Setting Up a Logical System

Step-by-Step Procedure

• Configure a root password for the device.

  content_copy zoom_out_map

  user@host# set system root-authentication Talk22rt6
  

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set logical-systems ls-product-design
set system login class ls-design-admin logical-system ls-product-design
set system login class ls-design-admin permissions all
set system login user lsdesignadmin1 full-name lsdesignadmin1
set system login user lsdesignadmin1 class ls-design-admin
set system login user lsdesignadmin1 authentication encrypted-password "$ABC123"
set system login class ls-design-user logical-system ls-product-design
set system login class ls-design-user permissions view
set system login user lsdesignuser1 full-name lsdesignuser1
set system login user lsdesignuser1 class ls-design-user
set system login user lsdesignuser1 authentication encrypted-password "$ABC123"
set system login user lsdesignuser2 full-name lsdesignuser2
set system login user lsdesignuser2 class ls-design-user
set system login user lsdesignuser2 authentication encrypted-password "$ABC123"
set logical-systems ls-marketing-dept
set system login class ls-marketing-admin logical-system ls-marketing-dept
set system login class ls-marketing-admin permissions all 
set system login user lsmarketingadmin1 class ls-marketing-admin
set system login user lsmarketingadmin1 full-name lsmarketingadmin1
set system login user lsmarketingadmin1 authentication encrypted-password "$ABC123"
set system login user lsmarketingadmin2 full-name lsmarketingadmin2
set system login user lsmarketingadmin2 class ls-marketing-admin
set system login user lsmarketingadmin2 authentication encrypted-password "$ABC123"
set logical-systems ls-accounting-dept
set system login class ls-accounting-admin logical-system ls-accounting-dept
set system login class ls-accounting-admin permissions all
set system login user lsaccountingadmin1 full-name lsaccountingadmin1
set system login user lsaccountingadmin1 class ls-accounting-admin
set system login user lsaccountingadmin1 authentication encrypted-password "$ABC123"
set logical-systems interconnect-logical-system

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

1. Create the first user logical system and define its administrator.

   Step-by-Step Procedure

   1. Create the user logical system.

      content_copy zoom_out_map

      [edit]
      user@host# set logical-systems ls-product-design
      

   2. Assign the user login class to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-design-admin logical-system ls-product-design
      

   3. Create the login class to give the user logical system administrator full permission over the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-design-admin permissions all
      

   4. Assign a full name to the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignadmin1 full-name lsdesignadmin1
      

   5. Associate the login class with the user logical system administrator to allow the administrator to log in to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignadmin1 class ls-design-admin
      

   6. Create a user login password for the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignadmin1 authentication plain-text-password
      New password: Talk1234
      Retype new password: Talk1234
      

2. Configure the first user for the logical system.

   Step-by-Step Procedure

   1. Configure the user login class and assign it to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-design-user logical-system ls-product-design
      

   2. To give the first user the ability to see the logical system’s resources and settings but not change them, assign view as the permission to the login class.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-design-user permissions view
      

   3. Assign a full name to the logical system user.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignuser1 full-name lsdesignuser1
      

   4. Associate the login class with the user to allow the user to log in to the user logical system.

      content_copy zoom_out_map

      user@host# set login user lsdesignuser1 class ls-design-user
      

   5. Create a user login password for the user.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignuser1 authentication plain-text-password
      New password: Talk4234
      Retype new password: Talk4234
      

3. Create the second user for logical system ls-product-design.

   Step-by-Step Procedure

   1. Assign a full name to the user.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignuser2 full-name lsdesignuser2
      

   2. Associate the user with the login class to allow the user to log in to the user logical system.

      content_copy zoom_out_map

      user@host# set login user lsdesignuser2 class ls-design-user
      

   3. Create a user login password.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsdesignuser2 authentication plain-text-password 
      New password: Talk9234
      Retype new password: Talk9234
      

4. Create the second user logical system and define its administrator.

   Step-by-Step Procedure

   1. Create the user logical system.

      content_copy zoom_out_map

      [edit]
      user@host# set logical-systems ls-marketing-dept
      

   2. Configure the user login class and assign it to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-marketing-admin logical-system ls-marketing-dept
      

   3. To give the user logical system administrator control over the user logical system, assign all as the permissions to the login class.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-marketing-admin permissions all
      

   4. Assign a full name to the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsmarketingadmin1 full-name lsmarketingadmin1
      

   5. Associate the user logical system administrator with the login class to allow the administrator to log in to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsmarketingadmin1 class ls-marketing-admin
      

   6. Create a user login password for the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsmarketingadmin1 authentication plain-text-password
      New password: Talk2345
      Retype new password: Talk2345
      

5. Create a second user logical system administrator for the ls-marketing-dept logical system.

   Step-by-Step Procedure

   1. Assign a full name to the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsmarketingadmin2 full-name lsmarketingadmin2
      

   2. Associate the user logical system administrator with the login class to allow the administrator to log in to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login lsmarketingadmin2 class ls-marketing-admin
      

   3. Create a user login password for the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsmarketingadmin2 authentication plain-text-password
      New password: Talk6345
      Retype new password: Talk6345
      

6. Create the third user logical system and define its administrator.

   Step-by-Step Procedure

   1. Create the user logical system.

      content_copy zoom_out_map

      [edit]
      user@host# set logical-systems ls-accounting-dept
      

   2. Configure the user login class and assign it to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-accounting-admin logical-system ls-accounting-dept
      

   3. To give the user logical system administrator control over the user logical system, assign permissions to the login class.

      content_copy zoom_out_map

      [edit system]
      user@host# set login class ls-accounting-admin permissions all
      

   4. Assign a full name to the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsaccountingadmin1 full-name lsaccountingadmin1
      

   5. Associate the user logical system administrator with the login class to allow the administrator to log in to the user logical system.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsaccountingadmin1 class ls-accounting-admin
      

   6. Create a login password for the user logical system administrator.

      content_copy zoom_out_map

      [edit system]
      user@host# set login user lsaccountingadmin1 authentication plain-text-password
      New password: Talk5678
      Retype new password: Talk5678
      

7. Configure an interconnect logical system to allow logical systems to pass traffic from one to another.

   content_copy zoom_out_map

   user@host# set logical-systems interconnect-logical-system
   

Results

From configuration mode, confirm your configuration by entering the show logical-systems command to verify that the logical systems were created. Also enter the show system login class command for each class that you defined.

To ensure that the logical systems administrators were created, enter the show system login user command.

If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

user@host# show logical-systems ?
interconnect-logical-system;
ls-accounting-dept;
ls-marketing-dept;
ls-product-design;

user@host# show system login class ls-design-admin 
logical-system ls-product-design;
permissions all;

user@host# show system login class ls-design-user 
logical-system ls-product-design
permissions view;

user@host show system login class ls-marketing-admin 
logical-system ls-marketing-dept;
permissions all;

user@host show system login class ls-accounting-admin 
 logical-system ls-accounting-dept;
permissions all;

user@host show system login user ?
 lsaccountingadmin1   lsaccountingadmin1
lsdesignadmin1       lsdesignadmin1
lsdesignuser2        lsdesignuser2
lsmarketingadmin1    lsmarketingadmin1
lsmarketingadmin2    lsmarketingadmin2

Purpose

Verify that the user logical systems exist and that you, as the primary administrator, can enter them from root. Return from a user logical system to the primary logical system.

Action

From operational mode, enter the following command:

root@host> set cli logical-system ls-product-design
Logical system:ls-product-design
root@host:ls-product-design>

root@host:ls-product-design> clear cli logical-system
Cleared default logical system
root@host> 

root@host> set cli logical-system ls-marketing-dept
Logical system:ls-marketing-dept
root@host:ls-marketing-dept>

root@host:ls-marketing-dept> clear cli logical-system
Cleared default logical system
root@host> 

root@host> set cli logical-system ls-accounting-dept
Logical system:ls-accounting-dept
root@host:ls-accounting-dept>

root@host:ls-accounting-dept> clear cli logical-system
Cleared default logical system
root@host> 

Purpose

Verify that the user logical systems you created exist and that the administrators’ login IDs and passwords that you created are correct.

Action

Use SSH to log in to each user logical system as its user administrator would do.

1. Run SSH specifying the IP address of your SRX Series Firewall.

2. Enter the login ID and password for the administrator for one of the user logical systems that you created. After you log in, the prompt shows the administrator name. Notice how this result differs from the result produced when you log in to the user logical system from the primary logical system at root. Repeat this procedure for all of your user logical systems.

   content_copy zoom_out_map

   login: lsdesignadmin1
   Password: Talk1234
   
   lsdesignadmin1@host: ls-product-design>