Juniper NSM3000 - REV 1 Manual

Hide thumbs Also See for NSM3000 - REV 1:

Quick start manual (51 pages)

Table Of Contents

100

Table of Contents

Quick Links

Download this manual

Juniper Networks Network

and Security Manager

NSMXpress and NSM3000 User Guide

Release

2010.4

Published: 2010-11-17

Revision 1

Table of Contents

Summary of Contents for Juniper NSM3000 - REV 1

Page 2 Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.
Page 3 REGARDING LICENSE TERMS. 1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer’s principal office is located in the Americas) or Juniper Networks (Cayman) Limited (if the Customer’s principal office is located outside the Americas) (such applicable entity being referred to herein as “Juniper”), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable...
Page 4 Customer shall be liable for any such violations. The version of the Software supplied to Customer may contain encryption or other capabilities restricting Customer’s ability to export the Software without an export license. Copyright © 2010, Juniper Networks, Inc.
Page 5 (including Juniper modifications, as appropriate) available upon request for a period of up to three years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA http://www.gnu.org/licenses/gpl.html...
Page 15: About This Guide
Requesting Technical Support on page xviii Objectives Juniper Networks NSMXpress and NSM3000 are appliance versions of Network and Security Manager (NSM), a software application that centralizes control and management of your Juniper Networks devices. With NSM, Juniper Networks delivers integrated, policy-based security and network management for network and security devices.
Page 16: Table 1: Notice Icons
The product supports two levels of access, user and privileged. Identifies variables clusterID, ipAddress. The angle bracket (>) Indicates navigation paths through the UI Object Manager > User Objects > Local by clicking menu options and links. Objects Copyright © 2010, Juniper Networks, Inc.
Page 17: Documentation
Describes NSM features related to device configuration and Manager Configuring management. It also explains how to configure basic and advanced ScreenOS Devices Guide NSM functionality, including deploying new device configurations, managing security policies and VPNs, and general device administration. Copyright © 2010, Juniper Networks, Inc. xvii...
Page 18: Documentation Feedback
Software release version (not required for Network Operations Guides [NOGs]) Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC.
Page 19: Self-Help Online Tools And Resources
About This Guide Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: http://www.juniper.net/customers/support/ Find product documentation: http://www.juniper.net/techpubs/...
Page 21: Using The Nsm Appliance
Using the NSM Appliance Part 1 contains the following chapters: Getting Started on page 3 Installing and Configuring NSM from the CLI on page 13 Configuring NSM from the Web Interface on page 31 Copyright © 2010, Juniper Networks, Inc.
Page 23: Getting Started
NSM appliances make it easy for administrators to control device configuration, network settings, and security policy settings for multiple families of Juniper Networks devices including: IDP Series Intrusion Detection and Prevention Appliances and Firewall and VPN devices running ScreenOS.
Page 24: Installation And Configuration Workflow
NOTE: If you decide to install an NSM appliance in your DMZ, ensure that it can connect to your internal resources. NSM Appliance Ports Table 5 on page 5 provides required port information on the NSM appliances. Copyright © 2010, Juniper Networks, Inc.
Page 25: Installing The Nsmxpress Hardware
Shared Disk NFS connection For more information on ports, refer to the Network and Security Manager Installation Guide. Installing the NSMXpress Hardware Follow these steps to unpack the NSMXpress appliance and connect it to your network. Copyright © 2010, Juniper Networks, Inc.
Page 26: Figure 1: Front Panel Of Nsmxpress
Hardware installation is now complete. The next step is to set up the software, as described in “Initial Setup Configuration” on page 8. Table 6 on page 6 provides LED information for the Ethernet ports. Table 6: Ethernet Port LEDs LAN Status LED 1 LED2 10 Mbps connection Copyright © 2010, Juniper Networks, Inc.
Page 27: Installing The Nsm3000 Hardware
If your NSM appliance contains two power supplies, plug each power cord into a separate power circuit to ensure that the NSM appliance continues to receive power if one of the power circuits fails. Plug the Ethernet cable into the port marked ETH0 on the front panel. Copyright © 2010, Juniper Networks, Inc.
Page 28: Initial Setup Configuration
HyperTerminal. Configure a console terminal or terminal emulation utility to use the following serial connection parameters: 9600 bits per second 8-bit no parity (8N1) Copyright © 2010, Juniper Networks, Inc.
Page 29: Set Up Your Appliance
To configure your system via a web browser, connect to: https://10.150.43.205/administration To configure your system via command line, type: nsm_setup For operation of NSM server, switch to user “nsm”. Please consult NSM product documentation for details. [admin@NSMXpress ~]$ Copyright © 2010, Juniper Networks, Inc.
Page 30: Cli Configuration
“admin” user, go to the $ prompt, enter sudo su - root for the # root prompt, then enter the “admin” password you set when logging into the NSM appliance. To return to the “admin” user, enter exit from the # prompt. Copyright © 2010, Juniper Networks, Inc.
Page 31: Web Interface Configuration
Enter the admin user name and password and then click Login. See “Configuring NSM from the Web Interface” on page 31 for details about how to install and configure NSM on your NSM appliance from the Web interface. Copyright © 2010, Juniper Networks, Inc.
Page 33: Installing And Configuring Nsm From The Cli
Password for 'super' user 3> GUI server one-time password [] Password to initiate authentication between HA peers and to Central Manager. This password must be the same for all NSM servers in this installation. Copyright © 2010, Juniper Networks, Inc.
Page 34 Turn on the NSM appliance and wait for the login prompt: Juniper NSMXpress NSM 2010.4Kernel 2.6.9 42.0.8.ELsmp on an i686 NSMXpress.juniper.net logon: admin Password: Las Login: Tue May 17 09:43:50 on tty50 Run NSMXpress system setup? [y/N] N Copyright © 2010, Juniper Networks, Inc.
Page 35: Configuring The Nsm Software
[admin@NSMXpress “]$ Your NSM appliance comes preconfigured as a regional server or a central manager, as described in the following sections: Configuring a Regional Server on page 16 Configuring the Central Manager on page 21 Copyright © 2010, Juniper Networks, Inc.
Page 36: Configuring A Regional Server
Once configured, the setup program displays the IP address for the interface you selected. NSM ‘super’ password—Enter 2 to specify an NSM super password. This password must be at least eight characters long and is case-sensitive. This password is used by Copyright © 2010, Juniper Networks, Inc.
Page 37: Configuring Custom Settings
Install to use the built-in limited device license for as many as 25 devices. This option is the default. Otherwise, enter the filename of the license file you purchased from Juniper Networks that permits you to manage more than 25 devices. For additional details about NSM licensing, see the Network and Security Manager Installation Guide.
Page 38 3> HA Link 2 Remote IP [] IP address for the peer's secondary heartbeat link 4> HA Remote Replication IP [] IP address used for remote HA replications 5> Return to High Availability Menu Copyright © 2010, Juniper Networks, Inc.
Page 39 Menu: SRS—Enter 3 to open a menu to configure Statistical Report Server (SRS). The following sections provide details about configuring remote backup and SRS: Enabling and Configuring Remote Replication of the Database on page 20 Enabling and Configuring the Statistical Report Server on page 20 Copyright © 2010, Juniper Networks, Inc.
Page 40 Statistical Report Server will be used with this GUI Server 2> SRS DB IP [] Database server IP address 3> SRS DB Type [pgsql] Database Type 4> SRS Database Name [netscreen] Database name 5> SRS DB Owner Name [netscreen] Database user name Copyright © 2010, Juniper Networks, Inc.
Page 41: Configuring The Central Manager
HA peers and to all Regional Servers 4> Menu: High Availability [Off] 5> Menu: Advanced Options A> Apply settings C> Cancel all changes and quit R> Redraw menu Choice [1-5,A,C,R]: You have the following options: Copyright © 2010, Juniper Networks, Inc.
Page 42: Configuring High Availability
IP address outside the HA cluster 5> HA Inter-server password [] Shared password for heartbeat 6> Menu: Shared Disk [Off] 7> Menu: HA Links 8> Menu: HA Advanced Settings The following options are available to configure HA. Copyright © 2010, Juniper Networks, Inc.
Page 43 3> HA Link 2 Remote IP [] IP address for the peer's secondary heartbeat link 4> HA Remote Replication IP [] IP address used for remote HA replications 5> Return to High Availability menu Copyright © 2010, Juniper Networks, Inc.
Page 44: Enabling And Configuring Remote Replication Of The Database
1> Remote Replication of Database [n] If 'y', local backups will be sent to a remote backup machine 2> Hour of day to Replicate Database [02] Hour to start backup Copyright © 2010, Juniper Networks, Inc.
Page 45: Configuring Standard Configuration Options
Saving Setup Options on page 29 Changing the Password To change your password: On the NSM appliance Settings Menu, enter 1 at the prompt. Enter y when prompted to change the password for an “admin” user. Copyright © 2010, Juniper Networks, Inc.
Page 46 3 for 1000 Mbps and go to the next step. Enter 1 for full duplex or 2 for half duplex, and then return to the NSM appliance Settings menu. Setting Routing Options To set or modify routing options: Copyright © 2010, Juniper Networks, Inc.
Page 47: Adding Dns Servers
You can change time zones or the Network Time Protocol (NTP) configuration. The default time zone is set for Pacific Standard Time (PST)/Pacific Daylight Time (PDT). Select time zones in the following order: Continent or ocean Country Region Copyright © 2010, Juniper Networks, Inc.
Page 48: Forwarding Local Status E-Mails
System security updates are NSM appliance operating system-level patches that protect the system against any future reported security vulnerabilities. The NSM appliance checks for new updates daily by connecting to Juniper Networks. To manage system security updates: On the NSM appliance Settings menu, enter 8 at the prompt.
Page 49: Saving Setup Options
To reinstall an NSM appliance, use the following procedure. The steps in the procedure assume the NSM appliance is connected to the computer with a null-modem cable. If not, refer to the section “Initial Setup Configuration” on page 8 for details. To reinstall the NSM appliance configuration: Copyright © 2010, Juniper Networks, Inc.
Page 50 Rescue mode, just hit <Enter> at the password prompt. Press any key. Enter erase at the prompt to erase the disk. This task will take a few minutes. When reinstallation is finished, you are prompted to login. Copyright © 2010, Juniper Networks, Inc.
Page 51: Chapter 3 Configuring Nsm From The Web Interface
To install the regional server or central manager software using the minimum requirements: Complete all appropriate steps in “Getting Started” on page 3. Enter the https://<ip>/administration URL for your appliance in a Web browser. See “Web Interface Configuration” on page 11 for details. Copyright © 2010, Juniper Networks, Inc.
Page 52: Figure 4: Regional Server Configuration Main Menu
NOTE: The “admin” user default username is admin and the password is the one you created in Step 6 of “Boot the NSM Appliance” on page 8. Figure 4: Regional Server Configuration Main Menu Copyright © 2010, Juniper Networks, Inc.
Page 53: Figure 5: Central Manager Configuration Main Menu
Click Upload license file to upload the license file you generated using the Juniper License Management System (LMS), which permits you to manage more than 25 devices. This license file must be located on your local hard drive. Copyright © 2010, Juniper Networks, Inc.
Page 54: Configuring High Availability
(Optional) Click Menu next to Shared Disk (see Figure 6 on page 34) to configure a shared disk for regional servers (see Figure 7 on page 35) or for central managers (see Figure 8 on page 35). Copyright © 2010, Juniper Networks, Inc.
Page 55: Figure 7: Shared Disk Options For Regional Servers
If you configure HA with just one heartbeat link, then device management traffic and data replication traffic both use that link. If you configure two links, device management traffic uses the first link and data replication uses the second. Copyright © 2010, Juniper Networks, Inc.
Page 56: Advanced Options
To display the Advanced Options menu, on the NSM Configuration Main Menu, select Menu next to Advanced Options. The Advanced Options menu appears as shown in Figure 12 on page 36. Figure 12: Advanced Options Menu Advanced installation options include: Copyright © 2010, Juniper Networks, Inc.
Page 57: Enabling And Configuring Remote Replication Of The Database
Backup information is copied to the /var/netscreen/dbbackup directory on the remote server. The “nsm” user must exist on both servers and you must establish an SSH trust relationship. See the Network and Security Manager Installation Guide, for details. Copyright © 2010, Juniper Networks, Inc.
Page 58: Figure 14: Srs Menu
SRS database. The default value is netscreen. To enter another name, click the radio button next to the blank text box and enter the name in the text box. Copyright © 2010, Juniper Networks, Inc.
Page 59: Installing Nsm Software
Scheduling Security Updates on page 43 Changing the Superuser Password To change the superuser password, select NSM Administration > NSM Super User Password. See Figure 15 on page 39. Figure 15: Change Superuser Password Copyright © 2010, Juniper Networks, Inc.
Page 60: Figure 16: Download Nsm Mibs
Exporting Device Logs (Regional Server Only) To export device logs, select NSM Administration > Export Device Logs. See Figure 18 on page 40. This option is not available on the central manager. Figure 18: Export Device Logs Copyright © 2010, Juniper Networks, Inc.
Page 61: Figure 19: Generate Reports
Modifying NSM Configuration Files To manually edit the files, select NSM Administration GuiSrv.cfg DevSvr.dfg HaSvr.cfg > Modify NSM Configuration Files. The example in Figure 20 on page 42 shows the option to modify the file. GuiSvr.cfg Copyright © 2010, Juniper Networks, Inc.
Page 62: Backing Up The Nsm Database
Backing Up the NSM Database To configure backups of the NSM database, select NSM Administration > NSM Database Backup link under NSM Administration. See Figure 21 on page 43. Copyright © 2010, Juniper Networks, Inc.
Page 63: Changing The Nsm Management Ip
> NSM Management IP link under NSM Administration. See Figure 22 on page 43. Figure 22: Change Management IP Scheduling Security Updates To schedule security updates, select NSM Administration > Schedule Security Updates. See Figure 23 on page 44. Copyright © 2010, Juniper Networks, Inc.
Page 64: Managing System Administration
To reboot or shut down the NSM appliance, select System Administration > Bootup and Shutdown, and then click either Reboot System or Shutdown System. See Figure 24 on page 44. Figure 24: ReBoot or Shut Down Copyright © 2010, Juniper Networks, Inc.
Page 65: Network Interfaces
Routing and Gateways on page 46 Hostname and DNS Clients on page 46 Host Addresses on page 47 Network Interfaces Use this option to manage the network interfaces. See Figure 27 on page 46. Copyright © 2010, Juniper Networks, Inc.
Page 66: Figure 27: Network Interfaces
Use this option to configure and manage routes and gateways. See Figure 28 on page 46. Figure 28: Routes and Gateways Hostname and DNS Clients Use this option to configure and manage hostnames and DNS clients. See Figure 29 on page 47. Copyright © 2010, Juniper Networks, Inc.
Page 67: Host Addresses
. You also need to add NSM appliance users with their associated user profiles (SysAdmin, NSMAdmin, Operator, Guest), to the RADIUS database. For more details see Steel-Belted Radius Documentation. NOTE: You need System Administration or NSM Administration permission to manage RADIUS servers in the NSM appliance WebUI. Copyright © 2010, Juniper Networks, Inc.
Page 68: Adding A Radius Server
: The IP address or the hostname of the RADIUS Server. : The shared secret the NSM appliance and the RADIUS server use Shared secret for secure authentication. Auth Port : The RADIUS authentication software port. (We recommend UDP port 1812) Copyright © 2010, Juniper Networks, Inc.
Page 69 RADIUS Servers that have been added. Select the name of the server whose properties you want to edit. The Edit RADIUS Server dialog box appears. See Figure 33 on page 50. Copyright © 2010, Juniper Networks, Inc.
Page 70: Monitoring With Snmp
SNMP System Information on page 51 SNMP Trap Configuration on page 52 SNMP Configuration To configure SNMP: Select System Administration > SNMP Monitoring. Select the SNMP Config tab, which is shown in Figure 34 on page 51. Copyright © 2010, Juniper Networks, Inc.
Page 71: Figure 34: Configuring Snmp
Select the System Info tab, which is shown in Figure 35 on page 51. Figure 35: Configuring SNMP System Information Enter the following information, with is required for any SNMP-managed device: Contact—Contact information for the appliance. Location—Location of the appliance. Copyright © 2010, Juniper Networks, Inc.
Page 72: Figure 36: Configuring Snmp Traps
Enter the percentage of free memory below which SNMP issues a trap. CPU high Enter the percentage of CPU use over which SNMP issues a trap. NSM start/stop Admin Logon/Logoff External IP unreachable Enter the IP address of the required device. Click Save. Copyright © 2010, Juniper Networks, Inc.
Page 73: Forwarding Syslog Messages
Viewing Syslog Receivers To view the syslog receivers configured on your NSM appliance, follow these steps: Select System Administration > Syslog Forwarding. The Syslog Forwarding window appears. Figure 37 on page 55 shows an example. Copyright © 2010, Juniper Networks, Inc.
Page 74: Table 7: Viewing Syslog Receivers
Server log, and HA Server log. The syslog facility is a field included in the syslog message to help identify the data source. Click Save. Click Add new Receiver. The syslog receiver configuration window appears as shown in Figure 37 on page 55. Copyright © 2010, Juniper Networks, Inc.
Page 75: Figure 37: Configuring A Syslog Receiver
In the IP field, Enter the IP address of the syslog receiver. In the Transport field, select the type of syslog receiver: Select UDP for basic syslog implementations. Select TCP for rsyslog or syslog-NG implementations. Copyright © 2010, Juniper Networks, Inc.
Page 76: Changing The System Time
Configure an NTP server to synchronize the system time with an external clock. Installing Updates Select System Administration > System Update to perform the following tasks: Check for updates and install them. Enable or disable automatic updates. Copyright © 2010, Juniper Networks, Inc.
Page 77: Managing Users
NSMXpress users. See Figure 38 on page 57. Figure 38: NSMXpress Users Dialog Box Click The Create NSMXpress user dialog box appears. Create a new NSMXpress User. See Figure 39 on page 58. Copyright © 2010, Juniper Networks, Inc.
Page 78: Deleting A User
Select the check box next to the name of the user you want to delete and click Delete . Click in the Delete Users confirmation dialog box that appears. Selected Delete User NOTE: You cannot delete admin users or change their user profiles. Copyright © 2010, Juniper Networks, Inc.
Page 79: Editing User Attributes
Table 8: NSM Appliance WebUI User Profiles and Permissions System Network NSM Appliance Modules Administrator Administrator Operator Guest User System Administration Bootup and Shutdown Change User Password Network Configuration RADIUS Management SNMP Monitoring Syslog Forwarding System Time Copyright © 2010, Juniper Networks, Inc.
Page 80: Configuring The Web Interface
To specify which NSM client computers can access the NSM appliance through the Web interface, select System Administration > WebUI Configuration. The Allowed IP Addresses window appears as shown in Figure 41 on page 61. Copyright © 2010, Juniper Networks, Inc.
Page 81: Maintaining Nsm Appliances
Select lograte to view graphs that monitor the log rate hourly, daily, weekly, monthly, or on a customizable basis. CPU Load Select Load to view graphs that monitor the CPU load hourly, daily, weekly, monthly, or on a customizable basis. Copyright © 2010, Juniper Networks, Inc.
Page 82: Memory Data
One set makes up the NSM appliance OS, the other a set of upgrade script packages. Both sets are usually retained in the local file system. The NSM appliance OS set can also be downloaded from the Juniper Networks software repository.
Page 83: Troubleshooting
Administrator and NSM administrator permissions can view all Actions Logs in the NSM appliance. To view Action Audit Logs: Select . The NSMXpress Actions Log dialog box Troubleshooting > Action Audit Logs appears. See Figure 43 on page 64. Copyright © 2010, Juniper Networks, Inc.
Page 85: Error Logs
Figure 45: Review Error Logs To view details of an individual error log, select the file you want to view and click View. Figure 46 on page 65 shows sample error log details. Figure 46: Error Log Detail Copyright © 2010, Juniper Networks, Inc.
Page 86: Network Utilities
The data sent by ping contains a hexadecimal pattern. If you leave this option blank, ping will fill it with random data. This option is useful if you do not have problems with connectivity itself but with data loss. Copyright © 2010, Juniper Networks, Inc.
Page 87: Traceroute
IP address (see Figure 50 on page 68). The query type drop-down list contains several types of records found in the DNS database. Enter a nameserver or select the default. If you choose the default, nslookup uses the server on which the NSM appliance is installed. Copyright © 2010, Juniper Networks, Inc.
Page 88: Ip Subnet Calculator
> Tech Support. To help analyze problems, select a detail type in the drop-down list box, and then click Run Tech-Support Script. The NSM appliance creates a file you can download and send to Juniper Networks technical support. See Figure 52 on page 68. Figure 52: Juniper Tech Support...
Page 89: Viewing System Information
Chapter 3: Configuring NSM from the Web Interface Viewing System Information Use the System Information menu item to display information about the server, including CPU load and memory use, as shown in Figure 53 on page 69. Figure 53: System Information Copyright © 2010, Juniper Networks, Inc.
Page 93: Nsmxpress Leds
Hard disk activity. Hardware Unlit Normal operation. Blinking fast (1/sec) A fan has failed. Blinking slow (4/sec) A power supply has failed. On steadily Warning that the system is overheating and is about to power off. Copyright © 2010, Juniper Networks, Inc.
Page 94 NOTE: This is applicable for Blinking red Hard disk recovery or rebuild NSM 3000 RAID configurations and not for non-RAID configurations (NSMXpress/NSMCM). NOTE: For information on LAN LEDs, see Table 6 on page 6 Copyright © 2010, Juniper Networks, Inc.
Page 97 DevSvr.cfg file................41 central manager, configuring......22, 34 disk usage..................62 regional server, configuring........17, 34 DMZ....................4 High Availability menu DNS client.................46 central manager..............22 DNS server.................27 regional server..............17 documentation host address................47 comments on..............xviii hostname................27, 46 Copyright © 2010, Juniper Networks, Inc.
Page 98 NSM license.................17, 33 trap configuration............52 nsm user..................10 SRS See Statistical Report Server nsm_setup utility..............14 SSH....................5 NTP server................28, 56 static routing..............26, 46 null modem serial cable............6 Statistical Report Server menu........20, 38 Statistical Report Server, configuring......20, 38 Copyright © 2010, Juniper Networks, Inc.
Page 99 JTAC............xviii tiling.....................62 time zone................28, 56 time, setting...............27, 56 traceroute utility..............67 trap conditions, SNMP............52 troubleshooting...............63 URL, Web interface..............11 user admin, nsm, root.............10 Web interface configuring...............60 login URL................11 Web interface configuration configuration..............11 Web login..................11 Yum server.................57 Copyright © 2010, Juniper Networks, Inc.

This manual is also suitable for:

Nsmxpress - rev 1 Nsmxpress

Juniper NSM3000 - REV 1 Manual

Chapter 1 Getting Started

Chapter 2 Installing and Configuring NSM from the CLI

Chapter 3 Configuring NSM from the Web Interface

Quick Links

Related Manuals for Juniper NSM3000 - REV 1

Summary of Contents for Juniper NSM3000 - REV 1

This manual is also suitable for:

Table of Contents