JTAC Recommended Junos Software Versions ( Feb 2014) - SRX

SRX Series Services Gateways

Platform	JTAC Recommended Junos Software by Platform	Release Type	Last updated
SRX100B/H	Junos 11.4R10.3	Standard	08 Jan 2014
SRX100H2 (*1)	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX110H	Junos 11.4R10.3	Standard	28 Jan 2014
SRX110H2	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX210B/H/BE/HE	Junos 11.4R10.3	Standard	08 Jan 2014
SRX210H2	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX220H	Junos 11.4R10.3	Standard	08 Jan 2014
SRX220H2	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX240B/H/B2/H2	Junos 11.4R10.3	Standard	08 Jan 2014
SRX550	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX650	Junos 11.4R10.3	Standard	08 Jan 2014
SRX1400 (*2, 3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX1400 w/NP-IOC (*2, 3)	Junos 12.1X44-D30.4	Standard	04 Feb 2014
SRX3400 (*3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX3400 w/NP-IOC (*3)	Junos 12.1X44-D30.4	Standard	04 Feb 2014
SRX3600 (*3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX3600 w/NP-IOC (*3)	Junos 12.1X44-D30.4	Standard	04 Feb 2014
SRX5400	Junos 12.1X46-D10.2	Standard	08 Jan 2014
SRX5600	Junos 11.4R10.3	Standard	08 Jan 2014
SRX5600 w/NG-SPC (*4)	Junos 12.1X44-D30.4	Standard	03 Feb 2014
SRX5800	Junos 11.4R10.3	Standard	08 Jan 2014
SRX5800 w/NG-SPC (*4)	Junos 12.1X44-D30.4	Standard	03 Feb 2014

Note:
(*1) TSB16272 - U-Boot upgrade recommendation for SRX100H2
(*2) SRX 1400 deployment as a Chassis Cluster requires Junos 11.1 or above
(*3) TSB16273 - Junos software limitation for SRX1400/SRX3400/SRX3600 Routing Engine and SRX3K Switch Fabric Board
(*4) TSB16197 - Intermittent PHY or MAC layer link failure on SRX5600 and SRX5800 with SRX5K-SPC-4-15-320

JUNOS : Install Software via CLI from Junos software copied to USB stick

Follow these steps to install the software via the CLI from a USB stick:

1. Download the Junos upgrade file to the USB stick. 
   
2. Locate the USB device ID that Junos is associating to the USB stick:
   

   user@srx> start shell
user@srx% ls /dev/
   

3. Insert the USB device into the USB slot.  For example, slot 0 would return the following:
   

   root# umass0: USB USBFlashDrive, rev 2.00/1.00, addr 2
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <USB USBFlashDrive 0100> Removable Direct Access SCSI-0 device
da0: 1.000MB/s transfers
da0: 980MB (2007040 512 byte sectors: 64H 32S/T 980C)

   Run the following command
   
   user@srx% ls /dev/
   
   Locate difference in outputs to locate drive label. (It will usually be da#s1, i.e. da0s1)
   

4. Create a mount directory:
   

   user@srx% mkdir /tmp/usb

5. Mount the USB to the directory:
   

   user@srx% mount -t msdosfs /dev/<drivelabel, e.g. #da0s1> /tmp/usb

   Example:
   user@srx% mount -t msdosfs /dev/da0s1 /tmp/usb (there is a space between the label name and /tmp)
   
   Verify that the USB is mounted to the device:
   root@% pwd
/cf/root
root@% cd /var/tmp/usb/
root@% pwd
/cf/var/tmp/usb
root@% ls
junos-jsr-11.4R5.7-export.tgz


6. Exit shell and install the software:
   

   user@srx% exit
user@srx> request system software add /tmp/usb/<upgrade filename> no-validate no-copy

7. Upon completion, reboot the SRX:
   

   user@srx> request system reboot

JUNOS : ACTIVATE YOUR SRX SERIES AND J SERIES FEATURES

Four Easy Steps to Activate Your Juniper Networks Product Features

 

1. Gather your Authorization Code and Device Serial Number.

Authorization Code:

The 16-digit alphanumeric Authorization Code is sent via email in response to your order and is required to generate the license activation key for your SRX Series device. The Authorization Code is required to generate your license key—it is not the actual license key.

Device Serial Number:

The device serial number is a unique 12-digit alphanumeric code used to identify your SRX Series device when generating license keys. You can find the SRX Series device serial number either on the bottom or sides of the unit. You can also find the serial number via the NSM Device Inventory Hardware tab by executing the CLI command, “show chassis hardware,” or through the J-Web Monitor Dashboard.

2. Sign in to the Juniper Networks License Management System at  www.juniper.net/generate_license ,

Select the J Series and SRX Series device link, and follow the instructions in the system user interface.

3. The Juniper License Management System provides you with your license key in one of two ways:

Download your license key to your computer from the Juniper Networks License Management System.

• You receive an email that contains the license key.

4. On the SRX Series Device:

CLI: request system license add terminal > Press Enter >

When prompted, type the license key separating multiple license keys with a blank line > Ctrl-D.

J-Web Interface:

Click Maintain > Licenses and enter the license key in one of the following ways:

•

In the license File URL box, type the URL for the license key website.

•Or copy the license key text, and paste it into the License Key Text box, separating multiple license keys with a blank line.

• Click OK

JUNOS : Configure System Log

By default, control protocol activity is logged as a separate system log facility, dfc. To modify the filename or level at which control protocol activity is recorded, include the following statements at the [edit syslog] hierarchy level:

[edit syslog]

file dfc.log {dfc any;}

To cancel logging, include the no-syslog statement at the [edit services dynamic-flow-capture capture-group client-name control-source identifier] hierarchy level:

[edit services dynamic-flow-capture capture-group client-name control-source identifier]no-syslog;

JUNOS : Require Regular Remote Configuration Backup

Backups of a routers configuration may be necessary when recovering from physical

hardware failure, administrative errors or a successful attack. Preserving the evidence of

an attack may also be necessary for regulatory compliance, forensic investigation or

prosecution of the attacker.

 

By default, JUNOS routers save a local backup copy of your configuration every time you

commit (save) a change. JUNOS maintains the 50 previous configuration files, 4 on theRouting Engines Flash drive and the remainder on the hard disk.

 

This provides a useful method to recover from many types of fault or error, however an

attacker will, potentially, be in a position to compromise these backups along with the

active configuration, so it is vital that you also keep a remote configuration backup

beyond the attackers reach.

 

Remediation:

A discussion of all possible backup methods is beyond the scope of this Benchmark.

Consider the Archival section of this Benchmark for one method of obtaining remote

backups whenever your configuration is changed.

 

Alternatively CVS tools such as RANCID provide an method to backup and configuration

files from a central location as well as keeping track of changes over time.

 

Also consider a method of maintaining offline copies of your backup data, such as tape

storage. This provides a vital tool in Disaster Recovery and is also extremely helpful when

recovering from a successful attack, as you can be certain that the attacker was unable to alter the offline version.

JUNOS : JTAC Recommended Junos Software Versions - SRX (Jan 2014)

SRX Series Services Gateways

Platform	JTAC Recommended Junos Software by Platform	Release Type	Last updated
SRX100B/H	Junos 11.4R10.3	Standard	08 Jan 2014
SRX100H2 (*1)	Junos 12.1X44-D20.3	Standard	05 Aug 2013
SRX110H	Junos 11.4R10.3	Standard	28 Jan 2014
SRX110H2	Junos 12.1X44-D20.3	Standard	05 Aug 2013
SRX210B/H/BE/HE	Junos 11.4R10.3	Standard	08 Jan 2014
SRX210H2	Junos 12.1X44-D20.3	Standard	05 Aug 2013
SRX220H	Junos 11.4R10.3	Standard	08 Jan 2014
SRX220H2	Junos 12.1X44-D20.3	Standard	05 Aug 2013
SRX240B/H/B2/H2	Junos 11.4R10.3	Standard	08 Jan 2014
SRX550	Junos 12.1X44-D20.3	Standard	05 Aug 2013
SRX650	Junos 11.4R10.3	Standard	08 Jan 2014
SRX1400 (*2, 3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX3400 (*3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX3600 (*3)	Junos 11.4R10.4	Standard	08 Jan 2014
SRX5400	Junos 12.1X46-D10.2	Standard	08 Jan 2014
SRX5600	Junos 11.4R10.3	Standard	08 Jan 2014
SRX5600 w/NG-SPC (*4)	Junos 12.1X44-D22	Standard	04 Sep 2013
SRX5800	Junos 11.4R10.3	Standard	08 Jan 2014
SRX5800 w/NG-SPC (*4)	Junos 12.1X44-D22	Standard	04 Sep 2013

(*1) TSB16272 - U-Boot upgrade recommendation for SRX100H2
(*2) SRX 1400 deployment as a Chassis Cluster requires Junos 11.1 or above
(*3) TSB16273 - Junos software limitation for SRX1400/SRX3400/SRX3600 Routing Engine and SRX3K Switch Fabric Board
(*4) TSB16197 - Intermittent PHY or MAC layer link failure on SRX5600 and SRX5800 with SRX5K-SPC-4-15-320

JUNOS : Hit-count tracking

The new show security policies hit-count command displays the utility rate of security policies according to the number of hits they receive. One can use this feature to determine which policies are being used on the device, and how frequently they are used. Depending on the command options that one chooses, the number of hits can be listed without order or sorted in either ascending or descending order, and they can be restricted to the number of hits that fall above or below a specific count or within a range. Data is shown for all zones associated with the policies or named zones.

This feature is supported on following platforms/applications:

SRX100   Junos OS 12.1R1

SRX110   Junos OS 12.1R1

SRX210   Junos OS 12.1R1

SRX220   Junos OS 12.1R1

SRX240   Junos OS 12.1R1

SRX550   Junos OS 12.1R1

SRX650   Junos OS 12.1R1

SRX1400 Junos OS 12.1R1

SRX3400 Junos OS 12.1R1

SRX3600 Junos OS 12.1R1

SRX5600 Junos OS 12.1R1

SRX5800 Junos OS 12.1R1