NetScreeny a Fortinet

včera 20:11 | Linux - IT

Snad každý se dostane k pěkným hračkám. Dříve jsem kamarádil s NetScreeny, pak Junipery a udělal jsem si k tomu poznámky na (tehdy) twiki. A dnes se hodí ověřit, jak to přenést na Fortinet. Vstupy jsou z historie, výstup mi udělalo AI. PDF nejde přiložit sem, bude v komentáři.        

Komentáře

[vencour]

Příloha:

• juniper-fortinet-upravit-2026-11-09.pdf (550388 bytů)

Základy
• chassis a backup router: set system backup-router [address-of-nexthop-on-fxp0] destination [network-that-ntp-and-mgmt-is-in]
• KB 13428: Difference in chassis cluster support between JUNOS-ES and SRX
• KB 15356: How are interfaces assigned on J-Series and SRX platforms when Chassis Cluster is enabled?
• KB 15504: SRX Getting Started - Configure Chassis Cluster (High Availability) on a SRX240 device
• KB 15439: How do I verify chassis cluster nodes are configured and up on J-Series and SRX?
• KB 16141: What are the minimum hardware and software requirements for a Chassis Cluster (JSRP) on SRX?
• KB 17161: Cannot manage SRX via fpx0 in chassis cluster
• KB 17410: Copy a file from one node to the other node in a JSRP Chassis Cluster
• KB 18181: How to add SRX Chassis Cluster into NSM
• KB 19938: How to schedule upgrade reboot with SRX Chassis Cluster
• KB 20554: Copy OS from primary partition to secondary partition in Chassis Cluster
• KB 20641: Troubleshooting steps when the Chassis Cluster does not come up
• KB 20672: Troubleshooting steps if the Chassis Cluster is in Primary/Lost State
• KB 20673: How to verify that Chassis Cluster in Primary/Secondary State has proper priority
• KB 20687: Troubleshooting steps to correct a Fabric Link that is down in a Chassis Cluster
• KB 20697: Troubleshooting steps if the Chassis Cluster is in Primary/Disabled State
• KB 20795: How-to's and troubleshooting articles for managing a Chassis Cluster
• KB 20861: How can I automatically trigger failover of redundancy-group 0 and redundancy-group 1 at the same time on a Chassis Cluster?
• KB 20987: Troubleshooting Chassis Cluster Redundancy Group not failing over
• KB 21050: Unable to get logs to NSM from Chassis Cluster in stream mode logging
• KB 21113: Can't manage Chassis Cluster (High Availability)
• KB 21145: After setting up SRX650 Chassis Cluster, how can the last remaining onboard port ge-0/0/3 be used for both LAN and WAN links?
• KB 21647: Unable to Process More Than 4 Queues per RETH Interface on SRX High End Devices in a Chassis Cluster
• KB 22431: How to use the local interface in a chassis cluster
• KB 22679: How to prepare a standalone SRX system to join another SRX system configured for chassis cluster (using USB snapshot)
• KB 23862: How to enable/disable Fabric Monitoring

SRX a nat
• TN 81: Junos NAT Configuration Examples Refer to the following Application Note for several configuration examples of how to configure NAT (Source NAT, Destination NAT, Double NAT, and Static NAT)
• TN 25: Configuring (NAT) on SRX and J Series devices for ScreenOS Users
• KB 10139: How to determine if the Source and Destination Address Translation is correct on a J Series or SRX Series device
• KB 13427: What is the total number of sessions supported for source nat pool with PAT on SRX?
• KB 14194: What are the NAT rule limits in on SRX and J-series routers?
• KB 15694: SRX Getting Started - Configuration Examples & Troubleshooting (JumpStation) - *obecné rozcestí*
• kB 15758: SRX Getting Started - Configure NAT
• KB 16252: Troubleshooting NAT in SRX series
• KB 16710: How to define packet filters for NAT traffic?
• KB 17448: Accessing a Static NAT from inside your network
• KB 17525: Can you configure NAT rules on traffic for policy-based VPNs on SRX or J-Series gateways?
• KB 17855: SRX: In "cluster" (HA) environment, the "nat source" with "port no-translation" works differently
• KB 19400: SRX: Configuration Example: How to access Internal Resources using the external Static NAT address
• KB 19459: SRX: DNS queries will not resolve names when Persistent NAT is enabled
• KB 20711: SRX: Scenarios to clarify definition of address-persistent vs persistent-nat
• KB 21296: SRX: Configuration Example -- Persistent NAT (Formerly Cone NAT)
• KB 21547: SRX: Does NAT provide support for traffic processed by 'Selective stateless packet-based services'?
• KB 21611: Resolution Guide - SRX - Troubleshoot Source NAT
• KB 21697: SRX: NAT is not working for device in Junos Packet Mode
• KB 21709: SRX: Verify Source NAT Rules are in order and working correctly
• KB 21719: How to check and interpret the Flow Sessions installed in the SRX when troubleshooting NAT
• KB 21757: SRX: How to interpret Flow TraceOptions output for NAT troubleshooting
• KB 21783: SRX: Example - Checking and reordering NAT rules
• KB 21785: SRX: When and how to configure Proxy ARP
• KB 21839: Resolution Guide – SRX - Troubleshoot Destination NAT
• KB 21872: SRX: Example Firewall Filter used to count the number of incoming packets
• KB 21886: SRX: Verify Destination NAT Rules are in order and working correctly
• KB 21892: Resolution Guide – SRX - Troubleshoot Static NAT
• KB 21918: SRX: Verify Static NAT Rules are being used
• KB 21922: Resolution Guides and Articles - SRX - NAT ... This article provides links to the Resolution Guides and articles for troubleshooting NAT on a SRX device
• KB 22059: SRX: Anti-virus is not working when persistent NAT is enabled
• KB 22178: SRX: The ALG for IKE and ESP is not applied to the traffic
• KB 24709: SRX: Ping to proxy ARP address does not work after 11.2R1

logování apod.
• KB 16224: How to forward Syslogs from SRX to STRM
• KB 16448: Sending logs to NSM from SRX devices
• KB 16502: SRX Getting Started - Configure System Logging
• KB 16509: SRX Getting Started - Configure Traffic Logging (Security Policy Logs) for SRX Branch Devices
• KB 16643: How to configure High-End SRX devices to send traffic logs to NSM
• KB 21450: New knob allow-duplicates added in syslog hierarchy
• KB 21501: Security log hostname is not the same as the primary node hostname
• KB 22193: Syslog timestamp generated by High-End SRX is wrong
• KB 22281: Syslog rotation time has been changed in 10.4R7

nastavení SNMP
• KB 12142: SNMP monitoring of CPU utilization not working when in JSRP cluster mode
• KB 16545: SRX Getting Started - Configure SNMP Agent
• KB 20788: "snmpwalk" of ifDescr is not returning the same values after upgrading from Junos 10.1 to 10.2
• KB 22048: How to configure SNMPv3 on SRX

NSM
• KB 4394: How Do I View the Juniper Networks NSM Error Logs?
• KB 4503: NSM Log Management
• KB 4514: Transferring an NSM Database From One System to Another
• KB 4548: Why Does a Firewall Device Fail to Connect to the NSM Server?
• KB 4594: How Do I Run the NSM Processes as a Non-Root User?
• KB 4649: Clearing the Email Queue From NSM GUI Server
• KB 5096: How To determine NSM software version
• KB 7115: How To: Generate a Core Dump on NSM Server When System Problem Occurs
• KB 8580: Can NSM send a trap to an SNMP manager when a firewall disconnects from NSM?
• KB 9002: Changing the NSM update timeout in High Latency Network
• KB 9313: devSvrDbSvr shows as Off when checking the status of the devSvr process
• KB 9692: How do I change the IP Address of NSM Server?
• KB 9840: How to enable debug mode for NSM processes
• KB 9844: NSM directive fails with a Java error message similar to"java null.pointer.exception error"
• KB 9851: Where can I find the related error logs when processing directives in NSM?
• KB 10375: How to backup a current NSM install
• KB 11015: What is the directory /var/netscreen/DevSvr/.latest-db-backup in NSMxpress?
• KB 11016: NSM Gui Server does not communicate with Device Server
• KB 11257: Obtain logging rate of devices to NSM
• KB 11263: Proper order for starting and stopping NSM services
• KB 11267: NSM: What is the role of the DevSvr/misc/action/sp directory?
• KB 11476: How to backup NSM: Taking a snapshot of NSM
• KB 11714: NSM: devSvr will not start. devSvrDbSvr fails to start and no new errorLogs are written in errorLogs
• KB 11731: How to Export and Import the NSM database in 2007.1r3 and higher to remove audit logs, old database versions or shrink the database
• KB 11829: NSM DevSvr processes names, definitions, and error logs filenames
• KB 11830: NSM HaSvr processes names, definitions, and error logs filenames
• KB 11598: NSM: how to move an NSM standalone server to a distributed configuration
• KB 12173: NSM installation Package does not give you the MENU choice to upgrade DevSvr/GuiSvr or both
• KB 12285: Three methods of creating a Database backup from the command line interface for NSM
• KB 12367: Can't import device in NSM; stuck in Pending state.
• KB 12707: Understanding NSM Log Management
• KB 12891: How to clear blocked IP addresses from NSM backend ... tip na spuštění /usr/netscreen/GuiSvr/utils/.xdbViewEdit.sh
• KB 13121: NSM: Protocol not enabled 81000102
• KB 13523: How to check the upgrade history of an NSM server
• KB 14868: Export NSM logs to CSV file from the NSM CLI
• KB 14938: NSM - How to adjust retry settings and timeout for JUNOS software upgrade.
• KB 15196: NSM Daily backups fail on Secondary Server
• KB 15643: NSM: Restoring a Database from a Tech-Support
• KB 16166: Where are packet captures stored on the NSM server?
• KB 16655: NSM - Meaning of Red Triangle Error - "Could not get day list"
• KB 17268: Meaning of deviceDaemon.0: "Error 4477856-nsDdNspServer.c:896 GSP message size 16388 > 16384: IDP -> NSM message"
• KB 17358: How to relocate device logs on NSM server to a different directory
• KB 21050: Unable to get logs to NSM from Chassis Cluster in stream mode logging
• KB 22703: JTAC Recommended NSM (Network & Security Manager) Software Versions

konfigurace dynamic-vpn a rádiusu (mimochodem, v RHELu i v gentoo se jedná o adresář /etc/raddb/, v ubuntu to má být /etc/freeradius)
• KB17292 - Dynamic VPN Check license usage & install license
• KB17220 - Dynamic VPN Troubleshoot Dynamic VPN client that is not working (Start here)
• KB17232 - Dynamic VPN Access Manager client is 'Disconnected'
• KB17335 - Dynamic VPN Access Manager client gets 'Authentication Failure: Incorrect Credentials' error
• KB17337 - Dynamic VPN Configuration example using FreeRADIUS
• KB17660 - Dynamic VPN Access Manager client is connected, but can't get to protected resources
• KB17344 - Dynamic VPN Access Manager client gets 'Authentication Failure: No Configuration Available'
• KB17455 - Dynamic VPN Access Manager client gets 'No configuration for user'
• KB17453 - Dynamic VPN 'IKE Negotiations Failed' reported on Access Manager client
• KB17439 - Dynamic VPN Access Manager client gets no error and the 'Connection result:' field is blank (hangs) when attempting to connect to the SRX

Něco od NetScreenů
• WebUI ukládá konfiguraci automaticky
• CLI:
• get config - výpis konfigurace
• get sys-cfg - another hidden command
• save config to tftp - uložení konfigurace na tftp
• save software from flash to tftp
• secure copy - kopírování skrze scp
• set scp enable
• get scp
• get file
• get system
• get system > tftp .
• exec vfs ls flash:/*
• delete file flash:jmeno
• clear session
• get session
• get session | include 192.168.1.1*
• reset
• get log event
• get envar
• get vrouter
• get admin user
• set admin password password priviliege _what_
• set admin root access console
• set admin access attempts 2
• set admin auth banner telnet login "Authorized users only All actions are logged!!!"
• get console
• set console timeout 5
• get user
• get auth
• set admin auth timeout 5
• set/unset admin manager-ip _ipaddress_
• exec tftp 123.123.123.100 cert-name newcertifikat.cet
• set ssl encrypt 3des sha-1
• unset interface untrust manage ping|snmp|telnet
• set admin port 32000
• set admin ssh port 1024
• save config to last-known good
• exec config rollback enable
• unset/set admin device-reset
• unset/set admin hw-reset
• get zone
• set flow tcp-syn-check
• get interface trust port phy
• get route
• get route v6
• get route prefix A.B.C.D/E
• get route | exclude /32
• get route id X
• set vrouter trust-vr route 0.0.0.0/0 vrouter untrust-vr
• set address V1-trust my-pc 1.1.1.11/32
• set policy from V1-trust do V1-untrust my-pc host-2 any permit
• set policy id 5
• set src-address negate ...
• set policy (from zone to zone sa da service action) auth
• set route IP/mask interface ifname gateway gw_
• set ntp timezone -5
• set clock ntp
• exec ntp update
• set interface ethernet2 dhcp server auto
• set interface untrust phy full
• set int tru manage ssh
• unset int tru manage telnet
• set int phy link-down
• set interface ethernet2 dhcp server ip 10.7.0.50 mac 123412341234
• set domain moje.domena
• set dns host dns1 2.33.2.11
• set interface e1 nat
• set ike gateway "dallas" address 10.11.12.1 main outgoing-interface eth0/0 preshare juniper123
• set ike gateway "dallas" address 10.11.12.1 main outgoing-interface eth0/0 preshare juniper123 sec-level standard
• get ike p1-sec-level
• set ike p1-proposal custom1 pre group5 esp aes256 sha seconds 12800
• set ike p1-proposal custom1 pre group5 esp aes256 sha days 7
• set ike gateway "corp" address 10.140.0.3 Aggressive local-id s1 denton@xyzcorp.com" outgoing-interface "ethernet0/0" preshare jun
• get sa
• get db info
• get sys-cfg | inc dbuf
• get mem
• clear dbuf
• get db stream > tftp 10.251.7.113 login_debug.txt
• get log event > tftp 10.251.7.113 eventlog.txt
• set ffilter dst-ip 10.10.10.1 ip-proto 6 dst-port 23
• snoop filter ip src-ip 10.10.10.1 src-port 23
• unset all
• debug: set ff src-ip X.X.X.X set ff dst-ip X.X.X.X (X is the IP of your server) clear dbuf debug flow basic undebug all get db str

[RealJ]

fortinet nebrat... nebrat... nebrat!!!

[👻]

máš typo ve slově fortnite :D ;D