Foreword |
|
xv | |
Preface |
|
xvii | |
1 Introduction to the SRX |
|
1 | (70) |
|
|
1 | (4) |
|
|
2 | (3) |
|
|
5 | (1) |
|
|
5 | (1) |
|
|
6 | (20) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
Data Center Services Tier |
|
|
12 | (3) |
|
|
15 | (1) |
|
|
16 | (3) |
|
|
19 | (2) |
|
The Junos Enterprise Services Reference Network |
|
|
21 | (5) |
|
|
26 | (1) |
|
|
27 | (19) |
|
|
27 | (3) |
|
|
30 | (2) |
|
|
32 | (4) |
|
|
36 | (3) |
|
|
39 | (3) |
|
|
42 | (1) |
|
Branch SEX Series Hardware Overview |
|
|
42 | (2) |
|
|
44 | (1) |
|
|
45 | (1) |
|
|
46 | (22) |
|
Data Center SRX-Specific Features |
|
|
46 | (2) |
|
|
48 | (1) |
|
|
49 | (2) |
|
Data Center SRX Series Session Setup |
|
|
51 | (4) |
|
Data Center SRX Series Hardware Overview |
|
|
55 | (2) |
|
|
57 | (4) |
|
|
61 | (7) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (2) |
2 What Makes Junos So Special? |
|
71 | (16) |
|
|
72 | (7) |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
75 | (2) |
|
|
77 | (1) |
|
|
78 | (1) |
|
Junos Is Junos Except When It's Junos |
|
|
79 | (1) |
|
Coming from Other Products |
|
|
79 | (5) |
|
|
80 | (2) |
|
|
82 | (1) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
85 | (2) |
3 Hands-On Junos |
|
87 | (38) |
|
|
87 | (1) |
|
|
88 | (1) |
|
|
89 | (6) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
91 | (4) |
|
|
95 | (5) |
|
|
100 | (6) |
|
|
106 | (2) |
|
|
108 | (1) |
|
Junos Configuration Essentials |
|
|
109 | (13) |
|
|
109 | (4) |
|
|
113 | (3) |
|
|
116 | (3) |
|
|
119 | (3) |
|
|
122 | (1) |
|
|
123 | (1) |
|
|
123 | (2) |
4 Security Policy |
|
125 | (68) |
|
|
125 | (3) |
|
|
128 | (2) |
|
Viewing SRX Policy Tables |
|
|
130 | (3) |
|
Viewing Policy Statistics |
|
|
133 | (2) |
|
|
135 | (2) |
|
|
137 | (8) |
|
|
137 | (2) |
|
|
139 | (4) |
|
Blocking Unwanted Traffic |
|
|
143 | (2) |
|
|
145 | (4) |
|
Troubleshooting Security Policy and Traffic Flows |
|
|
149 | (11) |
|
|
150 | (2) |
|
|
152 | (7) |
|
|
159 | (1) |
|
Application Layer Gateway Services |
|
|
160 | (8) |
|
|
163 | (5) |
|
|
168 | (4) |
|
|
170 | (2) |
|
Web and Proxy Authentication |
|
|
172 | (4) |
|
|
172 | (2) |
|
Pass-Through Authentication |
|
|
174 | (2) |
|
|
176 | (8) |
|
|
184 | (4) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
190 | (3) |
5 Network Address Translation |
|
193 | (54) |
|
How the SRX Processes NAT |
|
|
193 | (2) |
|
|
195 | (36) |
|
|
197 | (11) |
|
|
208 | (8) |
|
|
216 | (3) |
|
|
219 | (4) |
|
|
223 | (4) |
|
Case Study 5-1: ISP Redundancy via PAT |
|
|
227 | (4) |
|
|
231 | (1) |
|
|
231 | (9) |
|
Implementing Destination NAT |
|
|
232 | (2) |
|
|
234 | (2) |
|
Tracing Destination NAT Flows |
|
|
236 | (2) |
|
Case Study 5-2: Virtual IP NAT |
|
|
238 | (2) |
|
|
240 | (5) |
|
Case Study 5-3: Double NAT |
|
|
243 | (2) |
|
|
245 | (1) |
|
|
245 | (1) |
|
|
246 | (1) |
6 IPsec VPN |
|
247 | (94) |
|
VPN Architecture Overview |
|
|
248 | (5) |
|
|
248 | (1) |
|
|
249 | (1) |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
251 | (2) |
|
IPsec VPN Concepts Overview |
|
|
253 | (6) |
|
IPsec Encryption Algorithms |
|
|
254 | (1) |
|
IPsec Authentication Algorithms |
|
|
254 | (1) |
|
|
255 | (2) |
|
|
257 | (1) |
|
|
258 | (1) |
|
|
258 | (1) |
|
|
259 | (3) |
|
|
259 | (1) |
|
|
260 | (1) |
|
Phase 1 IKE Negotiation Modes |
|
|
261 | (1) |
|
|
262 | (2) |
|
|
263 | (1) |
|
|
263 | (1) |
|
|
263 | (1) |
|
Flow Processing and IPsec VPNs |
|
|
264 | (1) |
|
|
264 | (4) |
|
|
265 | (1) |
|
|
265 | (3) |
|
|
268 | (7) |
|
|
268 | (1) |
|
|
269 | (1) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
|
271 | (1) |
|
Differentiated Services Code Point |
|
|
272 | (1) |
|
|
272 | (1) |
|
|
273 | (1) |
|
|
273 | (1) |
|
Simple Certificate Enrollment Protocol |
|
|
274 | (1) |
|
|
274 | (1) |
|
|
275 | (1) |
|
Selecting the Appropriate VPN Configuration |
|
|
275 | (4) |
|
|
279 | (30) |
|
|
279 | (1) |
|
Certificate Preconfiguration Tasks |
|
|
279 | (3) |
|
Phase 1 IKE Configuration |
|
|
282 | (11) |
|
Phase 2 IKE Configuration |
|
|
293 | (10) |
|
Configuring Manual Key IPsec VPNs |
|
|
303 | (2) |
|
|
305 | (4) |
|
VPN Verification and Troubleshooting |
|
|
309 | (17) |
|
|
310 | (2) |
|
VPN Tracing and Debugging |
|
|
312 | (14) |
|
|
326 | (11) |
|
Case Study 6-1: Site-to-Site VPN |
|
|
326 | (9) |
|
Case Study 6-2: Remote Access VPN |
|
|
335 | (2) |
|
|
337 | (1) |
|
|
337 | (1) |
|
|
338 | (3) |
7 High-Performance Attack Mitigation |
|
341 | (48) |
|
Network Protection Tools Overview |
|
|
342 | (7) |
|
|
342 | (3) |
|
|
345 | (2) |
|
|
347 | (1) |
|
|
348 | (1) |
|
Protecting Against Network Reconnaissance |
|
|
349 | (5) |
|
|
350 | (1) |
|
|
350 | (2) |
|
|
352 | (1) |
|
|
353 | (1) |
|
Protecting Against Basic IP Attacks |
|
|
354 | (4) |
|
|
354 | (2) |
|
|
356 | (1) |
|
|
357 | (1) |
|
Basic Denial-of-Service Screens |
|
|
358 | (3) |
|
Advanced Denial-of-Service and Distributed Denial-of-Service Protection |
|
|
361 | (2) |
|
|
363 | (1) |
|
|
364 | (1) |
|
|
365 | (5) |
|
|
370 | (2) |
|
|
371 | (1) |
|
|
372 | (5) |
|
|
377 | (1) |
|
|
377 | (4) |
|
|
378 | (1) |
|
|
378 | (2) |
|
|
380 | (1) |
|
|
381 | (4) |
|
|
385 | (1) |
|
|
386 | (1) |
|
|
386 | (3) |
8 Intrusion Prevention |
|
389 | (98) |
|
|
389 | (43) |
|
|
391 | (5) |
|
IPS Packet Processing on the SRX |
|
|
396 | (8) |
|
|
404 | (4) |
|
|
408 | (8) |
|
|
416 | (2) |
|
|
418 | (3) |
|
|
421 | (2) |
|
|
423 | (4) |
|
Custom Attack Groups and Objects |
|
|
427 | (5) |
|
Configuring IPS Features on the SRX |
|
|
432 | (22) |
|
Getting Started with IPS on the SRX |
|
|
432 | (22) |
|
|
454 | (3) |
|
First Steps to Deploying IPS |
|
|
454 | (1) |
|
|
454 | (1) |
|
|
455 | (1) |
|
|
456 | (1) |
|
Day-to-Day IPS Management |
|
|
456 | (1) |
|
|
457 | (9) |
|
|
457 | (1) |
|
Checking Security Package Version |
|
|
458 | (1) |
|
|
458 | (1) |
|
|
459 | (1) |
|
|
460 | (1) |
|
|
461 | (1) |
|
|
462 | (1) |
|
Troubleshooting the Commit/Compilation Process |
|
|
463 | (3) |
|
|
466 | (18) |
|
|
484 | (1) |
|
|
484 | (1) |
|
|
485 | (2) |
9 Unified Threat Management |
|
487 | (52) |
|
|
487 | (36) |
|
|
488 | (1) |
|
|
489 | (9) |
|
|
498 | (8) |
|
|
506 | (2) |
|
|
508 | (6) |
|
Controlling What to Do When Things Go Wrong |
|
|
514 | (2) |
|
|
516 | (5) |
|
|
521 | (2) |
|
|
523 | (7) |
|
|
527 | (1) |
|
|
528 | (2) |
|
Case Study 9-1: Small Branch Office |
|
|
530 | (7) |
|
|
533 | (1) |
|
UTM Policies and Profiles |
|
|
534 | (3) |
|
|
537 | (1) |
|
|
537 | (1) |
|
|
537 | (2) |
10 High Availability |
|
539 | (82) |
|
Understanding High Availability in the SRX |
|
|
540 | (14) |
|
|
540 | (2) |
|
|
542 | (1) |
|
|
543 | (2) |
|
Junos High Availability Concepts |
|
|
545 | (3) |
|
|
548 | (6) |
|
|
554 | (32) |
|
Differences from Standalone |
|
|
554 | (1) |
|
Activating JSRPD (Juniper Services Redundancy Protocol) |
|
|
555 | (2) |
|
|
557 | (1) |
|
Configuring the Control Ports |
|
|
558 | (5) |
|
Configuring the Fabric Links |
|
|
563 | (4) |
|
Node-Specific Information |
|
|
567 | (3) |
|
Configuring Heartbeat Timers |
|
|
570 | (1) |
|
|
571 | (6) |
|
|
577 | (6) |
|
Integrating Dynamic Routing |
|
|
583 | (1) |
|
|
584 | (2) |
|
|
586 | (20) |
|
|
586 | (5) |
|
|
591 | (4) |
|
|
595 | (4) |
|
|
599 | (5) |
|
|
604 | (1) |
|
Preserving the Control Plane |
|
|
605 | (1) |
|
|
605 | (1) |
|
Troubleshooting the Cluster |
|
|
606 | (12) |
|
|
606 | (4) |
|
|
610 | (1) |
|
|
611 | (4) |
|
|
615 | (1) |
|
The Dreaded Priority Zero |
|
|
615 | (2) |
|
|
617 | (1) |
|
|
618 | (1) |
|
|
618 | (1) |
|
|
619 | (2) |
11 Routing |
|
621 | (88) |
|
How the SRX "Routes" IP Packets |
|
|
622 | (4) |
|
|
622 | (2) |
|
|
624 | (1) |
|
|
625 | (1) |
|
Address Resolution Protocol (ARP) |
|
|
626 | (1) |
|
|
626 | (5) |
|
|
627 | (2) |
|
|
629 | (2) |
|
|
631 | (33) |
|
|
632 | (14) |
|
Case Study 11-1: Securing OSPF Adjacencies |
|
|
646 | (2) |
|
Case Study 11-2: Redundant Paths and Routing Metrics |
|
|
648 | (3) |
|
|
651 | (13) |
|
|
664 | (8) |
|
Case Study 11-3: Equal Cost Multipath (ECMP) |
|
|
670 | (2) |
|
|
672 | (16) |
|
|
674 | (8) |
|
|
682 | (1) |
|
Case Study 11-4: Internet Redundancy |
|
|
683 | (5) |
|
|
688 | (5) |
|
Configuring Routing Instances |
|
|
689 | (4) |
|
|
693 | (12) |
|
Configuring Filter-Based Forwarding |
|
|
694 | (3) |
|
Case Study 11-5: Dynamic Traffic Engineering |
|
|
697 | (8) |
|
|
705 | (1) |
|
|
706 | (1) |
|
|
706 | (3) |
12 Transparent Mode |
|
709 | (46) |
|
Transparent Mode Overview |
|
|
709 | (15) |
|
Why Use Transparent Mode? |
|
|
710 | (2) |
|
|
712 | (1) |
|
Transparent Mode and Bridge Loops, Spanning Tree Protocol |
|
|
712 | (1) |
|
Transparent Mode Limitations |
|
|
713 | (1) |
|
Transparent Mode Components |
|
|
714 | (1) |
|
Interface Modes in Transparent Mode |
|
|
715 | (1) |
|
|
715 | (1) |
|
|
716 | (1) |
|
|
716 | (1) |
|
Transparent Mode Security Policy |
|
|
717 | (1) |
|
Transparent Mode Specific Options |
|
|
717 | (1) |
|
|
718 | (1) |
|
|
718 | (1) |
|
High Availability with Transparent Mode |
|
|
718 | (3) |
|
Transparent Mode Flow Process |
|
|
721 | (3) |
|
Configuring Transparent Mode |
|
|
724 | (16) |
|
Configuring Transparent Mode Basics |
|
|
725 | (4) |
|
Configuring Integrated Routing and Bridging |
|
|
729 | (2) |
|
Configuring Transparent Mode Security Zones |
|
|
731 | (1) |
|
Configuring Transparent Mode Security Policies |
|
|
732 | (4) |
|
Configuring Bridging Options |
|
|
736 | (1) |
|
Configuring Transparent Mode QoS |
|
|
736 | (2) |
|
Configuring VLAN Rewriting |
|
|
738 | (2) |
|
Transparent Mode Commands and Troubleshooting |
|
|
740 | (5) |
|
The show bridge domain Command |
|
|
740 | (1) |
|
The show bridge mac-table Command |
|
|
741 | (1) |
|
The show 12-learning global-information Command |
|
|
741 | (1) |
|
The show 12-learning global-mac-count Command |
|
|
742 | (1) |
|
The show 12-learning interface Command |
|
|
742 | (1) |
|
Transparent Mode Troubleshooting Steps |
|
|
743 | (2) |
|
|
745 | (7) |
|
|
752 | (1) |
|
|
752 | (1) |
|
|
753 | (2) |
13 SRX Management |
|
755 | (48) |
|
The Management Infrastructure |
|
|
755 | (6) |
|
|
756 | (2) |
|
|
758 | (3) |
|
|
761 | (1) |
|
|
761 | (2) |
|
|
763 | (3) |
|
|
766 | (23) |
|
|
767 | (7) |
|
Creating a Configuration Template |
|
|
774 | (3) |
|
|
777 | (6) |
|
|
783 | (6) |
|
Keeping Your Scripts Up-to-Date |
|
|
789 | (1) |
|
|
790 | (11) |
|
Case Study 13-1: Displaying the Interface and Zone Information |
|
|
791 | (1) |
|
Case Study 13-2: Zone Groups |
|
|
791 | (1) |
|
Case Study 13-3: Showing the Security Policies in a Compact Format |
|
|
792 | (1) |
|
Case Study 13-4: Track-IP Functionality to Trigger a Cluster Failover |
|
|
793 | (1) |
|
Case Study 13-5: Track-IP Using RPM Probes |
|
|
794 | (2) |
|
Case Study 13-6: Top Talkers |
|
|
796 | (2) |
|
Case Study 13-7: Destination NAT on Interfaces with Dynamic IP Addresses |
|
|
798 | (2) |
|
Case Study 13-8: High-End SRX Monitor |
|
|
800 | (1) |
|
|
801 | (1) |
|
|
801 | (1) |
|
|
801 | (2) |
Index |
|
803 | |