Add Juniper SRX Cluster into JunOS Space 16.1 Security Director
My old post “Import Existing Juniper SRX Cluster into JunOS Space Security Director” was created based on Space 14.1 and SRX11.x version. Now both have been upgraded. Space NMP and Security Director have been upgrade to 16.1 (Post is here). SRX240H has been upgrade to 12.1D46.55.
Basically, all steps are similar except the web interface is different. What you need to do is to configure your SRX cluster with a master-only ip on both nodes. The configuration should looks like this:
[email protected]> show configuration ## Last commit: 2017-03-23 14:44:28 UTC by root version 12.1X46-D55.3; groups {node1 {system {host-name fw-m-t-2;backup-router 10.9.1.1;services {ssh {max-sessions-per-connection 32;}}syslog {file default-log-messages {any info;match "(requested 'commit' operation)|(requested 'commit synchronize' operation)|(copying configuration to juniper.save)|(commit complete)|ifAdminStatus|(FRU power)|(FRU removal)|(FRU insertion)|(link UP)|transitioned|Transferred|transfer-file|(license add)|(license delete)|(package -X update)|(package -X delete)|(FRU Online)|(FRU Offline)|(plugged in)|(unplugged)|GRES";structured-data;}}}interfaces {fxp0 {unit 0 {family inet {address 10.9.1.14/24 {preferred;}address 10.9.1.15/24 {master-only;}}}}}}node0 {system {host-name fw-m-t-1;backup-router 10.9.1.1;services {ssh {max-sessions-per-connection 32;}}syslog {file default-log-messages {any info;match "(requested 'commit' operation)|(requested 'commit synchronize' operation)|(copying configuration to juniper.save)|(commit complete)|ifAdminStatus|(FRU power)|(FRU removal)|(FRU insertion)|(link UP)|transitioned|Transferred|transfer-file|(license add)|(license delete)|(package -X update)|(package -X delete)|(FRU Online)|(FRU Offline)|(plugged in)|(unplugged)|GRES";structured-data;}}}interfaces {fxp0 {unit 0 {family inet {address 10.9.1.13/24 {preferred;}address 10.9.1.15/24 { master-only;}}}} }}security;global-policy {security {policies {from-zone <*> to-zone <*> {policy default-logdrop {match {source-address any;destination-address any;application any;}then {deny;log {session-init;}}}}}}} }
In Juniper Space, you just need to import master-only ip into it. Here are steps with screenshots.
1. Device Discovery
|
Create Device Discovery Profile |
Specify Probes |
Specify credentials |
Secify Device Fingerprint |
Schedule Discovery Job |
Discovery Progress |
Discovered Device |
Note: If your Space Schema Version does not have your SRX OS version, it will shows mismatch on Schema Version column. In that case , you will need to do DMI Schema download the version you are missing.
DMS Download |
2. Import Device
Import Devices |
Follow the on-screen notes to complete steps, you will be able to import Firewall policy, NAT policy and IDP policy ,etc.
Imported Firewall Policy |
Imported IPS Policy |
3. Publish and Update policy to your SRX devices
Update Firewall Policy |
4. Troubleshooting
During updating policy, I met following two errors:
4.1. [Error] Configuration update failed.
Severity : error
Message : remote lock-configuration failed on node1
The fix is at KB27800 – [SRX] The error ‘remote lock-configuration failed on node’ is seen in SRX chassis cluster
- Go to node with the stuck lock.
- Execute the following commands:
>start shell%mgd clr-chg
4.2. [Error] Configuration update failed.
Severity : error
At : [edit security idp idp-policy Space-IPS-Policy rulebase-ips rule Recommended-TCP/IP match]
Message : Please install the Signature Database
Details : attacks
Severity : error
Message : configuration check-out failed
The fix is just to download latest signature database and install it to devices.
Download Latest Signature Database |
Share this:
- Click to share on Twitter (Opens in new window)
- Click to share on Facebook (Opens in new window)
- More
- Click to print (Opens in new window)
- Click to share on LinkedIn (Opens in new window)
- Click to share on Reddit (Opens in new window)
- Click to share on Tumblr (Opens in new window)
- Click to share on Pinterest (Opens in new window)
- Click to share on Pocket (Opens in new window)
- Click to share on Telegram (Opens in new window)
- Click to share on WhatsApp (Opens in new window)
- Click to share on Skype (Opens in new window)
Like this:
Related
Add Juniper SRX Cluster into JunOS Space 16.1 Security Director相关推荐
- 绿盟科技网络安全威胁周报2017.22 关注Juniper Junos Space任意代码执行漏洞CVE-2017-2306...
绿盟科技发布了本周安全通告,周报编号NSFOCUS-17-22,绿盟科技漏洞库本周新增13条,其中高危0条.本次周报建议大家关注 Juniper Networks Junos Space任意代码执行漏 ...
- Juniper SRX Junos升级
Juniper SRX Junos升级 这是我升级SRX 系统的过程给大家分享一下 准备工作:先准备一个Junos软件(可以到Juniper官网下)和一个3CD Ftp软件(个人认为比较稳定)还有网线 ...
- JUNIPER SRX系列防火墙(JUNOS12.1)HA配置说明
JUNIPER SRX系列防火墙(JUNOS12.1)HA配置说明 Chassis Cluster概述和简介: Juniper SRX系列防火墙可以通过一组相同型号的SRX系列防火墙来提供网络节点的冗 ...
- juniper srx 1500 HA及双线路自动切换配置
机房ISP提供了两条上联线路,分别接入ISP的两台核心交换机. 这两条线路是主备模式,同一时间只能有一条工作. 恰好等保要求,买了两台juniper srx 1500,为了节省设备,决定这两个墙既作为 ...
- juniper srx 3400 双机 配置
单位最近更新防火墙,打算把10年前的2台juniper换成现在的2台juniper srx 3400,利用juniper的jsrp技术实现,双机设备,一台坏了,另一台自动接替.觉得这次juniper命 ...
- Juniper SRX NAT46/NAT64配置
Juniper SRX345配置NAT46与NAT64 NAT46 测试拓扑 Model: srx345 Junos: 15.1X49-D140.2 JUNOS Software Release [1 ...
- Juniper SRX JSRP 配置文档
请访问原文链接:https://sysin.org/blog/juniper-srx-jsrp-config/,查看最新版.原创作品,转载请保留出处. 作者:gc(at)sysin.org,主页:ww ...
- Juniper SRX防火墙系统会话链接的清除
Juniper SRX防火墙系统会话链接的清除 维护Juniper防火墙SRX系列防火墙,一段时间后,发现防火墙老是有时候登录不上去,有时候可以登录. 查看用户的时候,发现,系统挂了很多连接会话,怪不 ...
- juniper srx解决内网不能telnet公网IP的方法
juniper srx做好基于目的地址池的映射后外网可以telnet a.a.a.a 22(a.a.a.a为公网IP),但是内网不能telnet a.a.a.a 22.具体解决方法: /*/源地址转换 ...
- Juniper SRX防火墙批量导入set格式配置
Juniper SRX防火墙批量导入set格式配置 SRX在进行大量配置时可能会出现一些小问题,可以使用load set terminal命令导入大量set格式的配置. root# load set ...
最新文章
- inno打包软件出现 main方法找不到
- 详解程序包管理RPM
- PHP 取302跳转后真实 URL 的两种方法
- Windows Servers双网卡绑定并配置IP地址
- Xshell链接远程服务器调用Pycharm的方法
- tensorflow 制定 CPU 或GPU
- boost::hana::comparing用法的测试程序
- 技术回顾系列:最新最热门的技术大事-第一周
- mui几种页面跳转方式对比
- linux链接 .o,Linux 链接概念 - osc_8ieji7o1的个人空间 - OSCHINA - 中文开源技术交流社区...
- Matlab求解规划问题之 fgoalattain函数
- 【报告分享】Facebook IQ 2020年热门话题和趋势报告.pdf(附下载链接)
- 俄罗斯方块c语言代码及注释,C语言代码实现俄罗斯方块
- CF-GYM 103119 L. Random Permutation
- 速锐得解码东风雪铁龙CAN网特点及休眠唤醒应用于驾培驾考
- 图片合成视频,视频文件过大了,python 改变视频的码率, 压缩视频文件
- 计算机三级网络技术知识点大全(二)
- Oracle对话框列间距太近,如何调整MathType矩阵行列间距
- 通用嵌入式系统测试平台 ETest简介
- C语言math.h详解