#Delete the entire configuration (not factory default, wipe config)
delete
#Copy/Paste Configuration
load override terminal - http://kb.juniper.net/InfoCenter/index?page=content&id=KB16622
#Software Installation/Upgrade (firmware)
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16652
#Save (commit) changes
commit
#Check that commit will work and is not missing any necessary statements (this does not mean that it will work for getting online)
commit check
#Have commit rollback in x (5 minutes) if another commit is not performed, x can be any number
commit confirmed 5
#Set hostname on device
set system host-name
#Set root password
set system root-authentication plain-text-password
#Create a new admin user ([name] in most cases will or should be admin)
set system login user [name] class super-user authentication plain-text-password
#Set IP on fe0/0/0 [check x.x.x.x/x against their current firewall, if its one IP most likely /24 actually but the subnet tends to be 255.255.255.0 on current firewalls]
set interfaces fe-0/0/0 unit 0 family inet address x.x.x.x/x [probably /24 unless its a /29 or /30]
#Set IP on VLAN (internal/trusted network - check x.x.x.x/x against their current firewall) (MAKE SURE that you delete the default vlan network off if you add one as well)
set interfaces vlan unit 0 family inet address x.x.x.x/x
#Set default gateway [check x.x.x.x against what the current firewall gateway is set to]
set routing-options static route 0.0.0.0/0 next-hop x.x.x.x
#Delete DHCP (ONLY IF DHCP IS NOT BEING DONE BY PREVIOUS/CURRENT FIREWALL)
delete system services dhcp
#Save Rescue Config (eliminates orange alarm light as well, to be ran when finished with config and you don't run it from configure mode)
request system configuration rescue save
#Application for Firewall rules (example for tcp636 application, the tcp636 portion is the name that is created for the application below)
set applications application tcp636 protocol tcp
set applications application tcp636 destination-port 636
set applications application tcp3389 protocol tcp
set applications application tcp3389 destination-port 3389
#Firewall rules - Incoming/Inbound (the NAT portion) (keep source 0.0.0.0/0 and then lockdown in security policy portion) (pool name for example is name of server and address is /32 of
server for that one address) (destination-address is always going to be a /32 even if the external wan interface is a /29 for example, take what that single IP is listed and put it as
a /32 unless otherwise noted)
set security nat destination pool [poolname] address x.x.x.x/x
set security nat destination rule-set inbound-nat rule from zone untrust
set security nat destination rule-set inbound-nat rule [namehere] match source-address 0.0.0.0/0
set security nat destination rule-set inbound-nat rule [namehere] match destination-address x.x.x.x/32
set security nat destination rule-set inbound-nat rule [namehere] match destination-port xx
set security nat destination rule-set inbound-nat rule [namehere] then destination-nat pool [poolname]
#Firewall rules - Security Policies Incoming/Inbound (the opening and lockdown portion)
set security policies from-zone untrust to-zone trust policy xxxx-in[ex http-in] match source-address any
set security policies from-zone untrust to-zone trust policy xxxx-in[ex http-in] match destination-address [trusted address-book address, going from source to this trusted address]
set security policies from-zone untrust to-zone trust policy xxxx-in[ex http-in] match application junos-xxx
set security policies from-zone untrust to-zone trust policy xxxx-in[ex http-in] then permit
#Firewall rules - Outgoing/Outbound (rules other than the default listed aren't on every firewall, default posted)
set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any
set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit
#Create an Address (this is an example of a trusted/internal computer or server)
set security zones security-zone trust address-book address trust-net 10.1.1.0/24
set security zones security-zone trust address-book address Bob-PC 10.1.1.1/32
#Create an Address Set (Groups) (this is an example of trusted/internal computers or servers clusters or groups)
set security zones security-zone trust address-book address-set All10 address trust-net
set security zones security-zone trust address-book address-set All10 address Bob-PC
#Create an Address (this is an example of a untrusted/external computer or server)
set security zones security-zone untrust address-book address example1 x.x.x.x/32
set security zones security-zone untrust address-book address example2 x.x.x.x/32
#Create an Address Set (Groups) (this is an example of untrusted/external computers or servers like example3 [example1/example2]) (NEEDS ADDRESS ABOVE MADE)
set security zones security-zone untrust address-book address-set example3 address example1
set security zones security-zone untrust address-book address-set example3 address example2
#Bridge Interfaces (cleans up config, fyi will need to run "delete interfaces f0/0/X" after this to truly clean them up)
set interfaces interface-range interfaces-trust member fe-0/0/1
set interfaces interface-range interfaces-trust member fe-0/0/2
set interfaces interface-range interfaces-trust member fe-0/0/3
set interfaces interface-range interfaces-trust member fe-0/0/4
set interfaces interface-range interfaces-trust member fe-0/0/5
set interfaces interface-range interfaces-trust member fe-0/0/6
set interfaces interface-range interfaces-trust member fe-0/0/7
set interfaces interface-range interfaces-trust unit 0 family ethernet-switching vlan members vlan-trust
#For Pulse IPsec VPN (aka mobile user vpn) make sure IKE is running on external interface
set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ike
#Download Junos Pulse Client - or check ftp under Juniper
http://www.juniper.net/support/products/pulse/2.1/#sw
#Show MAC address table (do this from the enable line not configure)
show ethernet-switching table brief
#Remote Management Lockdown (should be cookie cutter) (make sure you add internal lan subnet as well)
set system services web-management https interface fe-0/0/0.0
set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ssh
set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services https
set system services ssh rate-limit 3
set system services ssh root-login deny
set firewall family inet filter local_acl term remote_mgmt from address X.X.X.X/24 (THIS IS THE NETWORK YOU ARE GOING TO ALLOW ADD AS MANY AS NECESSARY)
set firewall family inet filter local_acl term remote_mgmt from protocol tcp
set firewall family inet filter local_acl term remote_mgmt from port ssh
set firewall family inet filter local_acl term remote_mgmt from port https
set firewall family inet filter local_acl term remote_mgmt then accept
set firewall family inet filter local_acl term remote_mgmt_denied from protocol tcp
set firewall family inet filter local_acl term remote_mgmt_denied from port ssh
set firewall family inet filter local_acl term remote_mgmt_denied from port https
set firewall family inet filter local_acl term remote_mgmt_denied then log
set firewall family inet filter local_acl term remote_mgmt_denied then discard
set firewall family inet filter local_acl term default-term then accept
set interfaces lo0 unit 0 family inet filter input local_acl
set interfaces lo0 unit 0 family inet address 127.0.0.1/32
#If you do an IKE VPN you'll need to make these changes
delete firewall family inet filter local_acl term remote_mgmt from port https
delete firewall family inet filter local_acl term remote_mgmt_denied from port https
#Resource cleanup
delete security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services dhcp
delete security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services tftp
set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ping
#Further lockdown and security cleanup (remove the ability to connect to https externally also to not interfere with SSL VPN)
delete system services web-management https interface fe-0/0/0.0
#Set inactivity-timeout
set applications application junos-[xxxx] inactivity-timeout [seconds]
Comments