port, as described in
“Connecting the NetScreen Device to the Network” on page 5.
2. Launch your browser, enter the IP address for the Trust interface in the URL
field, and then press Enter.
Note: You can also access remote NetScreen devices using Secure Shell (SSH)
applications. Refer to the “Administration”chapter in Volume 3 of the NetScreen
Concepts & Examples ScreenOS Reference Guide for more information.

Chapter 2 Configuring the Device
12 User’s Guide
For example, if the IP address of the Trust interface on the NetScreen device is
192.168.1.1/24, enter the following:
192.168.1.1
The NetScreen WebUI software displays the login prompt.
3. Enter netscreen in both the Admin Name and Password fields, then click
Login. (Use lowercase letters only. The Admin Name and Password fields are
both case sensitive.)
The NetScreen WebUI application window appears. (If you access the device for
the first time using the WebUI, the Initial Configuration Wizard appears; refer
to the Getting Started Guide for the NetScreen-5GT.)
Using Telnet
1. Connect your workstation (or your LAN hub) to the Trusted port, as described in
“Connecting the NetScreen Device to the Network” on page 5.
2. Start a Telnet client application to the IP address for the Trust interface.
For example, if the IP address of the Trust interface on the NetScreen device is
192.168.1.1/24, enter the following:
192.168.1.1
3. Enter netscreen in both the login and password prompts. (Use lowercase
letters only. The login and password fields are both case sensitive.)
Using a Console Connection
To establish a console connection:
1. Plug the female DB-9 end of the serial cable into the serial port of your
computer. (Be sure that the DB-9 connector is seated properly in the port.)
2. Plug the male DB-9 end of the serial cable into the Console port of the
NetScreen-5GT device. (Be sure that the DB-9 connector is seated properly in
the port.)
Note: For the console connection, you require a serial cable with a male DB-9 connector on
one end and female DB-9 connector on the other end.

Configuring the Untrust Interface
NetScreen-5GT 13
3. Launch a serial terminal emulation program. (A commonly-used terminal
program is Hilgreave HyperTerminal.) The required settings to launch a console
session with your NetScreen-5GT device are as follows:
– Baud Rate: 9600
– Parity: No
– Data Bits: 8
– Stop Bit: 1
– Flow Control: None
4. Enter netscreen in both the login and password prompts. (Use lowercase
letters only. The login and password fields are both case sensitive.)
CONFIGURING THE UNTRUST INTERFACE
Your network uses the Untrust interface on the NetScreen device to connect to the
Internet. If you are setting up your Internet connection for the first time, contact your ISP
for information on your network IP address assignment.
•If your ISP gave you a specific, fixed IP address and netmask for your network,
configure the IP address and netmask for the network and the IP address of the
router port connected to the NetScreen device. Enter the following CLI
commands in a Telnet or Console session:
set interface untrust ip ip_addr/mask
set interface untrust gateway ip_addr
save
•If your network receives an IP address from a server via DHCP, enter the
following CLI commands in a Telnet or Console session:
set interface untrust dhcp client enable
save
•If your network receives an IP address from a server via PPPoE, configure the
user name and password assigned by your ISP. Enter the following CLI
commands in a Telnet or Console session:
set pppoe interface untrust
set pppoe username name_str password pswd_str
save
Note: If you access the device for the first time using the ScreenOS WebUI graphical
interface, the Initial Configuration Wizard appears when you log in to the WebUI to guide
you through the configuration described in this chapter. Therefore, only the CLI
commands are shown in this chapter.

Chapter 2 Configuring the Device
14 User’s Guide
CHANGING YOUR LOGIN NAME AND PASSWORD
Because all NetScreen products use the same default login name and password
(netscreen), it is highly advisable to change your login name and password immediately.
In a Telnet or Console session, enter the following CLI commands:
set admin name name_str
set admin password pswd_str
save
For information on creating different levels of administrators, see the “Administration”
chapter in Volume 3 of the NetScreen Concepts & Examples ScreenOS Reference Guide.
VERIFYING EXTERNAL CONNECTIVITY
To verify that workstations in your network can access resources on the Internet, start a
Web browser from any workstation in the network and enter the following URL:
www.netscreen.com.
RESETTING THE DEVICE TO FACTORY DEFAULTS
If you lose the admin password, you can reset the NetScreen device to its default settings.
This destroys any existing configurations, but restores access to the device.
You can restore the device to its default settings in one of the following ways:
•Using a Console connection. For further information, see the “Administration”
chapter in Volume 3 of the NetScreen Concepts & Examples ScreenOS Reference
Guide.
•Using the reset pinhole on the rear panel of the device, as described in the next
section.
Warning: Resetting the device deletes all existing configuration settings and renders
existing firewall and VPN service inoperative.

Resetting the Device to Factory Defaults
NetScreen-5GT 15
Using the Reset Pinhole
You can reset the device and restore the factory default settings by pressing the reset
pinhole. To perform this operation, you need to either view the device status LEDs on the
front panel or have a Console session as described in “Using a Console Connection” on
page 12.
1. Locate the reset pinhole on the rear panel. Using a thin, firm wire (such as a
paper clip), push the pinhole for four to six seconds and then release.
The Status LED blinks amber. A message on the Console states that erasure of
the configuration has started and the system sends an SNMP/SYSLOG alert.
2. Wait for one to two seconds.
After the first reset, the power LED blinks green; the device is now waiting for
the second push. The Console message now states that the device is waiting for a
second confirmation.
3. Push the reset pinhole again for four to six seconds.
The Status LED lights amber for one-half second, and then returns to the
blinking green state.
4. The device resets to its original factory settings.
When the device resets, the Status LED turns amber for one-half second and
then returns to the blinking green state. The Console message states that the
configuration is erased and the unit is reset. The system generates SNMP and
SYSLOG alerts to configured SYSLOG or SNMP trap hosts.
5. The device restarts.
If you do not follow the complete sequence, the reset process cancels without any
configuration change and the console message states that the erasure of the configuration
is aborted. The Status LED returns to blinking green. If the device did not reset, an
SNMP alert is sent to confirm the failure.
Reset Pinhole

Chapter 2 Configuring the Device
16 User’s Guide