Policy Based Routing Example on Juniper Netscreen/SSG

set vrouter trust-vr
set access-list extended 100 src-ip 10.1.1.7/24 dst-ip 10.2.2.2/32 dest-port 22-22 protocol tcp entry 1 
set access-list extended 100 src-ip 10.1.1.7/24 dst-ip 10.2.2.2/32 dest-port 443-443 protocol tcp entry 2


set match-group name PBR_GROUP
set match-group PRB_ROUTE ext-acl 10 match-entry 1 
set match-group PRB_ROUTE ext-acl 10 match-entry 2 


set action-group name Action_PBR_ROUTE
set action-group Action_PBR_ROUTE next-hop 10.1.2.7 action-entry 1 
set action-group Action_PBR_ROUTE next-interface ethernet2 action-entry 2
set pbr policy Redirect_PBR_ROUTE match-group PBR_GROUP action-group Action_PBR_ROUTE 1 exit
set interface ethernet4 pbr Redirect_PBR_GROUP set vrouter trust-vr pbr Redirect_PBR_ROUTE

Use snoop (packet capture) on Juniper Netscreen/SSG

snoop filter ip src-ip  
snoop filter ip dst-ip 
snoop filter on
snoop

Useful troubleshooting commands on Juniper Netscreen/SSG

get event
get av all
get av scan
get av stat
get mem
get session info
get os task
get perf cpu all detail
get perf session detail
get socket
get log sys

Perform offline attack update using guiSvrCli.sh if the NSM server does not have internet access

Perform Juniper NSM offline attack update using guiSvrCli.sh if the NSM server does not have internet access (KB ID: KB10092)


./guiSvrCli.sh --attack-update --post-action -none          

Debug AV Scan-Mgr Updates on a Juniper Netscreen/SSG?

How To: Debug AV Scan-Mgr Updates on a Juniper Netscreen/SSG? 
debug scan-mgr pm


For details, see http://kb.juniper.net/KB7250

Juniper USB Flash Drive

The Juniper USB flash drive is USB 2.0 compliant.  The maximum USB flash that can be used is 1 GB.  This applies to SSG-5, SSG-20, SSG-140, SSG-520, and SSG-550.


To list the contents of the flash memory, run:

Firewall(M)-> exec vfs ls flash:

    CONFIG.BIN                112            

    $NSBOOT$.BIN              10,246,895     

  488,284,160 bytes free (515,506,176 total) on disk

Setting MSS (Maximum Segment Size) on Netscreen/SSG

By default it is set at 1500. If you're experiencing issues with MSS, trying lowering it to 1360.


set flow all-tcp-mss 1360

Set Netscreen/SSG Interface as Manageable

From the command line, it should look similiar to this:


set interface trust ip manageable
set interface trust manage ping
set interface trust manage ssh
set interface trust manage-ip 10.1.1.0/24
set ssh version v2
set ssh enable
save


Note: You may need to subsitute "trust" with the actual interface name of the trust interface from "get int".


From the GUI, this can be done through: 
1) Admin -> Permitted IPs & Admin -> Management Enable SSH (V2) & Enable SCP
2) Network -> Interfaces -> Edit -> Service Options -> Management Services -> SSH/Ping

Troubleshoot Performance Issues on Juniper Netscreen/SSG

get performance cpu
get counters
show alarm ?
get event level alert
get event level critical
get event level emergency
get event level warning

Lost Admin Password for Juniper Netscreen/SSG

This is a last resort to restoring a Netscreen/SSG to factory default settings if the administrative password has been lost. Note: This will remove your configuration and reset the device to factory default settings.


Items Needed:

Laptop
Serial Console Cable w/ RJ-45 End
Crossover (PC -> PC) Ethernet Cable
Serial Number (from sticker on back of the Netscreen/SSG device)


Device Recovery:
1) Console Connection (Console -> Hyperterm -> Baud Rate 9600 & Flow = None -> Enter)
2) Username/Password = Serial # / Serial #
3) Yes / Yes
4) Reset Device
5) Login with netscreen/netscreen @ 192.168.1.1 (factory default IP)
(Ethernet -> Laptop -> Trust Interface -> Set your laptop laptop = 192.168.1.2, and browse to the firewall at 192.168.1.1).


Reconfigure Basic Access
Then use the GUI or CLI to reconfigure the Untrust interface and default gateway for outside access.
set interface "ethernet0" zone "Untrust"
set interface ethernet0 ip 1.1.1.2/24
set interface ethernet0 route
set interface ethernet0 ip manageable
set interface ethernet0 manage-ip 1.1.1.2
set interface ethernet0 manage scs
set interface ethernet0 manage ssl
set interface ethernet0 manage web
set scs enable
set route 0.0.0.0/0 interface ethernet0 gateway 1.1.1.1

Packet Capture on a Juniper Netscreen/SSG

--
Basic Traffic Capture
--
Set up capture
clear db
set console dbuf
set ffilter src-ip 1.1.1.1 dst-ip 2.2.2.2
debug flow basic

generate some traffic


view the output of the capture
get dbuf stream


when done, turn off debugging-
undebug all

--

Example to Capture VPN/IPSEC Traffic:

--

set console dbuf

set ffilter dst-ip 1.1.1.1 ip-proto 50

set ffilter src-ip 1.1.1.1 ip-proto 50

debug ike basic

debug flow all

cl db

get dbuf stream

Juniper NSM Error Logs

These can come in very handy when troubleshooting a problem with a Juniper NSM server. Start by tailing logs in these directories.


/idp/netscreen/DevSvr/errorLog
/idp/netscreen/GuiSvr/errorLog

How to Upgrade a Juniper HA Netscreen or SSG Firewall

These notes assume that the bootloader is already up to date, and that we're just upgrading the ScreenOS software.

Standalone Firewall

1) Download the latest ScreenOS release and release notes from Juniper support.


2) Backup (save) the config via GUI:
Configuration -> Update -> Config File -> Save to File
or Save Config via CLI: "save config to tftp ?"


3) Configuration -> Update -> Firmware/ScreenOS -> Load File. The Netscreen or SSG will now reboot and come back up at the new version.

-------------------------------------------------------------------

Upgrade HA NSRP Pair - IN ATIVE/STANDBY Mode

- Upgrade Standby Unit First
- Configuration -> Update -> ScreeOS/Keys -> Firmware (ScreenOS) -> Load File -> Apply

 - This will upload file, apply new image, and reboot. WebUI will time out while device is rebooting. WebUI should refresh back to Netscreen login page after it reboots - may take several minutes (after 5 min or so if it doesn't refresh back to login page, hit the refresh button every 1-2 mins).

 - Login and Confirm Home page shows new version


 - Failover to secondary (On Primary: exec nsrp vsd-group 1 mode ineligible) - you can confirm group 1 is the correct VSD group through Network -> NSRP -> VSD Group

 - Confirm Secondary is Master (from CLI prompt should change from (B) (backup) to (M) (master).

- Upgrade Primary

- Login to Primary Confirm home screen shows new version

 - On Primary: exec nsrp sync rto all from peer (syncs objects with secondary)

 - Primary may fail back to master after it upgrades/reboots (if preempt is enabled); if it does not, and secondary is still active after the primary upgrade, manually fail primary back to active/master from secondary by using: exec nsrp vsd-group 1 mode backup
-------------------------------------------------------------------
Upgrade HA NSRP Pair - IN ATIVE/ACTIVE Mode


Similar to the above note, except:
Fail over master/B (Group # changes):


• If the preempt option is enabled:
exec nsrp vsd-group 1 mode ineligible


• If the preempt option is not enabled:
exec nsrp vsd-group 1 mode backup


Then fail over other device and upgrade.
Followed by SYNC: exec nsrp sync rto all


Note: Use "get nsrp" from the CLI (or viewed through the WebUI) to make sure you're using the correct VSD group in the commands above. Also use "get system" after the upgrade to confirm the upgrade was successful and reflects the new version.


Also see:  http://kb.juniper.net/index?page=content&id=KB13672&pmv=print