The J-Web Setup Wizard

• NTP: north-america.pool.ntp.org

• DNS: 8.8.8.8 and 8.8.4.4

• Time zone: PST/Los Angeles

Device name

Enter a hostname.

You can use alphanumeric characters, special characters such as the underscore (_), the hyphen (-), or the period (.); the maximum length is 255 characters.

Username

Displays the root user.

Password

Enter a password.

You can use alphanumeric characters and special characters; the minimum length is six characters.

SSH for root user

Enable this option to allow the root login (to the device) using SSH.

Username

Enter the admin username to manage the device.

Password

Enter the admin password.

Time zone

Select a time zone from the list.

Time source

Select either NTP server, computer time, or Manual to configure the system time:

• NTP Server > NTP servers—Select the NTP server in the Available column and move to the selected column using the right arrow. Once the system is connected to the network, the system time is synced with the NTP server time.

  In addition, to add a new NTP server, click + and enter a hostname or IP address of the NTP server and click OK.

  Note:

  If you want to add more NTP servers, go to Device Administration > Basic Settings > Date & Time Details through the J-Web menu.

• Computer Time > Computer time—Device automatically synchronizes with your computer time only during the setup.

• Manual > Date and time—Select the date and time (in MM-DD-YYYY and HH:MM:SS 24-hour format) to configure the system time manually.

Management interface

Select an interface from the list.

If fxp0 port is your device’s management port, then the fxp0 port is displayed. You can change it as required or you can select None and proceed to the next page.

Management address

Enter a valid IPv4 address for the management interface.

Management subnet mask

Enter a subnet mask for the IPv4 address.

If you have changed the management address, use the new IP address to access J-Web.

Static route

Enter an IPv4 address for the static route to route to the other network devices.

Static route subnet mask

Enter a subnet mask for the static route IPv4 address.

Next hop gateway

Enter a valid IPv4 address for the next hop.

Management access

Enter a valid IPv6 address for the management interface.

Management subnet prefix

Enter a subnet prefix length for the IPv6 address.

Static route

Enter an IPv6 address for the static route if required to reach the device through the management interface.

Static route subnet prefix

Enter a subnet prefix length for the static route IPv6 address.

Next hop gateway

Enter a valid IPv6 address for the next hop.

HTTPS

This option is enabled by default.

SSH

This option is enabled by default.

Ping

Enable this option for ping service.

DHCP

Enable this option for DHCP service.

NETCONF

Enable this option for NETCONF service.

From Zone

Name of the source zone. In the standalone mode, permits all traffic from the trust zone.

To Zone

Name of the destination zone. In standalone mode, permits all traffic from the trust zone to the untrust zone.

Source

Name of the source address (not the IP address) of a policy.

Destination

Name of the destination address.

Application

Name of a preconfigured or custom application of the policy match.

Action

Action taken when a match occurs as specified in the policy.

—Displays the available trust and untrust zones configuration.

Add Trust Zone Interface

Click + to add trust zone interface. For more information on the fields, see Table 3.

Edit Trust Zone Interface

Select an interface and click the pencil icon at the right corner of the table to modify the configuration.

Delete Trust Zone Interface

Select an interface and click the delete icon at the upper-right corner of the table.

A confirmation window appears. Click Yes to delete the selected interface or click No to discard.

Search Trust Zone Interface

Click the search icon at the right corner of the table to quickly locate a zone or an interface.

Detailed View Trust Zone Interface

Hover over the interface name and click the Detailed View icon to view the zone and interface details.

Zone name

View the trust zone name populated from your device factory default settings.

Description

Enter the description for trust zone.

System services

Enable this option for the types of traffic that can reach the device on a particular interface.

By default, this option is enabled. You can disable if required.

Protocols

Enable this option to configure the device to perform stateful network traffic filtering on network packets using network traffic protocols (for example, TCP and UDP).

By default, this option is enabled. You can disable if required.

Application tracking

Enable this option to collect byte, packet, and duration statistics for application flows in the specified zone.

Source identity log

Enable this option for the device to log the user identity information based on the source zone configured in the security policy.

Add Untrust Zone Interface

Click + to add untrust zone interface. For more information on the fields, see Table 4.

Edit Untrust Zone Interface

Select an interface and click the pencil icon at the right corner of the table to modify the configuration.

Delete Untrust Zone Interface

Select an interface and click the delete icon at the upper-right corner of the table.

A confirmation window appears. Click Yes to delete the selected interface or click No to discard.

Search Untrust Zone Interface

Click the search icon at the upper-right corner of the table to quickly locate a zone or an interface.

Detailed View Untrust Zone Interface

Hover over the interface name and click the Detailed View icon to view the zone and interface details.

Zone name

View the untrust zone name populated from your device factory default settings.

Description

Enter the description for untrust zone.

Application tracking

Enable this option to collect byte, packet, and duration statistics for application flows in the specified zone.

Source identity log

Enable this option for the device to log the user identity information based on the source zone configured in the security policy.

DNS server 1

Enter the IPv4 or IPv6 address of the primary DNS.

DNS server 2

Enter the IPv4 or IPv6 address of the secondary DNS.

Default gateway (IPv4)

Enter the IPv4 address of the next possible destination for any network.

Default gateway (IPv6)

Enter the IPv6 address of the next possible destination for any network.

Tap interface

Select the interface from the list.

IP-IP tunnel inspection

Enable this option for the SRX Series Firewall to inspect pass through traffic over an IP-IP tunnel.

GRE tunnel inspection

Enable this option for the SRX Series Firewall to inspect pass through traffic over a GRE tunnel.

From Zone

Name of the source zone. In the Tap mode, permits all traffic from the tap zone.

To Zone

Name of the destination zone. In the Tap mode, permits all traffic from the TAP zone to the TAP zone.

Source

Name of the source address (not the IP address) of a policy.

Destination

Name of the destination address.

Application

Name of a preconfigured or custom application of the policy match.

Action

Action taken when a match occurs as specified in the policy.

Content Security

Enable this option for configuring Content Security services.

License

Enter Content Security license key and click Install License to add a new license.

Content Security type

Select an option to configure Content Security features:

• Web Filtering

• Antivirus

• Antispam

Web filtering type

Select an option:

• Juniper Enhanced—Specifies that the Juniper Enhanced Web filtering intercepts the HTTP and the HTTPS requests and sends the HTTP URL or the HTTPS source IP to the Websense ThreatSeeker Cloud (TSC).

• Local—Specifies the local profile type.

• Websense Redirect—Specifies that the Web filtering module intercepts an HTTP request. The URL in the request is then sent to the external Websense server which makes a permit or a deny decision.

• Juniper NextGen—Intercepts the HTTP and HTTPS traffic and sends URL information or the destination IP address to the Juniper NextGen Web Filtering (NGWF) Cloud. The NGWF Cloud categorizes the URL and provides site reputation information. Based on this information, SRX Series Firewall takes the action on the traffic.

IPS

Enable this option to install the IPS signatures.

License

Enter the license key and click Install License to add a new license.

IPS signature

Click Browse to navigate to the IPS signature package folder and select it. Click Install to install the selected IPS signature package.

ATP Cloud

Enable this option to use Juniper ATP Cloud services.

Security intelligence

Enable this option to use Security intelligence services.

User Firewall

Enable this option to use user firewall services.

Domain name

Enter a domain name for Active Directory.

Domain controller

Enter domain controller IP address.

Username

Enter a username for administrator privilege.

Password

Enter a password for administrator privilege.

Type (family)

• Select Switching. Fields for switching interface are:

  Note:

  This option will be available for only SRX300 Series Firewalls, SRX550M, and SRX1500, and SRX1600 Firewalls. For SRX2300, SRX4100, SRX4200, SRX4300, SRX4600, SRX5000 Series Firewalls, and vSRX Virtual Firewalls, the Type (family) field is not available.

  • IRB interface Unit—Enter the IRB unit.

  • Description—Enter the description for the interface.

• Select Routing. Fields for routing interface are:

  For SRX5000 Series Firewalls, SRX4100, SRX4200, SRX4600, and vSRX Virtual Firewalls, the Type (family) field is not available.

  • Interface—Select an option from list.

  • Interface unit—Enter the Inet unit.

    Note:

    VLAN tagging is enabled automatically if the interface unit is higher than zero.

  • Description—Enter the description for the interface.

  • VLAN ID—Enter the VLAN ID.

    Note:

    VLAN ID is mandatory if the interface unit is higher than zero.

Interfaces

Select an interface from the Available column and move it to the Selected column.

Name

Enter a unique name for the VLAN.

VLAN ID

Enter the VLAN ID.

IPv4 address

Enter a valid IPv4 address for the switching or the routing interface.

Subnet mask

Enter a subnet mask for the IPv4 address.

IPv6 address

Enter a valid IPv6 address for the switching or the routing interface.

Subnet prefix

Enter a subnet prefix for the IPv6 address.

DHCP local server

Enable this option to configure the switch to function as an extended DHCP local server.

Pool name

Enter the DHCP pool name.

Pool start address

Enter the starting IPv4 address of the DHCP server pool address range. This address must be within the IPv4 network.

Pool end address

Enter the ending IPv4 address of the DHCP server pool address range. This address must be within the IPv4 network.

Propagate settings from

Select an option from the list. Propagation of TCP/IP settings (such as, DNS and gateway address) received on the device interface acting as DHCP client.

System Services

Select system services from the list in the Available column and then click the right arrow to move it to the Selected column.

The available options are:

• all—Specify all system services.

• any-service—Specify services on entire port range.

• appqoe—Specify the APPQOE active probe service.

• bootp—Specify the Bootp and dhcp relay agent service.

• dhcp—Specify the Dynamic Host Configuration Protocol.

• dhcpv6—Enable Dynamic Host Configuration Protocol for IPV6.

• dns—Specify the DNS service.

• finger—Specify the finger service.

• ftp—Specify the FTP protocol.

• http—Specify the Web management using HTTP.

• https—Specify the Web management using HTTP secured by SSL.

• ident-reset—Specify the send back TCP RST IDENT request for port 113.

• ike—Specify the Internet key exchange.

• lsping—Specify the Label Switched Path ping service.

• netconf—Specify the NETCONF Service.

• ntp—Specify the network time protocol.

• ping—Specify the internet control message protocol.

• r2cp—Enable Radio-Router Control Protocol.

• reverse-ssh—Specify the reverse SSH Service.

• reverse-telnet—Specify the reverse telnet Service.

• rlogin—Specify the Rlogin service

• rpm—Specify the Real-time performance monitoring.

• rsh—Specify the Rsh service.

• snmp—Specify the Simple Network Management Protocol.

• snmp-trap—Specify the Simple Network Management Protocol trap.

• ssh—Specify the SSH service.

• tcp—encap-Specify the TCP encapsulation service.

• telnet—Specify the Telnet service.

• tftp—Specify the TFTP

• traceroute—Specify the traceroute service.

• webapi-clear-text—Specify the Webapi service using http.

• webapi-ssl—Specify the Webapi service using HTTP secured by SSL.

• xnm-clear-text—Specify the JUNOScript API for unencrypted traffic over TCP.

• xnm-ssl—Specify the JUNOScript API Service over SSL.

Protocols

Select protocols from the list in the Available column and then click the right arrow to move it to the Selected column.

The available options are:

• all—Specifies all protocol.

• bfd—Bidirectional Forwarding Detection.

• bgp—Border Gateway Protocol.

• dvmrp—Distance Vector Multicast Routing Protocol.

• igmp—Internet Group Management Protocol.

• ldp—Label Distribution Protocol.

• msdp—Multicast Source Discovery Protocol.

• nhrp- Next Hop Resolution Protocol.

• ospf—Open shortest path first.

• ospf3—Open shortest path first version 3.

• pgm—Pragmatic General Multicast.

• pim—Protocol Independent Multicast.

• rip—Routing Information Protocol.

• ripng—Routing Information Protocol next generation.

• router-discovery—Router Discovery.

• rsvp—Resource Reservation Protocol.

• sap—Session Announcement Protocol.

• vrrp—Virtual Router Redundancy Protocol.

Interface

Select an interface from the list.

Interface unit

Enter the interface unit value.

VLAN ID

Enter the VLAN ID.

Description

Enter the description for the interface.

Address Mode

Select an address mode for the interface. The available options are DHCP Client, PPPoE (PAP), PPPoE (CHAP) and Static IP.

Username

Enter a username for PPPoE (PAP) or PPPoE (CHAP) authentication.

Password

Enter a password for PPPoE (PAP) or PPPoE (CHAP) authentication.

IPv4 Address

Enter a valid IPv4 address for the interface.

Subnet Mask

Enter a subnet mask for the IPv4 address.

IPv6 Address

Enter a valid IPv6 address for the interface.

Subnet Prefix

Enter a subnet prefix for the IPv6 address.

System Services

Select system services from the list in the Available column and then click the right arrow to move it to the Selected column.

Protocols

Select protocols from the list in the Available column and then click the right arrow to move it to the Selected column.