Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II

Network and Security Manager

NSMXpress Series II Quick Start

November 17, 2010

Revision 1

NSMXpress Series II is an appliance version of Network and Security Manager (NSM).

NSMXpress Series II simplifies the complexity of network administration by providing a

single, integrated management interface that controls device parameters.

This robust hardware management system installs in minutes with full high availability

(HA) support, making it easy to scale and deploy. Enterprise customers with limited

resources can benefit significantly from NSMXpress Series II because it eliminates the

need to have dedicated resources for maintaining a network and security management

solution.

NSMXpress Series II makes it easy for administrators to control device configuration,

network settings, and security policy settings for multiple families of Juniper devices

including:

•IDP Series Intrusion Detection and Prevention Appliances and Firewall and VPN devices

running ScreenOS

•Devices running Junos OS, such as J Series Services Routers, SRX Series Services

Gateways, EX Series Ethernet Switches, M Series Multiservice Edge Routers, and MX

Series Ethernet Services routers

•SA Series SSL VPN Appliances

•IC Series Unified Access Control Appliances

For a complete list of supported device families and platforms, see the Network and

Security Manager Administration Guide.

Up to 10 administrators can log into NSMXpress Series II concurrently.

This quick start explains the following steps for installing and configuring NSMXpress

Series II and for configuring NSM.

1. Install the NSMXpress Series II appliance hardware.

2. Set up the NSMXpress Series II appliance using the serial port.

3. Configure the NSMXpress Series II software using the Web interface.

4. Configure the NSM software which is preinstalled onto the NSMXpress Series II

appliance, with site-specific parameters.

Contents HardwareInstallation.................................................4

NSMXpressSeriesIIPorts.........................................4

InstallingtheHardware............................................5

InitialSetupConfiguration.............................................7

BootNSMXpressSeriesII..........................................8

SetUpYourAppliance............................................8

WebInterfaceConfiguration....................................9

ConfiguringtheNSMSoftware.........................................9

ConfiguringBasicSettings........................................10

ConfiguringHighAvailability.......................................12

AdvancedOptions...............................................15

Enabling and Configuring Remote Replication of the Database . . . . . . . 16

Enabling and Configuring SRS (Regional Server Only) . . . . . . . . . . . . . . . 17

InstallingNSMSoftware..........................................18

ManagingNSMAdministration........................................18

ChangingtheSuperuserPassword..................................18

Downloading NSM MIBS (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . 19

ExportingAuditLogs.............................................19

Exporting Device Logs (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . . . 19

Generating Reports (Regional Server Only) . . . . . . . . . . . . . . . . . . . . . . . . . . 20

ModifyingNSMConfigurationFiles.................................20

BackingUptheNSMDatabase.....................................21

ChangingtheNSMManagementIP.................................22

SchedulingSecurityUpdates......................................22

ManagingSystemAdministration......................................23

Rebooting or Shutting Down NSMXpress Series II . . . . . . . . . . . . . . . . . . . . . . 23

ChangingtheUserPassword......................................24

ConfiguringtheNetwork..........................................24

Network Interfaces ..........................................24

RoutingandGateways........................................25

HostnameandDNSClients...................................25

HostAddresses.............................................26

ManagingRADIUSServers........................................26

AddingaRADIUSServer......................................27

Changing the Priority of RADIUS Servers . . . . . . . . . . . . . . . . . . . . . . . . . 28

DeletingaRADIUSServer.....................................28

Editing RADIUS Server Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

MonitoringwithSNMP...........................................29

SNMPConfiguration .........................................29

SNMPSystemInformation....................................30

SNMPTrapConfiguration......................................31

NSMXpress Quick Start

ForwardingSyslogMessages......................................32

ViewingSyslogReceivers......................................32

Adding and Configuring Syslog Receivers . . . . . . . . . . . . . . . . . . . . . . . . . 33

Editing Syslog Receiver Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

DeletingSyslogReceivers.....................................35

ChangingtheSystemTime.......................................35

InstallingUpdates...............................................35

Managing Users ................................................36

Creating New NSMXpress Series II Users . . . . . . . . . . . . . . . . . . . . . . . . . 36

DeletingaUser..............................................38

EditingUserAttributes.......................................38

UnderstandingUserProfiles...................................38

ConfiguringtheWebInterface.....................................40

MaintainingNSMXpressSeriesII.......................................40

ViewingSystemStatistics........................................40

CPU.......................................................41

LogRate...................................................41

CPULoad ..................................................41

Memory Data ...............................................41

NetworkData...............................................41

ProcessCount...............................................41

DiskData...................................................41

TileAllGraphs...............................................41

UpgradingtheRecoveryPartition...................................42

Troubleshooting....................................................43

AuditingUserOperations.........................................43

Error Logs .....................................................44

NetworkUtilities................................................45

Ping ......................................................45

Traceroute .................................................46

Lookup ....................................................47

IPSubnetCalculator.........................................47

Tech Support ..................................................48

ViewingSystemInformation..........................................48

Rack-Mounting the NSMXpress Series II Appliance . . . . . . . . . . . . . . . . . . . . . . . . 49

Front-MountingFlushtoRack.....................................49

Front-MountingRecessedinRack..................................50

Front-Rear-MountingFlushtoRack.................................51

Front-Rear- Mounting Recessed in Rack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Mid-Mount in Two Post Equipment Rack . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

ListofTechnicalPublications.........................................53

RequestingTechnicalSupport........................................54

Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

OpeningaCasewithJTAC........................................55

RevisionHistory....................................................56

Hardware Installation

We recommend that you install NSMXpress Series II on your LAN to ensure that it can

communicate with your applicable resources, such as authentication servers, DNS servers,

internal Web servers through HTTP/HTTPS, external Web sites through HTTP/HTTPS

(optional), the Juniper update server via HTTP, Network File System (NFS) file servers

(optional), and client/server applications (optional).

NOTE: If you decide to install NSMXpress Series II in your DMZ, ensure that

it can connect to your internal resources.

NSMXpress Series II Ports

Table 1 on page 4 provides required port information on the NSMXpress Series II.

Table 1: Required Ports on NSMXpress Series II

Depends on

ConfigurationInternetLANDescriptionPortDirection

NoNoYesSSH command-line management22In

NoNoYesWeb interface for administrator

443

YesYesLANWeb interface for listening for NSM

API messages.

8443

NoYesYesConnections from managed

devices to NSMXpress Series II

7800

NoNoYesConnections from the NSM GUI

Client to NSM

7801

YesNoYesHeartbeat between peers in an HA

cluster

7802

YesYesYesConnections from managed IDP

devices to NSM

7803

YesYesYesConnections from devices running

Junos , Secure Access devices, or

Infranet Controller devices

7804

NSMXpress Quick Start

Table 1: Required Ports on NSMXpress Series II (continued)

Depends on

ConfigurationInternetLANDescriptionPortDirection

NoYesYesSSH connection to new managed

device

22Out

YesNoYesTelnet connection to new

managed device

NoNoYesDNS lookups53

YesYesNoSystem Security Updates from

Juniper Networks

YesNoYesShared Disk portmap lookup111

YesYesYesNetwork Time Protocol (NTP) time

synchronization

123

YesNoYesShared Disk NFS connection2049

For more information on ports, refer to the Network and Security Manager Installation

Guide.

Installing the Hardware

Follow these steps to unpack the NSMXpress Series II appliance and connect it to your

network.

To install NSMXpress Series II:

1. Place the shipping container on a flat surface and remove the hardware components

with care.

2. Remove the NSMXpress Series II device from the shipping container and place it on

a flat surface.

3. Mount NSMXpress Series II in your server rack using the attached mounting brackets.

4. Plug the power cord into the AC receptacle on the rear panel.

Hardware Installation

Figure 1: Rear Panel of NSMXpress Series II

g040042

Power

supply

AC Power

supply

receptacle

AC Power Blank power

supply tray

switch

Fan 0 Fan 1

If your NSMXpress Series II contains two power supplies, plug a power cord into each

AC receptacle.

5. Plug the other end of the power cord into a wall socket.

If your NSMXpress Series II contains two power supplies, plug each power cord into

a separate power circuit to ensure that the NSMXpress Series II continues to receive

power if one of the power circuits fails.

6. Plug the Ethernet cable into the network port marked ETH0 on the front panel. See

Figure 2 on page 6.

Figure 2: Front Panel of NSMXpress Series II

CONSOLE ETH1 ETH0

g040404

Power

LED

Hardware

LED

Hard disk LED

Left

LAN

LED

Right

LAN

LED

NSMXpress II

Hard disk

Activity LED

Hard disk

Failure LED

Network ports

Console

port

USB

maintenance

port

7. Plug the console cable with the DB9 to RJ45 adapter into the console port. See Figure

2 on page 6.

This cable was shipped with your NSMXpress Series II. See Table 3 on page 7

8. Push the power button on the rear panel. See Figure 1 on page 6

The green LED on the bottom left corner of the front panel turns on. The NSMXpress

Series II hard disk LED turns on whenever the appliance reads data from or writes data

to an NSMXpress Series II hard disk.

The internal port uses two LEDs to indicate the LAN connection status, which is

described in Table 2 on page 7.

Hardware installation is now complete. The next step is to set up the software, as

described in “Initial Setup Configuration” on page 7.

NSMXpress Quick Start

Table 2 on page 7 provides LED information for the ETH0 and ETH1 ports.

Table 2: Ethernet Port LEDs

LED2LED 1LAN Status

OffOff10 Mbps connection

OffGreen100 Mbps connection

OffOrange1000 Mbps connection

BlinkingOrange, Green, or OffData is being transferred

OffOffNo connection

Table 3 on page 7 provides RJ-45 Console Connector Pinout information.

Table 3: RJ-45 Console Connector Pinout

DescriptionSignalPin

Request to SendRTS Output1

Data Terminal ReadyDTR Output2

Transmit DataTxD Output3

Chassis GroundGND4

Chassis GroundGND5

Receive DataRxD Input6

Data Set ReadyDSR Input7

Clear to SendCTS Input8

Initial Setup Configuration

When you first turn on an unconfigured NSMXpress Series II appliance, you need to enter

basic network and machine information through the serial console to make your appliance

accessible to the network. After entering these settings, you can continue configuring

the appliance using the CLI or the Web interface. You are not prompted for the initial

setup information again.

Initial Setup Configuration

This section describes the required serial console setup and the tasks you need to perform

when connecting to your NSMXpress Series II for the first time:

•Boot NSMXpress Series II on page 8

•Set Up Your Appliance on page 8

Boot NSMXpress Series II

To configure NSMXpress Series II for the first time, you must attach your NSMXpress

Series II appliance to a console terminal running an emulation utility such as

HyperTerminal.

1. Configure a console terminal or terminal emulation utility to use the following serial

connection parameters:

•9600 bits per second

•8-bit no parity (8N1)

•1 stop bit

•No flow control

2. Connect the terminal or laptop to the null modem serial cable plugged into the

NSMXpress Series II console port.

3. Turn on the NSMXpress Series II appliance.

When NSMXpress Series II is powered on, the serial console displays diagnostic

information before proceeding to the boot countdown. When complete, the serial

console displays the login prompt terminal emulator.

NSMXpress.juniper.net login:

4. Enter admin as your default login name.

5. Enter abc123 as your default password.

6. Change your default password when prompted. Enter the default password first,

followed by your new password. All passwords are case-sensitive.

Set Up Your Appliance

This section provides the minimum information necessary to make your appliance active

on the network.

To set up your appliance either as a regional server or a central manager, follow these

steps:

1. Enter the IP address for interface eth0 and press Enter.

2. Enter the subnet mask for interface eth0 and press Enter.

3. Enter the default route or default gateway address for interface eth0 and press Enter.

Applying changes...

Re-loading database

NSMXpress Quick Start

Done!

Your NSMXpress is now active on the network.

To configure your system via a web browser, connect to:

https://10.150.43.205/admin

To configure your system via command line, type:

nsm_setup

For operation of NSM server, switch to user “nsm”.

Please consult NSM product documentation for details.

[admin@NSMXpress ~]$

To configure the NSM software using the CLI, see the NSMXpress and NSM 3000 User

Guide. To configure the NSM software using the Web interface, go to “Web Interface

Configuration” on page 9.

Web Interface Configuration

To configure NSM on your system from a Web interface, use the following steps.

1. Copy the URL (starting with https://) from the terminal emulator after installing

NSMXpress:

Your NSMXpress is now active on the network.

To configure your system via a web browser, connect to:

https//10.150.43.205/administration

2. Open a Web browser and paste the URL into the address text box.

3. Press Enter to open the NSMXpress Series II login page.

4. Enter the admin user name and password and then click Login.

5. See “Configuring the NSM Software” on page 9 for details about how to install and

configure NSM on your NSMXpress Series II appliance from the Web interface.

Configuring the NSM Software

After logging in as an ‘admin’ user, an initial setup script walks you through additional

configuration system settings before finalizing the NSM installation. This chapter describes

that setup process.

Your NSMXpress Series II appliance comes preconfigured as a regional server or a central

manager. Most installation and configuration steps in this section are identical for both

types of server. All exceptions are noted.

Configuring the NSM Software

After logging into the NSMXpress Series II Web interface, NSMXpress Series II provides

you with the following installation options:

•Configuring Basic Settings on page 10

•Configuring High Availability on page 12

•Advanced Options on page 15

•Installing NSM Software on page 18

Configuring Basic Settings

To install the regional server or central manager software using the minimum

requirements:

1. Install your NSMXpress Series II hardware as described in “Hardware Installation” on

page 4.

2. Boot and setup your NSMXpress Series II appliance as described in “Initial Setup

Configuration” on page 7.

3. Enter the https://<ip>/administration URL for your appliance in a Web browser. See

“Web Interface Configuration” on page 9 for details.

4. Log into the Web interface. The System Info page opens.

5. Click the link Install NSM Regional Server (see Figure 3 on page 11) to go to the Install

Regional Server window or click the Install NSM Central Manager link to view the Install

NSM Central Manager window (see Figure 4 on page 11), as the case may be.

NOTE: The “admin” user default username is admin and the password is

the one you created in Step 6 of “Boot NSMXpress Series II” on page 8.

NSMXpress Quick Start

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Juniper Software

Juniper

Juniper JUNOSE 11.2.X PHYSICAL LAYER Manuale utente

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Manuale di istruzioni

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE... Manuale utente

Juniper

Juniper JUNOS PUS MOBILE SECURITY SUITE Manuale utente

Juniper

Juniper JUNOS SPACE 2.0 - RELEASE NOTES Manuale utente

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV... Manuale di istruzioni

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER - APPLICATION CONFIGURATION GUIDE REV... Manuale utente

Juniper

Juniper JUNOS OS 10.4 - XML API OPERATIONAL Manuale

Juniper

Juniper JUNOSE 11.1.X - COMMAND REFERENCE A TO M... Manuale di installazione

Juniper

Juniper MWS1000 Istruzioni per l'installazione

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT... Manuale utente

Juniper

Juniper SERVICE AVAILABILITY - CONFIGURATION GUIDE V... Manuale utente

Juniper

Juniper TEPM AGENT - RELEASE NOTES 17-12-10 Manuale di istruzioni

Juniper

Juniper JUNOSE 10.0.X PHYSICAL LAYER Manuale utente

Juniper

Juniper NETWORKS STRM - TECHNICAL NOTE REV 6-2008 Manuale utente

Juniper

Juniper JUNOS SOFTWARE 10.2 - SOFTWARE INSTALLATION AND UPGRADE GUIDE... Manuale di installazione e funzionamento

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - REV1 Manuale utente

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - QUALITY OF SERVICE CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper JUNOSE 11.1.X MULTICAST ROUTING Manuale utente

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - INSTALLATION... Manuale utente

Juniper

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE... Manuale di istruzioni

Juniper

Juniper JUNOSE SOFTWARE 11.2.X - BROADBAND ACCESS CONFIGURATION GUIDE... Manuale utente

Juniper

Juniper MEDIA FLOW PUBLISHER Manuale utente

Juniper

Juniper CARE PLUS Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Juniper NETWORK AND SECURITY MANAGER NSMXPRESS SERIES II - ... Manuale utente

Manuali Software popolari di altre marche