Juniper Networks 5000 manual

N ET S CREEN -5000 S ERIES User’s Guide Version 5.0 P/N 093-1698-000 Rev. D[...]

Copyright Notice Copyright © 2006 Juniper Networks , Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, NetScreen, Ne tScreen Techn ologies, GigaScr een, and the Ne tScreen log o are registered trademarks of Juniper Netw orks, Inc. Ne tScreen-5GT, NetScreen-5XP, NetScreen-5XT, NetScreen-25, NetScreen-50, NetScreen-100, NetScree[...]

NetScreen-5000 Series iii Table of Contents Preface .............................. .............................. .............................................. ......... vii Guide Organization ........... .............. .............. .............. .............. .............. .. vii Command Line Interface (CLI) Convention s ............. ......[...]

Table of Conten ts iv User’s Guide NetScreen-5400 Interfaces ......................................................... ................... 24 Configurable Interfaces .................................... ............................... ............. 24 Performing Initial Connection and Config uration .................... .............. ... 2 5 Est[...]

NetScreen-5000 Series v EMI Certifications ..................... .............. .............. .............. ................ ...... A-III Connectors .......... .............. .............. .............. ........... .............. .............. ... A-III Appendix B Port Descriptions and LED Status ................... ...........................[...]

Table of Conten ts vi User’s Guide[...]

NetScreen-5000 Series vii Preface The Juniper Networks NetScreen-5 000 Series consists of purp ose-built, hi gh-performance security systems that provide IPSec VPN and firewall services fo r large-scale carrier, enterprise, and data-cent er networks. Built around Ne tScreen ’s third-ge neration ASIC technology and distributed system architec ture[...]

Preface viii User’s Guide C OMMAND L INE I NTERFACE (CLI) C ONVENTIONS The following conventions are used when pr esenting the syntax of a command line interface (CLI) comman d: • Anything inside square brackets [ ] is optional. • Anything insi de braces { } is required. • If there is more than one choice, each choice is separ ated by a pip[...]

NetScreen-5000 Series 1 1 Chapter 1 Overview This chapter prov ides detailed d escriptions of the NetScree n-5000 Serie s, modules, power supplies, and fan assemb lies. Topics explained in this chapter in clude: • “NetScreen-5000 Series” on page 2 – “NetScreen-5200” on page 2 – “NetScreen-5400” on page 2 • “Power Supplies” o[...]

Chapter 1 Overview 2 User’s Guide N ET S CREEN -5000 S ERIES This section describes the NetScreen-5000 Series, whic h currently includes the NetScreen-5200 and t he NetScreen-5400. NetScreen-5200 The NetScreen-5200 is a chassi s-based, two-slot network securi ty device with a 2U (rack unit) chassis. Slot 1 is for the management module and Slot 2 [...]

Power Supplies NetScreen-5000 Series 3 P OWER S UPPLIES The NetScreen-5000 Series can us e two kinds of power supplies: • Direct Current (DC) Power Supply • Alternating Current (AC) Power Supply The slots for these power supplies are locate d in the back of the NetScreen-5200 and on the front of the NetScre en-5400. When two or more power suppl[...]

Chapter 1 Overview 4 User’s Guide The DC Power Supply The DC power supply weighs about three poun ds. The faceplate contains a power LED, a power switch, a cooling fan vent, and three DC power terminal blocks that connect to power cables. The figure below shows the NetScreen-5200 DC power supply . The AC Power Supply The AC power supply weighs ab[...]

Fan Modules NetScreen-5000 Series 5 F AN M ODULES The NetScreen-5200 has a three-f an module and th e NetScreen-5 400 has a two- fan module. You can access the fan mod ule from the l eft front side of ea ch chassis. • To remove the NetScreen-5200 fan modu le, turn the fan knob in the unlock position, then gently pull the fan module le ver toward [...]

Chapter 1 Overview 6 User’s Guide Management Modules The management mod ule provides general-purpose CPU delivery, and contains dedicated High Availabili ty (HA) and manageme nt interf aces. It handles tasks such as management access, session setup and term ination, and Internet Key Ex change (IKE) negotiation. There are currently t wo management[...]

NetScreen-5000 Modules NetScreen-5000 Series 7 The 5000-M2 Management Module The 5000-M2 management module is based a r ound powerful, dual 1GHz PowerPC CPUs, which assist o ther system elements, primarily with n on-flow related tasks. The 5000 -M2 management module provides ov erall management and control of the system. Although it performs system[...]

Chapter 1 Overview 8 User’s Guide Secure Port Modules Secure Port Modules (SPMs) perform general packet proces s ing and device connection tasks for devices that communicate with the NetScreen -5000 Series. These modules are based around the GigaScreen-II ASIC. SPMs handle packets as they enter and exit the system, provi ding packet parsing, clas[...]

NetScreen-5000 Modules NetScreen-5000 Series 9 The 5000-2G24FE SPM The 5000-2G24FE SPM provides two 1-Gi gabit Ethernet ports and 24 Fast Ethernet (FE) ports with up to 2 Gbps of firewal l and up to 1 Gbps of VPN proces s capacity. This module is capable of supporti ng a total of six aggr egate interfaces. This total consists of one aggregate inter[...]

Chapter 1 Overview 10 User’s Guide The 5000-8G2 SPM The 5000-8G2 SPM provides eight 1- Gigabit mini-GBIC Ethernet ports using hot-swappable transcei vers. The 5000-8G2 SPM de livers up to 8 Gbps of firewall and up to 4 Gbps of VPN capacity. This module is also capabl e of supporting a total of four aggregate i nterfaces, with up to fo ur ports fo[...]

NetScreen-5000 Modules NetScreen-5000 Series 11 The 5000-2XGE SPM The 5000-2XGE SPM provides two 10-Gigabi t mini-GBIC Ethernet ports using hot-swappable tra nsceivers. The 5000-2XGE SPM delivers up to 1 0 Gbps of firewall and up to 5 Gbps of VPN capacity. This SPM cannot be mixed wi th the 5000-8G or 5000- 2G24FE SPMs. (For details on connecting o[...]

Chapter 1 Overview 12 User’s Guide[...]

NetScreen-5000 Series 13 2 Chapter 2 Installing the Device This chapter describes how to install a Ne tScreen-5000 Series in an equipme n t rack or on a desktop and how to co nfigure the d evice on a netwo rk. Topics in this chapter i nclude: • “General Instal lation Guid elines” on pa ge 14 • “Equipment Rack Installa tion Guidelines” o[...]

Chapter 2 Installing the Device 14 User’s Guide G ENERAL I NSTALLATION G UIDELINES Observing the following pre cautions can p r event injuries, equi p ment failur es, and shutdowns: • Never assume that the power su pply is disconnected from a power source. Always check first. • Room temperature might not be sufficie nt to keep equipment at ac[...]

Mounting the NetScreen-5000 Series NetScreen-5000 Series 15 There are two ways to rack mount the NetScreen-5200: • Rear and front mount • Mid-mount You can only front-mo unt the NetScreen-5400. M OUNTING THE N ET S CREEN -5000 S ERIES The following sections describe how to rack mount the Ne tScreen-5000 Series. • NetScreen-5200 Front and Rear[...]

Chapter 2 Installing the Device 16 User’s Guide NetScreen-5200 Mid-Mount To mid-mount the NetScreen-5200, you n eed four fitted screws, a Phillips-head screwdriver, and brackets. To mid-mount the NetScreen-5200: 1. Screw the left and right brackets to th e middle of each si de of the chassis. 2. Screw the left and right brac kets to the rack, sho[...]

Installing and Connecting the AC Power Supply NetScreen-5000 Series 17 I NSTALLING AND C ONNECTING THE AC P OWER S UPPLY To install and connect the AC power supply to the NetScreen-5000 Series: 1. On the NetScreen-520 0, slide the po wer supply into one of the power compartments in the back of the system. On the NetScreen-5400, slide the po wer sup[...]

Chapter 2 Installing the Device 18 User’s Guide The DC power supply, pow er switch, ground ing screw, and terminal blocks, are located on the faceplate of the power supply unit. To connect the DC power supply to a grou nding point at your site: 1. Remove the hex nut on the grounding screw. 2. Place the ground lug on the scre w and tighten the hex[...]

Establishing an HA Connection NetScreen-5000 Series 19 E STABLISHING AN HA C ONNECTION To assure continuous traffic flow in the ev ent of a system failure, you can cable and configure two NetScreen devices in a redundan t cluster, with one device acting as a master and the other as its backup. The master propagates all it s network, configuration a[...]

Chapter 2 Installing the Device 20 User’s Guide[...]

NetScreen-5000 Series 21 3 Chapter 3 Configuring the Device This chapter describes how to perform initia l configuration on the NetScreen-5000 Series once you have mounted it in a rack or de sktop, plugged in the necessary cables, and turned the power on. Topics in this chapter include: • “Operational Modes” on page 22 – “Transparent Mode[...]

Chapter 3 Configuring the Device 22 User’s Guide O PERATIONAL M ODES The NetScreen-5000 Series supports two oper at ional modes: Transpare nt and Route. The default mode is Route. Transparent Mode In Transparent mode, a NetScreen- 5000 Series systems operates as a Layer-2 bridge. Because the device cannot tr anslate packet IP addresses, it cannot[...]

The NetScreen-5000 Interfaces NetScreen-5000 Series 23 T HE N ET S CREEN -5000 I NTERFACES Each Secure Port Module (SPM) for the NetScreen-5000 Series sy stem provides 2, 8, or 26 physical ethernet ports. Each of these ports can serve as a physical interface. In addition, you can configure the ethernet port s to host multiple virtual ( logical ) in[...]

Chapter 3 Configuring the Device 24 User’s Guide NetScreen-5400 Interfaces A NetScreen-5400 contains one management modu l e ( i n s l o t 1 ) a n d u p t o t h r e e S P M s . Y o u can use a 5000-M or a 5000 -M2 management modu le in slot 1. In the illustra tions below , the device contains three 5000 -8G SPMs. Configurable Interfaces The confi[...]

Performing Initial Connection and Configuration NetScreen-5000 Series 25 P ERFORMING I NITIAL C ONNECTION AND C ONFIGURATION To establish the first console session with the NetScreen-5000 Series system, use a v t100 terminal emulator progra m through the pr ovided RJ-45/ DB9 serial port c onnector. Establishing a Terminal Emulator Connection To est[...]

Chapter 3 Configuring the Device 26 User’s Guide Upgrading the Firmware Du ring the Boot Process 1. Connect your computer to the NetScreen-5000 Series system: a. Using a serial cable, con nect the se rial port on your computer to the console port on the NetScreen-5000 Se ries system . This connection, in combination with a terminal appl ic ation,[...]

Performing Initial Connection and Configuration NetScreen-5000 Series 27 Changing Your Admin Name and Password Because all NetScreen products use the same admin name and password ( netscr een ), it is highly advisable to change your admin name and password immediately. Enter the following comma nds: set admin name name_str set admin password pswd_s[...]

Chapter 3 Configuring the Device 28 User’s Guide For example, to set the IP address and subnet mask of the MGT interface to 10.100.2.183 and 16, respecti vely: set interface mgt ip 10.100.2.183 /16 3. To confirm the new port setting s, execute the following co mmand: get interface mgt Setting the IP Address for the Trust Zone Interface The NetScr[...]

Configuring the Device for Telnet and WebUI Sessions NetScreen-5000 Series 29 3. Set the IP address an d subnet mask by executing the following command: set interface ethernet2/3 ip ip_ad dr / mask where ip_addr is the IP address and mask is the subnet mask . For example, to set the IP address and subnet mask of the ethernet2/3 interface to 172.16.[...]

Chapter 3 Configuring the Device 30 User’s Guide For example, if the MGT interface has an address of 10.100.2.183 , then enter: telnet 10.100.2.183 3. At the Userna me prompt, ty pe your user name (default is netscreen ). 4. At the Password prompt, type your password (default is netscreen ). 5. (Optional) By de fault, the console time s out and t[...]

Configuring the Chassis Alarm NetScreen-5000 Series 31 For example, if you assigned the MGT interface an IP address of 10.100.2.183 /16, then enter: http://10.100.2.183 The NetScreen WebUI software displays the login prompt. 3. Enter netscreen in both the Admin Name and Password fields, and then click Login . (Use lowercase le tters only. The Admin[...]

Chapter 3 Configuring the Device 32 User’s Guide C ONFIGURING J UMBO F RAMES The 5000-8G2 and 5000-2 XGE SPMs support jumbo frames that are up to 9,830 bytes. To set jumbo frames, use the set environment max-frame-si ze=9830 CLI command. You must reboot the system before this feature can take effect. C ONFIGURING A GGREGATE I NTERFACES The NetScr[...]

Using CLI Commands to Reset the Device NetScreen-5000 Series 33 4. (Optional) To see the updated port list and detail s about the new aggregate interface: get interface get interface aggregate1 Notice that the listing contains aggregate1 , an aggregate interface comprised of ethernet2/1 and ethernet2/2. This aggreg ate interface runs with a through[...]

Chapter 3 Configuring the Device 34 User’s Guide 3. Press the y key. The following message appears: !! Reconfirm Lost Password Reset !! If you continue, the entire configuration of the device will be erased. In addition, a permanent coun ter will be incremented to signify that this device has been reset. Th is is your last chance to cancel this c[...]

NetScreen-5000 Series 35 4 Chapter 4 Servicing the Device This chapter deta ils service and mainte nance of various components in your NetScreen-5000 Series system. To pics in this chapter include: • “Removing and Reseating Modules” on page 36 • “Replacing a DC Power Supply” on page 36 • “Replacing an AC Power Supply” on page 37 ?[...]

Chapter 4 Servicing the Device 36 User’s Guide R EMOVING AND R ESEATING M ODULES Although NetScreen-500 0 Series modules are pr e-installed before shipping, you may find it necessary to remove or reseat modules to suit the special security ne eds of your network. To remove a module from a NetScreen-5000 Series sy stem: 1. Release the module from [...]

Replacing an AC Power Supply NetScreen-5000 Series 37 R EPLACING AN AC P OWER S UPPLY To replace an AC power supply : 1. Turn off the pow er supply. 2. Lift the AC power cord retainer clip. 3. Unplug the cord fr om the power supply. 4. Turn the thumbscrew counterclockw ise to release the power supply. 5. Lift and grip the lever, and then gently pul[...]

Chapter 4 Servicing the Device 38 User’s Guide NetScreen-5200 Fan Module To remove the fan modu le on a NetScreen-5200: 1. Pull the fan l ever until it i s fully extende d. 2. Grip the sides, then gently slide the assembly straight out. 3. Insert the new fan module in the fa n bay, then push it straight in. 4. Secure the fan module in place by pu[...]

Replacing the Fan Module NetScreen-5000 Series 39 NetScreen-5200 Fan Tray Filter Before you replace the fan tray filter, make sure you have the f ollowing tools: • Flashlight or other light source • 18-inch wooden ruler To replace the fan tray filter: 1. Remove the fan tray (See “NetScreen-5200 Fan Module” on page 38 ). 2. Pull the front ed[...]

Chapter 4 Servicing the Device 40 User’s Guide 7. Once the filter is f ully inserted, push the wooden ruler against the filters surface several times to insure that the filter is secure against the chassis wall. 8. Insert the fan tray into the chassis. 9. Lock the fan lever. NetScreen-5400 Fan Module To replace th e fan modul e on a Ne tScreen-54[...]

Replacing the Fan Module NetScreen-5000 Series 41 3. Align the new fan mod ule in the fan bay, a nd then push it straight in . 4. Secure the fan module i n place by tightening the thum bscrews clockwise.[...]

Chapter 4 Servicing the Device 42 User’s Guide NetScreen-5400 Fan Tray Filter To replace the fan tray filter: 1. Remove the fan tray (See “NetScreen-5400 Fan Module” on page 40 ). 2. Lay the fan tray filter up. 3. Pull the filter fro m the Velcro ba cking. 4. Replace the filter. 5. Align the new fan mod ule in the fan bay, a nd then push it s[...]

Connecting and Disconnecting Gigabit Ethernet Cables NetScreen-5000 Series 43 C ONNECTING AND D ISCONNECTING G IGABIT E THERNET C ABLES To connect a Gigabit Ethernet cable to a mini-GBIC connect or transceiver port: 1. Hold the cable clip firmly but gently between your thumb an d forefinger, with your thumb on top of the clip and your finger under [...]

Chapter 4 Servicing the Device 44 User’s Guide[...]

NetScreen-5000 Series I A Appendix A Specifications This appendix provid es general system specificatio ns for the NetScreen-5000 Series. • “NetScreen-5200 Attributes” on page A-II • “NetScreen-5400 Attributes” on page A-II • “Electrical Specification” on page A-II • “NEBS Certific ations” on page A-I II • “Safety Certif[...]

Appendix A Specifications II User’s Guide N ET S CREEN -5200 A TTRIBUTES Height: 3.4 inches (8.6 cm) Depth: 19.5 inches (49.5 cm) Width: 17.5 inches (44.5 cm) Weight: 32 pounds (without power supply) (1 5 kg) N ET S CREEN -5400 A TTRIBUTES Height: 8.62 inches (21.89 cm) Depth: 14 inches (35 cm) Width: 17.5 inches (44.5 cm) Weight: 42 pounds (with[...]

NetScreen-5000 Series III NEBS C ERTIFICATIONS Level 3 NetScreen-5200 with DC power supply. GR-63-Core: NEBS, Environment al Testing GR-1089-Core: EMC an d Electrical Safety for Ne twork Telecommunications Equipment S AFETY C ERTIFICATIONS UL, CUL, CSA, CE, CB EMI C ERTIFICATIONS FCC class A, CE class A, C-Tick, VCCI class A C ONNECTORS The RJ-45 t[...]

Appendix A Specifications IV User’s Guide The following table show s the 10-Gigabit media types and di stances for the different types of connect ors used with the NetScreen-5000 Series systems. Standard Media Type Mhz/Km Rating Maximu m Distance 1000 Base-SR 62.5/125µm Multimode Fiber 160 220 m 62.5/125µm Multimode Fibe r 200 275 m 1000 Base-L[...]

NetScreen-5000 Series I B Appendix B Port Descriptions and LED Status This appendix provid es detail on port des criptions and LED status for th e NetScreen-5000 Series modules. • “Module Port Descriptions” on page B -II • “Module LED Descriptions” on page B-III • “Status LED States” on page B-IV • “Power Supply LEDs” on pag[...]

Appendix B Port Descri ptions and LED Status II User’s Guide M ODULE P ORT D ESCRIPTIONS The following table describes th e ports on the 5000-M and 5000-M2 management modules. The following table describes th e ports on the 5000-8G Secure Port Module (SPM). The following table detail s the ports on the 5000-2G24FE SPM. Port Description Type Speed[...]

NetScreen-5000 Series III The following table detail s th e ports on the 5000-8G2 SPM. The following table detail s th e ports on the 5000-2XGE SPM. M ODULE LED D ESCRIPTIONS This section provides descriptions of the LEDs on NetScre en-5000 Series modules. Two types of LEDs exis t on the modules: • Status LEDs. These LEDs reflect certain co nditi[...]

Appendix B Port Descri ptions and LED Status IV User’s Guide S TATUS LED S TATES This section describes Status LED states on all modules. Interpreting Status LE Ds for the Management Modules The Status LEDs indicate whether the mana gement module is op erating properl y. The following table describes the st atus possibilities for each. LED LED Co[...]

NetScreen-5000 Series V Interpreting Status LEDs for the Secure Port Module The Status LEDs indicate whether the Secure Port Module is operating properly . The following table describes the st atus possibilities for each. Interpreting Ethernet Port Status LEDs for All Modules The port Status LEDs indicate whether any of the ports on the modules are[...]

Appendix B Port Descri ptions and LED Status VI User’s Guide P OWER S UPPLY LED S The following tables describe LED behavi ors on the 5000-M and 5000-M2 for different combinations of functioning p ower supplies. Interpreting Power Supply LED Status for the NetScreen-5200 The following table detail s the LED behavior s on the 5000-M and 5000-M2 fo[...]

NetScreen-5000 Series VII F AN LED The following table describes th e Fan LED on both the NetScreen-5200 and NetScreen-5400 chassis. LED Color Meaning of the LED green Fans are operating. off Power is off.[...]

Appendix B Port Descri ptions and LED Status VIII User’s Guide[...]

Index NetScreen-5000 Series IX-I Index Numerics 5000-2G24FE, description 9 5000-2XGE, description 11 5000-8G description 8 figure 8 port status LEDs V system status LEDs V 5000-8G2 description 10 figure 10, 11 port status LEDs V system status LEDs V 5000-M figure 6 system status LEDs IV 5000-M2 figure 7 system status LEDs IV A AC power supply 4 rep[...]

Index IX-II User’s Guide 5000-8G 8 5000-8G2 10, 11 5000-M 6 5000-M2 7 allowable slots 5 installing 5 management module 6 secure port modules 7 mounting mid-mount rack installation 16 rear and front rack installation 15 N NetScreen publications viii NetScreen-5000 connecting to a router or switch 19 connecting to other devices 18 modules 5 NetScre[...]